linux-kernel - Re: WARNING: suspicious RCU usage (3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171130004743.GB65846@gmail.com>
Date:   Wed, 29 Nov 2017 16:47:43 -0800
From:   Eric Biggers <ebiggers3@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     syzbot 
        <bot+73a7bec1bc0f4fc0512a246334081f8c671762a8@...kaller.appspotmail.com>,
        cl@...ux.com, iamjoonsoo.kim@....com, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, penberg@...nel.org, rientjes@...gle.com,
        syzkaller-bugs@...glegroups.com,
        "Paul E. McKenney" <paulmck@...ibm.com>,
        Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: WARNING: suspicious RCU usage (3)

On Tue, Nov 28, 2017 at 09:06:06PM -0800, Eric Biggers wrote:
> On Tue, Nov 28, 2017 at 01:30:26PM -0800, Andrew Morton wrote:
> > 
> > It looks like blkcipher_walk_done() passed a bad address to kfree().
> > 
> 
> Indeed, it's freeing uninitialized memory because the Salsa20 algorithms are
> using the blkcipher_walk API incorrectly.  I've sent a patch to fix it:
> 
> "crypto: salsa20 - fix blkcipher_walk API usage"
> 
> I am not sure why the bug reports show up as "suspicious RCU usage", though.
> 
> There were also a few other syzbot reports of this same underlying bug; I marked
> them as duplicates of this one.
> 

The reason the "suspicious RCU usage" warning appeared is that due to the
incorrect call to blkcipher_walk_done(), kunmap_atomic() was being called
without a preceding kmap_atomic(), causing the preemption count to get screwed
up.  This was in addition to the uninitialized pointer being kfree()'d.

Running a reproducer does show more information after the "WARNING: suspicious
RCU usage" (see below).  So it does look like the report from syzkaller was
truncated, perhaps because two things went wrong right after each other.

Also, maybe enabling CONFIG_DEBUG_PREEMPT would be useful?

[    9.136392] 
[    9.137202] =============================
[    9.138014] WARNING: suspicious RCU usage
[    9.138909] 4.15.0-rc1-00033-gef0010a30935 #113 Not tainted
[    9.141195] -----------------------------
[    9.142145] ./include/trace/events/kmem.h:142 suspicious rcu_dereference_check() usage!
[    9.144400] 
[    9.144400] other info that might help us debug this:
[    9.144400] 
[    9.146292] 
[    9.146292] rcu_scheduler_active = 2, debug_locks = 1
[    9.148203] 1 lock held by syz_salsa20/625:
[    9.149215]  #0:  (sk_lock-AF_ALG){+.+.}, at: [<00000000e0f6099e>] af_alg_wait_for_data+0xd8/0x150
[    9.151682] 
[    9.151682] stack backtrace:
[    9.152658] CPU: 1 PID: 625 Comm: syz_salsa20 Not tainted 4.15.0-rc1-00033-gef0010a30935 #113
[    9.154669] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[    9.156408] Call Trace:
[    9.156964]  dump_stack+0x7c/0xb3
[    9.157696]  kfree+0x1c1/0x210
[    9.158377]  blkcipher_walk_done+0x21c/0x2c0
[    9.159319]  encrypt+0x7b/0xd0
[    9.160000]  ? skcipher_decrypt_blkcipher+0x40/0x50
[    9.161061]  ? skcipher_recvmsg+0x37a/0x3a0
[    9.161981]  ? sock_read_iter+0x93/0xd0
[    9.162835]  ? __vfs_read+0xcc/0x140
[    9.163582]  ? vfs_read+0x9c/0x130
[    9.164282]  ? SyS_read+0x45/0xb0
[    9.164974]  ? entry_SYSCALL_64_fastpath+0x1f/0x96
[    9.166015] kfree_debugcheck: out of range ptr 28h
[    9.166985] ------------[ cut here ]------------
[    9.167834] kernel BUG at mm/slab.c:2753!
[    9.168584] invalid opcode: 0000 [#1] SMP
[    9.169335] CPU: 1 PID: 625 Comm: syz_salsa20 Not tainted 4.15.0-rc1-00033-gef0010a30935 #113
[    9.171067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[    9.172689] task: 00000000ee01d793 task.stack: 0000000004031a33
[    9.173885] RIP: 0010:kfree_debugcheck+0x23/0x30
[    9.174833] RSP: 0018:ffffb46b0092fc80 EFLAGS: 00010096
[    9.175857] RAX: 0000000000000026 RBX: 0000000000000028 RCX: 0000000000000000
[    9.177218] RDX: 0000000000000001 RSI: ffff99daff5cccc8 RDI: ffff99daff5cccc8
[    9.178555] RBP: 0000000000000206 R08: 0000000000000001 R09: 0000000000000001
[    9.179923] R10: 000000001f5d6993 R11: 0000000000000000 R12: ffffffff85b64b1c
[    9.181284] R13: 0000000000000000 R14: ffffb46b0092fd98 R15: ffff99daf87b9000
[    9.182617] FS:  00000000013bb880(0000) GS:ffff99daff400000(0000) knlGS:0000000000000000
[    9.184148] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    9.185246] CR2: 00007f087bad7008 CR3: 0000000079f52003 CR4: 00000000001606e0
[    9.186608] Call Trace:
[    9.187081]  kfree+0x5a/0x210
[    9.187602]  blkcipher_walk_done+0x21c/0x2c0
[    9.188370]  encrypt+0x7b/0xd0
[    9.188933]  ? skcipher_decrypt_blkcipher+0x40/0x50
[    9.189796]  ? skcipher_recvmsg+0x37a/0x3a0
[    9.190541]  ? sock_read_iter+0x93/0xd0
[    9.191241]  ? __vfs_read+0xcc/0x140
[    9.191897]  ? vfs_read+0x9c/0x130
[    9.192502]  ? SyS_read+0x45/0xb0
[    9.193110]  ? entry_SYSCALL_64_fastpath+0x1f/0x96
[    9.193959] Code: 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb e8 32 f5 e1 ff 84 c0 74 02 5b c3 48 89 de 48 c7 c7 50 9c 21 86 e8 9a a0 f1 ff <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 89 
[    9.197364] RIP: kfree_debugcheck+0x23/0x30 RSP: ffffb46b0092fc80
[    9.198455] ---[ end trace 833d54cb4ca6de67 ]---
[    9.199291] Kernel panic - not syncing: Fatal exception in interrupt
[    9.200595] Kernel Offset: 0x4600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[    9.202405] Rebooting in 5 seconds..