linux-kernel - Re: BUG: unable to handle kernel paging request in delayed_put_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 22 Dec 2017 12:34:54 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Paul McKenney <paulmck@...ux.vnet.ibm.com>
Cc:     syzbot 
        <bot+50679d35ad280ab66b83cc309568910ba99dc9f6@...kaller.appspotmail.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Davidlohr Bueso <dave@...olabs.net>,
        LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>, rppt@...ux.vnet.ibm.com,
        Stephen Smalley <sds@...ho.nsa.gov>,
        syzkaller-bugs@...glegroups.com, Al Viro <viro@...iv.linux.org.uk>
Subject: Re: BUG: unable to handle kernel paging request in delayed_put_task_struct

On Tue, Dec 19, 2017 at 7:04 PM, Paul E. McKenney
<paulmck@...ux.vnet.ibm.com> wrote:
> On Tue, Dec 19, 2017 at 01:15:26PM +0100, Dmitry Vyukov wrote:
>> On Sun, Dec 3, 2017 at 3:24 PM, syzbot
>> <bot+50679d35ad280ab66b83cc309568910ba99dc9f6@...kaller.appspotmail.com>
>> wrote:
>> > Hello,
>> >
>> > syzkaller hit the following crash on
>> > 5bef2980adef8a6032d4f4709aebe9486181052f
>> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> > compiler: gcc (GCC) 7.1.1 20170620
>> > .config is attached
>> > Raw console output is attached.
>> >
>> > Unfortunately, I don't have any reproducer for this bug yet.
>
> That does make things more difficult.  Nevertheless...
>
>> > BUG: unable to handle kernel paging request at fffffffffffffff8
>> > IP: delayed_put_task_struct+0x87/0x3d0 kernel/exit.c:178
>> > netlink: 6 bytes leftover after parsing attributes in process
>> > `syz-executor0'.
>> > PGD 5e28067 P4D 5e28067 PUD 5e2a067 PMD 0
>> > Oops: 0002 [#1] SMP KASAN
>> > Dumping ftrace buffer:
>> >    (ftrace buffer empty)
>> > Modules linked in:
>> > CPU: 1 PID: 5363 Comm: syz-executor4 Not tainted 4.15.0-rc1-next-20171128+
>> > #54
>> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>> > Google 01/01/2011
>> > task: ffff8801d8d244c0 task.stack: ffff8801c15d8000
>> > RIP: 0010:delayed_put_task_struct+0x87/0x3d0 kernel/exit.c:178
>> > RSP: 0018:ffff8801db5078b0 EFLAGS: 00010206
>> > RAX: ffff8801d8d244c0 RBX: 1ffff1003b6a0f17 RCX: ffffffff81872631
>> > RDX: 0000000000000100 RSI: 000000003189bbb1 RDI: ffff8801d8bbb480
>> > RBP: ffff8801db507980 R08: 0000000000000005 R09: 0000000000000002
>> > R10: 0000000000000000 R11: ffffffff8748cd60 R12: ffff8801d8bbb5d0
>> > R13: ffff8801d8bbb5d8 R14: ffff8801d8bba1c0 R15: ffff8801db507c58
>> > FS:  00007f251e195700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
>> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> > CR2: fffffffffffffff8 CR3: 00000001980c2000 CR4: 00000000001426e0
>> > Call Trace:
>> >  <IRQ>
>> >  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
>
> If you do find a reproducer, please try reproducing with
> CONFIG_DEBUG_OBJECTS_RCU_HEAD=y, which checks for the call_rcu()
> equivalent to double frees.


This looks like a generally useful config for debugging, so I just
enabled CONFIG_DEBUG_OBJECTS* in all runs.

But this particular bug was already root caused. You can see that it's
marked as a duplicate of "BUG: unable to handle kernel paging request
in __switch_to" in the previous email.
All syzbot reported bugs are here:
https://groups.google.com/forum/#!forum/syzkaller-bugs
You can find "BUG: unable to handle kernel paging request in
__switch_to" there and see what was the resolution.