| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <94eb2c05a5301d7ed20561a25c5c@google.com>
Date: Sun, 31 Dec 2017 04:54:01 -0800
From: syzbot
<syzbot+ca425f44816d749e8eb49755567a75ee48cf4a30@...kaller.appspotmail.com>
To: JBeulich@...e.com, davem@...emloft.net,
herbert@...dor.apana.org.au, hpa@...or.com, jpoimboe@...hat.com,
kirill.shutemov@...ux.intel.com, ldufour@...ux.vnet.ibm.com,
linux-kernel@...r.kernel.org, luto@...nel.org, mingo@...hat.com,
netdev@...r.kernel.org, steffen.klassert@...unet.com,
syzkaller-bugs@...glegroups.com, tglx@...utronix.de, x86@...nel.org
Subject: suspicious RCU usage at ./include/linux/rcupdate.h:LINE (2)
syzkaller has found reproducer for the following crash on
6bb8824732f69de0f233ae6b1a8158e149627b38
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by:
syzbot+ca425f44816d749e8eb49755567a75ee48cf4a30@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed.
audit: type=1400 audit(1514724677.759:7): avc: denied { map } for
pid=3495 comm="syzkaller246415" path="/root/syzkaller246415126" dev="sda1"
ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
=============================
WARNING: suspicious RCU usage
4.15.0-rc5+ #171 Not tainted
-----------------------------
./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side
critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syzkaller246415/3495:
#0: (&net->xfrm.xfrm_cfg_mutex){+.+.}, at: [<0000000085c20885>]
xfrm_netlink_rcv+0x60/0x90 net/xfrm/xfrm_user.c:2598
#1: (rcu_read_lock){....}, at: [<00000000bee17d16>]
xfrm_state_get_afinfo+0x62/0x280 net/xfrm/xfrm_state.c:2157
stack backtrace:
CPU: 1 PID: 3495 Comm: syzkaller246415 Not tainted 4.15.0-rc5+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4585
rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline]
___might_sleep+0x385/0x470 kernel/sched/core.c:6025
__might_sleep+0x95/0x190 kernel/sched/core.c:6013
slab_pre_alloc_hook mm/slab.h:419 [inline]
slab_alloc mm/slab.c:3368 [inline]
kmem_cache_alloc_trace+0x298/0x750 mm/slab.c:3608
kmalloc include/linux/slab.h:499 [inline]
call_modprobe kernel/kmod.c:80 [inline]
__request_module+0x2e1/0xc20 kernel/kmod.c:171
xfrm_get_type_offload net/xfrm/xfrm_state.c:317 [inline]
__xfrm_init_state+0xa61/0xdd0 net/xfrm/xfrm_state.c:2257
xfrm_state_construct net/xfrm/xfrm_user.c:590 [inline]
xfrm_add_sa+0x1a09/0x33e0 net/xfrm/xfrm_user.c:646
xfrm_user_rcv_msg+0x422/0x860 net/xfrm/xfrm_user.c:2591
netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2441
xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2599
netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline]
netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897
sock_sendmsg_nosec net/socket.c:628 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:638
___sys_sendmsg+0x767/0x8b0 net/socket.c:2018
__sys_sendmsg+0xe5/0x210 net/socket.c:2052
SYSC_sendmsg net/socket.c:2063 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2059
entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x4400c9
RSP: 002b:00007ffe9973f518 EFLAGS: 00000203 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004400c9
RDX: 0000000000000000 RSI: 0000000020004000 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 0000000000401a30
R13: 0000000000401ac0 R14: 0000000000000000 R15: 0000000000000000
BUG: sleeping function called from invalid context at mm/slab.h:419
in_atomic(): 1, irqs_disabled(): 0, pid: 3495, name: syzkaller246415
2 locks held by syzkaller246415/3495:
#0: (&net->xfrm.xfrm_cfg_mutex){+.+.}, at: [<0000000085c20885>]
xfrm_netlink_rcv+0x60/0x90 net/xfrm/xfrm_user.c:2598
#1: (rcu_read_lock){....}, at: [<00000000bee17d16>]
xfrm_state_get_afinfo+0x62/0x280 net/xfrm/xfrm_state.c:2157
CPU: 1 PID: 3495 Comm: syzkaller246415 Not tainted 4.15.0-rc5+ #171
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060
__might_sleep+0x95/0x190 kernel/sched/core.c:6013
slab_pre_alloc_hook mm/slab.h:419 [inline]
slab_alloc mm/slab.c:3368 [inline]
kmem_cache_alloc_trace+0x298/0x750 mm/slab.c:3608
kmalloc include/linux/slab.h:499 [inline]
call_modprobe kernel/kmod.c:80 [inline]
__request_module+0x2e1/0xc20 kernel/kmod.c:171
xfrm_get_type_offload net/xfrm/xfrm_state.c:317 [inline]
__xfrm_init_state+0xa61/0xdd0 net/xfrm/xfrm_state.c:2257
xfrm_state_construct net/xfrm/xfrm_user.c:590 [inline]
xfrm_add_sa+0x1a09/0x33e0 net/xfrm/xfrm_user.c:646
xfrm_user_rcv_msg+0x422/0x860 net/xfrm/xfrm_user.c:2591
netlink_rcv_skb+0x224/0x470 net/netlink/af_netlink.c:2441
xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2599
netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline]
netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897
sock_sendmsg_nosec net/socket.c:628 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:638
___sys_sendmsg+0x767/0x8b0 net/socket.c:2018
__sys_sendmsg+0xe5/0x210 net/socket.c:2052
SYSC_sendmsg net/socket.c:2063 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2059
entry_SYSCALL_64_fastpath+0x23/0x9a
RIP: 0033:0x4400c9
RSP: 002b:00007ffe9973f518 EFLAGS: 00000203 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004400c9
RDX: 0000000000000000 RSI: 0000000020004000 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000203 R12: 0000000000401a30
R13: 0000000000401ac0 R14: 0000000000000000 R15: 0000000000000000
BUG: scheduling while atomic: syzkaller246415/3495/0x00000002
2 locks held by syzkaller246415/3495:
#0: (&net->xfrm.xfrm_cfg_mutex){+.+.}, at: [<0000000085c20885>]
xfrm_netlink_rcv+0x60/0x90 net/xfrm/xfrm_user.c:2598
#1: (rcu_read_lock){....}, at: [<00000000bee17d16>]
xfrm_state_get_afinfo+0x62/0x280 net/xfrm/xfrm_state.c:2157
Modules linked in:
View attachment "config.txt" of type "text/plain" (134059 bytes)
Download attachment "raw.log" of type "application/octet-stream" (17208 bytes)
View attachment "repro.txt" of type "text/plain" (1115 bytes)
Download attachment "repro.c" of type "application/octet-stream" (4043 bytes)
Powered by blists - more mailing lists