| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <f403043d0f180bb28505662ead84@google.com>
Date: Tue, 27 Feb 2018 01:59:01 -0800
From: syzbot <syzbot+d7a918a7a8e1c952bc36@...kaller.appspotmail.com>
To: akpm@...ux-foundation.org, dan.j.williams@...el.com,
hughd@...gle.com, jglisse@...hat.com,
kirill.shutemov@...ux.intel.com, linux-kernel@...r.kernel.org,
linux-mm@...ck.org, mhocko@...e.com, minchan@...nel.org,
mingo@...nel.org, ross.zwisler@...ux.intel.com,
syzkaller-bugs@...glegroups.com, ying.huang@...el.com
Subject: possible deadlock in __might_fault
Hello,
syzbot hit the following crash on upstream commit
c89be5242607d8aa08a6fa45a887c68b2d4a2a2c (Sun Feb 25 21:43:18 2018 +0000)
Merge tag 'nfs-for-4.16-3' of
git://git.linux-nfs.org/projects/trondmy/linux-nfs
So far this crash happened 1820 times on upstream.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d7a918a7a8e1c952bc36@...kaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.
audit: type=1400 audit(1519638766.030:7): avc: denied { map } for
pid=4243 comm="syzkaller923784" path="/root/syzkaller923784171" dev="sda1"
ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
audit: type=1400 audit(1519638766.030:8): avc: denied { map } for
pid=4243 comm="syzkaller923784" path="/dev/ashmem" dev="devtmpfs" ino=9417
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1
======================================================
WARNING: possible circular locking dependency detected
4.16.0-rc2+ #329 Not tainted
------------------------------------------------------
syzkaller923784/4243 is trying to acquire lock:
(&mm->mmap_sem){++++}, at: [<0000000074c86253>] __might_fault+0xe0/0x1d0
mm/memory.c:4570
but task is already holding lock:
(ashmem_mutex){+.+.}, at: [<0000000024db7f7c>] ashmem_pin_unpin
drivers/staging/android/ashmem.c:705 [inline]
(ashmem_mutex){+.+.}, at: [<0000000024db7f7c>] ashmem_ioctl+0x3db/0x11b0
drivers/staging/android/ashmem.c:782
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (ashmem_mutex){+.+.}:
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893
mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908
ashmem_mmap+0x53/0x410 drivers/staging/android/ashmem.c:362
call_mmap include/linux/fs.h:1786 [inline]
mmap_region+0xa99/0x15a0 mm/mmap.c:1705
do_mmap+0x6c0/0xe00 mm/mmap.c:1483
do_mmap_pgoff include/linux/mm.h:2223 [inline]
vm_mmap_pgoff+0x1de/0x280 mm/util.c:355
SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
SyS_mmap_pgoff+0x462/0x5f0 mm/mmap.c:1491
SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
-> #0 (&mm->mmap_sem){++++}:
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__might_fault+0x13a/0x1d0 mm/memory.c:4571
_copy_from_user+0x2c/0x110 lib/usercopy.c:10
copy_from_user include/linux/uaccess.h:147 [inline]
ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline]
ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(ashmem_mutex);
lock(&mm->mmap_sem);
lock(ashmem_mutex);
lock(&mm->mmap_sem);
*** DEADLOCK ***
1 lock held by syzkaller923784/4243:
#0: (ashmem_mutex){+.+.}, at: [<0000000024db7f7c>] ashmem_pin_unpin
drivers/staging/android/ashmem.c:705 [inline]
#0: (ashmem_mutex){+.+.}, at: [<0000000024db7f7c>]
ashmem_ioctl+0x3db/0x11b0 drivers/staging/android/ashmem.c:782
stack backtrace:
CPU: 1 PID: 4243 Comm: syzkaller923784 Not tainted 4.16.0-rc2+ #329
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223
check_prev_add kernel/locking/lockdep.c:1863 [inline]
check_prevs_add kernel/locking/lockdep.c:1976 [inline]
validate_chain kernel/locking/lockdep.c:2417 [inline]
__lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__might_fault+0x13a/0x1d0 mm/memory.c:4571
_copy_from_user+0x2c/0x110 lib/usercopy.c:10
copy_from_user include/linux/uaccess.h:147 [inline]
ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline]
ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x43fd19
RSP: 002b:00007ffe04d2fda8 EFLAGS: 00000217 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd19
RDX: 0000000000000000 RSI: 0000000000007709 RDI: 0000000000000003
RBP: 000000
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@...glegroups.com.
syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
View attachment "raw.log.txt" of type "text/plain" (7292 bytes)
View attachment "repro.syz.txt" of type "text/plain" (501 bytes)
View attachment "repro.c.txt" of type "text/plain" (614 bytes)
View attachment "config.txt" of type "text/plain" (137429 bytes)
Powered by blists - more mailing lists