linux-kernel - bpf: BPF_PROG_TEST_RUN leads to unkillable process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+aUy-3F43ECZACEps4c3GcbqCne9XFV8q7G8Dm8afn6kA@mail.gmail.com>
Date:   Fri, 1 Feb 2019 17:34:16 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>, songliubraving@...com,
        yhs@...com, netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     syzkaller <syzkaller@...glegroups.com>
Subject: bpf: BPF_PROG_TEST_RUN leads to unkillable process

Hello,

The following program leads to an unkillable process that eats CPU in
an infinite loop in BPF_PROG_TEST_RUN syscall. But kernel does not
self-detect cpu/rcu/task stalls either. The program contains max
number of repetitions, but as far as I see the intention is that it
should be killable. I see that bpf_test_run() checks for
signal_pending(current), but it does so only if need_resched() is also
set. Can need_resched() be not set for prolonged periods of time?
/proc/pid/stack is empty, not sure what other info I can provide.

Tested is on upstream commit 4aa9fc2a435abe95a1e8d7f8c7b3d6356514b37a.
Config is attached.

FTR, generated from the following syzkaller program:

r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3,
&(0x7f0000001fd8)=@...med={{0xffffff85, 0x0, 0x0, 0x0, 0x13, 0x5}},
&(0x7f0000000000)='\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0xe, 0x0,
&(0x7f0000000100)="8557147d6187677523fea28c88a8", 0x0,
0xfffffffffffffffe}, 0x28)


// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

int main(void)
{
  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  long res = 0;
  *(uint32_t*)0x20000080 = 3;
  *(uint32_t*)0x20000084 = 3;
  *(uint64_t*)0x20000088 = 0x20001fd8;
  *(uint8_t*)0x20001fd8 = 0x85;
  *(uint8_t*)0x20001fd9 = 0x44;
  *(uint16_t*)0x20001fda = 0;
  *(uint32_t*)0x20001fdc = 0x13;
  *(uint8_t*)0x20001fe0 = 5;
  *(uint8_t*)0x20001fe1 = 0;
  *(uint16_t*)0x20001fe2 = 0;
  *(uint32_t*)0x20001fe4 = 0;
  *(uint8_t*)0x20001fe8 = 0x95;
  *(uint8_t*)0x20001fe9 = 0;
  *(uint16_t*)0x20001fea = 0;
  *(uint32_t*)0x20001fec = 0;
  *(uint64_t*)0x20000090 = 0x20000000;
  memcpy((void*)0x20000000, "\000", 1);
  *(uint32_t*)0x20000098 = 5;
  *(uint32_t*)0x2000009c = 0x487;
  *(uint64_t*)0x200000a0 = 0x2000cf3d;
  *(uint32_t*)0x200000a8 = 0;
  *(uint32_t*)0x200000ac = 0;
  *(uint8_t*)0x200000b0 = 0;
  *(uint8_t*)0x200000b1 = 0;
  *(uint8_t*)0x200000b2 = 0;
  *(uint8_t*)0x200000b3 = 0;
  *(uint8_t*)0x200000b4 = 0;
  *(uint8_t*)0x200000b5 = 0;
  *(uint8_t*)0x200000b6 = 0;
  *(uint8_t*)0x200000b7 = 0;
  *(uint8_t*)0x200000b8 = 0;
  *(uint8_t*)0x200000b9 = 0;
  *(uint8_t*)0x200000ba = 0;
  *(uint8_t*)0x200000bb = 0;
  *(uint8_t*)0x200000bc = 0;
  *(uint8_t*)0x200000bd = 0;
  *(uint8_t*)0x200000be = 0;
  *(uint8_t*)0x200000bf = 0;
  *(uint32_t*)0x200000c0 = 0;
  *(uint32_t*)0x200000c4 = 0;
  int fd = syscall(__NR_bpf, 5, 0x20000080, 0x48);
  *(uint32_t*)0x20000200 = fd;
  *(uint32_t*)0x20000204 = 0;
  *(uint32_t*)0x20000208 = 0xe;
  *(uint32_t*)0x2000020c = 0;
  *(uint64_t*)0x20000210 = 0x20000100;
  memcpy((void*)0x20000100,
         "\x85\x57\x14\x7d\x61\x87\x67\x75\x23\xfe\xa2\x8c\x88\xa8", 14);
  *(uint64_t*)0x20000218 = 0;
  *(uint32_t*)0x20000220 = 0xfffffffe;
  *(uint32_t*)0x20000224 = 0;
  syscall(__NR_bpf, 0xa, 0x20000200, 0x28);
  return 0;
}

Download attachment ".config" of type "application/octet-stream" (157716 bytes)