linux-kernel - Re: BUG: MAX_STACK_TRACE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1552328239.45180.101.camel@acm.org>
Date:   Mon, 11 Mar 2019 11:17:19 -0700
From:   Bart Van Assche <bvanassche@....org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     syzbot <syzbot+78923eea7cf44364f4fb@...kaller.appspotmail.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Darrick J. Wong" <darrick.wong@...cle.com>, dledford@...hat.com,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        Christoph Hellwig <hch@...radead.org>,
        Jann Horn <jannh@...gle.com>, Jason Gunthorpe <jgg@...pe.ca>,
        johannes.berg@...el.com, leon@...nel.org,
        Linux List Kernel Mailing <linux-kernel@...r.kernel.org>,
        linux-rdma@...r.kernel.org, linux-xfs@...r.kernel.org,
        Waiman Long <longman@...hat.com>,
        Ingo Molnar <mingo@...nel.org>, Ingo Molnar <mingo@...hat.com>,
        Paul McKenney <paulmck@...ux.vnet.ibm.com>,
        Peter Zijlstra <peterz@...radead.org>, roland@...estorage.com,
        sean.hefty@...el.com, shamir.rabinovitch@...cle.com,
        swise@...ngridcomputing.com, syzkaller-bugs@...glegroups.com,
        Thomas Gleixner <tglx@...utronix.de>,
        Tejun Heo <tj@...nel.org>, Will Deacon <will.deacon@....com>,
        Cong Wang <xiyou.wangcong@...il.com>
Subject: Re: BUG: MAX_STACK_TRACE_ENTRIES too low!

On Mon, 2019-03-11 at 10:48 -0700, Linus Torvalds wrote:
> On Mon, Mar 11, 2019 at 8:19 AM Bart Van Assche <bvanassche@....org> wrote:
> > 
> > I think this issue has been fixed by a commit that went upstream yesterday. Hence:
> > 
> > #syz fix: workqueue, lockdep: Fix an alloc_workqueue() error path
> 
> Well, syzbot just reported a problem with that fix itself ("WARNING in
> lockdep_unregister_key").
> 
> Looks like now the lockdep_unregister_key() cleanup might be called
> even when the lockdep map was never initialized at all in that error
> case. Hmm?
> 
> I _think_ you need to split that "err_free_wq" label into "just free
> the wq" and "unregister lockdep and free wq".
> 
> But I didn't look any more closely, I might be misreading things.

Hi Linus,

>From the console output of the syzbot bug report at the start of this
e-mail thread:

WARNING: CPU: 1 PID: 7649 at kernel/locking/lockdep.c:747 register_lock_class+0x10de/0x2220

On line 747 in lockdep.c there is the following warning statement:

			WARN_ON_ONCE(class->name != lock->name);

My interpretation is that this means that a lockdep key got reregistered
without unregistration between the two registration calls. That's why I
posted my "#syz fix: workqueue, lockdep: Fix an alloc_workqueue() error
path" reply.

The latest syzbot complaint is different. In the console output of the latest
report I found the following:

WARNING: CPU: 1 PID: 6970 at kernel/locking/lockdep.c:4925 lockdep_unregister_key+0x21c/0x4e0

On line 4925 there is the following warning statement:

	WARN_ON_ONCE(!found);

In other words, lockdep_unregister_key() got called for a key that was never
registered.

I agree with your conclusion that the err_free_wq label needs to be split. I
will post a patch that realizes this.

Bart.