linux-kernel - Re: possible deadlock in acct_pin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Mar 2019 09:16:45 +0200
From:   Amir Goldstein <amir73il@...il.com>
To:     syzbot <syzbot+2a73a6ea9507b7112141@...kaller.appspotmail.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        kstewart@...uxfoundation.org,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        mark.rutland@....com, Miklos Szeredi <mszeredi@...hat.com>,
        Oleg Nesterov <oleg@...hat.com>, paulmck@...ux.vnet.ibm.com,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Al Viro <viro@...iv.linux.org.uk>
Subject: Re: possible deadlock in acct_pin_kill

On Wed, Mar 27, 2019 at 5:53 AM syzbot
<syzbot+2a73a6ea9507b7112141@...kaller.appspotmail.com> wrote:
>
> syzbot has bisected this bug to:
>
> commit e950564b97fd0f541b02eb207685d0746f5ecf29
> Author: Miklos Szeredi <mszeredi@...hat.com>
> Date:   Tue Jul 24 13:01:55 2018 +0000
>
>      vfs: don't evict uninitialized inode
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12123143200000
> start commit:   da5322e6 Merge tag 'selinux-pr-20181115' of git://git.kern..
> git tree:       upstream
> final crash:    https://syzkaller.appspot.com/x/report.txt?x=11123143200000
> console output: https://syzkaller.appspot.com/x/log.txt?x=16123143200000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d86f24333880b605
> dashboard link: https://syzkaller.appspot.com/bug?extid=2a73a6ea9507b7112141
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12298533400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17ff545d400000
>
> Reported-by: syzbot+2a73a6ea9507b7112141@...kaller.appspotmail.com
> Fixes: e950564b97fd ("vfs: don't evict uninitialized inode")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

The repro seems fine for catching the subject bug, but I can't get it
to reproduce on my system. I have written a simpler reliable repro.
Its in the commit message of the patch to test below:

#syz test: https://github.com/amir73il/linux.git acct_pin_kill_deadlock

I have been pinging Al about the fix above for a while, but no response:

https://marc.info/?l=linux-fsdevel&m=155119096826039&w=2

However! the bisection did not lead the subject bug, it lead to another
and IMO the bisected commit has nothing to do with the subject bug:

[   95.294877] list_add double add: new=ffff8801b47ebbd0,
prev=ffff8801b99ad438, next=ffff8801b47ebbd0.
[   95.304706] ------------[ cut here ]------------
[   95.309467] kernel BUG at lib/list_debug.c:31!
[   95.314361] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   95.319735] CPU: 0 PID: 7172 Comm: syz-executor0 Not tainted 4.18.0-rc1+ #1
[   95.326823] Hardware name: Google Google Compute Engine/Google
Compute Engine, BIOS Google 01/01/2011
[   95.336194] RIP: 0010:__list_add_valid+0xaa/0xb0
[   95.340942] Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 91 9a 4c fe 48
8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 00 70 fd 87 e8 55
ff f7 fd <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5
41 55
[   95.360083] RSP: 0018:ffff8801b9407188 EFLAGS: 00010282
[   95.365438] RAX: 0000000000000058 RBX: ffff8801b47ebbd0 RCX: 0000000000000000
[   95.372717] RDX: 0000000000000000 RSI: ffffffff87fd6dc0 RDI: ffffffff8a9fc860
[   95.380010] RBP: ffff8801b94071a0 R08: ffffed003b584f99 R09: ffffed003b584f98
[   95.387275] R10: ffffed003b584f98 R11: ffff8801dac27cc7 R12: ffff8801b47ebbd0
[   95.394536] R13: ffff8801b47ebbd0 R14: ffff8801b47eba48 R15: ffff8801b9407228
[   95.401813] FS:  00007f81e0a32700(0000) GS:ffff8801dac00000(0000)
knlGS:0000000000000000
[   95.410029] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   95.415910] CR2: 00000000004cc248 CR3: 00000001bf3dd000 CR4: 00000000001406f0
[   95.423171] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   95.430519] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   95.437781] Call Trace:
[   95.440363]  ? _raw_spin_lock+0x35/0x40
[   95.444330]  inode_sb_list_add+0xff/0x380
[   95.448470]  ? evict_inodes+0x560/0x560
[   95.452448]  ? kasan_check_write+0x14/0x20
[   95.456755]  ? do_raw_spin_lock+0xc1/0x200
[   95.460984]  inode_insert5+0x305/0x540