linux-kernel - Re: BUG: using __this_cpu_read() in preemptible code in ip6_finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 5 Apr 2019 09:00:23 +0200
From:   Krzysztof Kozlowski <krzk@...nel.org>
To:     syzbot <syzbot+51471b4aae195285a4a3@...kaller.appspotmail.com>
Cc:     alexander.h.duyck@...el.com, amritha.nambiar@...el.com,
        ast@...nel.org, bpf@...r.kernel.org, daniel@...earbox.net,
        davem@...emloft.net, ecree@...arflare.com, fw@...len.de,
        idosch@...lanox.com, jiri@...lanox.com, kafai@...com,
        kuznet@....inr.ac.ru, linux-kernel@...r.kernel.org,
        lirongqing@...du.com, netdev@...r.kernel.org, petrm@...lanox.com,
        sd@...asysnail.net, songliubraving@...com,
        syzkaller-bugs@...glegroups.com, yhs@...com,
        yoshfuji@...ux-ipv6.org
Subject: Re: BUG: using __this_cpu_read() in preemptible code in ip6_finish_output

On Wed, 3 Apr 2019 at 03:14, syzbot
<syzbot+51471b4aae195285a4a3@...kaller.appspotmail.com> wrote:
>
> syzbot has bisected this bug to:
>
> commit 97cdcf37b57e3f204be3000b9eab9686f38b4356
> Author: Florian Westphal <fw@...len.de>
> Date:   Mon Apr 1 14:42:13 2019 +0000
>
>      net: place xmit recursion in softnet data

I am seeing this as well on ARMv7 board booted from NFS root (exynos_defconfig):

[ 30.221238] BUG: using __this_cpu_read() in preemptible [00000000]
code: systemd-network/236
[ 30.228576] caller is ip6_output+0x68/0x3e8
[ 30.232578] CPU: 1 PID: 236 Comm: systemd-network Not tainted
5.1.0-rc3-next-20190405 #2
[ 30.240657] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[ 30.246719] [<c011238c>] (unwind_backtrace) from [<c010df50>]
(show_stack+0x10/0x14)
[ 30.254447] [<c010df50>] (show_stack) from [<c0a87270>] (dump_stack+0x98/0xc4)
[ 30.261638] [<c0a87270>] (dump_stack) from [<c0494a94>]
(__this_cpu_preempt_check+0x124/0x128)
[ 30.270238] [<c0494a94>] (__this_cpu_preempt_check) from [<c08e486c>]
(ip6_output+0x68/0x3e8)
[ 30.278730] [<c08e486c>] (ip6_output) from [<c08e52ac>]
(ip6_send_skb+0x30/0x1d0)
[ 30.286180] [<c08e52ac>] (ip6_send_skb) from [<c0912798>]
(rawv6_sendmsg+0x824/0x9c0)
[ 30.294005] [<c0912798>] (rawv6_sendmsg) from [<c07d8ff8>]
(sock_sendmsg+0x14/0x24)
[ 30.301628] [<c07d8ff8>] (sock_sendmsg) from [<c07d97cc>]
(___sys_sendmsg+0x230/0x244)
[ 30.309514] [<c07d97cc>] (___sys_sendmsg) from [<c07da9f8>]
(__sys_sendmsg+0x50/0x8c)
[ 30.317316] [<c07da9f8>] (__sys_sendmsg) from [<c01011ac>]
(__sys_trace_return+0x0/0x14)
[ 30.325376] Exception stack(0xe79f9fa8 to 0xe79f9ff0)
[ 30.330377] 9fa0: 00000000 b6f3da58 0000000b beeb2a6c 00000000 00000000
[ 30.338560] 9fc0: 00000000 b6f3da58 004015ce 00000128 004b10c8
00000000 020d28f9 00000000
[ 30.346708] 9fe0: 004aeee0 beeb2a40 0047cbdc b6d27684

Full log:
https://krzk.eu/#/builders/22/builds/1055/steps/13/logs/serial0

Best regards,
Krzysztof Kozlowski