linux-kernel - Re: WARNING in delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 26 Jul 2020 04:21:15 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     syzbot <syzbot+6324a37c93030377021f@...kaller.appspotmail.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, viro@...iv.linux.org.uk
Subject: Re: WARNING in delete_node (2)

On Sat, Jul 25, 2020 at 10:04:15AM -0700, syzbot wrote:
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 17410 at lib/radix-tree.c:571 delete_node+0x1e7/0x8a0 lib/radix-tree.c:571

Umm.  Interesting.  That's
                WARN_ON_ONCE(!list_empty(&node->private_list));
That list_head is only used by the page cache, and this node is part of
the radix tree of mounts.  So it should have been initialised to empty
and remained empty the entire time it was in use.  It'd be interesting
to get the object file that syzbot ran (at least lib/radix-tree.o) so I
could see from the register dump below what was in node->private_list.
The 'Code' snippet below is, alas, not very interesting because it's
the ud2 instruction, which gcc has correctly shuffled off to the end of
the function.

Or it's a random scribble, or it's bad ram.

> RIP: 0010:delete_node+0x1e7/0x8a0 lib/radix-tree.c:571
> Code: e2 48 c7 43 48 00 00 00 00 48 c1 ea 03 42 80 3c 2a 00 0f 85 bb 05 00 00 48 8b 55 18 49 39 d4 0f 84 8b 03 00 00 e8 e9 6c c3 fd <0f> 0b 48 c7 c6 d0 a6 b0 83 4c 89 e7 e8 b8 d7 b0 fd 4d 85 f6 0f 85
> RSP: 0018:ffffc900078afd08 EFLAGS: 00010246
> RAX: 0000000000040000 RBX: ffffffff89d2df00 RCX: ffffc90013fcd000
> RDX: 0000000000040000 RSI: ffffffff83b0d377 RDI: ffff8880a9c90842
> RBP: ffff88808a91ab40 R08: 0000000000000000 R09: ffff8880a9c90a6f
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808a91ab58
> R13: dffffc0000000000 R14: ffff8880a9c90840 R15: 000000000000000a
>  __radix_tree_delete+0x190/0x370 lib/radix-tree.c:1378
>  radix_tree_delete_item+0xe7/0x230 lib/radix-tree.c:1429
>  mnt_free_id fs/namespace.c:131 [inline]