linux-kernel - Re: WARNING in syscall_exit_to_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 13 Sep 2020 21:40:14 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     syzbot <syzbot+7ffc7214b893651d52b8@...kaller.appspotmail.com>,
        keescook@...omium.org, linux-kernel@...r.kernel.org,
        mingo@...nel.org, syzkaller-bugs@...glegroups.com,
        Christian Brauner <christian@...uner.io>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: WARNING in syscall_exit_to_user_mode

On Fri, Sep 11 2020 at 03:39, syzbot wrote:
>
> ------------[ cut here ]------------
> syscall 56 left IRQs disabled

Ouch. syscall 56 == sys_clone

> WARNING: CPU: 1 PID: 31467 at kernel/entry/common.c:245 syscall_exit_to_user_mode_prepare kernel/entry/common.c:245 [inline]

<snip>

>  ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:287

But this does not make any sense for regular fork because
ret_from_fork() invokes schedule_tail() which drops the runqueue lock
and enables interrupts.

But for kernel threads that's more interesting because after
schedule_tail() the kernel thread function is invoked and this can call
kernel_execve() and return to ret_from_fork() and then run through
syscall_exit_to_user_mode().

Let me get that reproducer...