linux-kernel - Re: WARNING in syscall_exit_to_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202009141304.811BAC4A0@keescook>
Date:   Mon, 14 Sep 2020 13:06:59 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     linux-kernel@...r.kernel.org, mingo@...nel.org,
        syzbot <syzbot+7ffc7214b893651d52b8@...kaller.appspotmail.com>,
        syzkaller-bugs@...glegroups.com, Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: WARNING in syscall_exit_to_user_mode

On Sun, Sep 13, 2020 at 09:54:34PM +0200, Thomas Gleixner wrote:
> On Sat, Sep 12 2020 at 10:52, Kees Cook wrote:
> >> ------------[ cut here ]------------
> >> syscall 56 left IRQs disabled
> >
> > This WARN appears reachable. :)
> 
> The above is hardly a problem of the new entry code. It's just detecting
> the wreckage...

Oh, well that's actually even better! :)

> > I also see on the dashboard these other problems with the new entry
> > code:
> 
> > https://syzkaller.appspot.com/bug?extid=d4336c84ed0099fdbe47
>
> This one is also just the messenger. That's the
> 
>      lockdep_assert_irqs_disabled();
> 
> in irqentry_exit() if I'm reading the reports correctly. That's a #PF
> returning with interrupts enabled for whatever weird reason. Let me
> stare at that...

Cool; thanks.

> > https://syzkaller.appspot.com/bug?extid=c4af95386364bc59b13e
> 
> This one is not a new entry code problem either:
> [...]
> The new entry code is just in the stack trace because that task was
> preempted after a timer interrupt.

This seems a bit like the first issue: it's just getting noticed now?

-- 
Kees Cook