linux-kernel - Re: WARNING in get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87zh54bp0n.fsf@x220.int.ebiederm.org>
Date:   Fri, 02 Oct 2020 10:56:08 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     syzbot <syzbot+3485e3773f7da290eecc@...kaller.appspotmail.com>
Cc:     axboe@...nel.dk, christian@...uner.io,
        linux-kernel@...r.kernel.org, liuzhiqiang26@...wei.com,
        oleg@...hat.com, syzkaller-bugs@...glegroups.com,
        Tejun Heo <tj@...nel.org>
Subject: Re: WARNING in get_signal

syzbot <syzbot+3485e3773f7da290eecc@...kaller.appspotmail.com> writes:

> Hello,
>
> syzbot found the following issue on:

So this is:

static void do_jobctl_trap(void)
{
	struct signal_struct *signal = current->signal;
	int signr = current->jobctl & JOBCTL_STOP_SIGMASK;

	if (current->ptrace & PT_SEIZED) {
		if (!signal->group_stop_count &&
		    !(signal->flags & SIGNAL_STOP_STOPPED))
			signr = SIGTRAP;
		WARN_ON_ONCE(!signr);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
		ptrace_do_notify(signr, signr | (PTRACE_EVENT_STOP << 8),
				 CLD_STOPPED);
	} else {
		WARN_ON_ONCE(!signr);
		ptrace_stop(signr, CLD_STOPPED, 0, NULL);
		current->exit_code = 0;
	}
}

I have the state of this paged out of my head at the moment.

Oleg or Tejun do you remember what is supposed to keep signr from being
NULL?


It looks like this code was introduced in commit 73ddff2bee15 ("job
control: introduce JOBCTL_TRAP_STOP and use it for group stop trap").

Eric


> HEAD commit:    fcadab74 Merge tag 'drm-fixes-2020-10-01-1' of git://anong..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=116865bd900000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=89ab6a0c48f30b49
> dashboard link: https://syzkaller.appspot.com/bug?extid=3485e3773f7da290eecc
> compiler:       gcc (GCC) 10.1.0-syz 20200507
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1211120b900000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16474c67900000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+3485e3773f7da290eecc@...kaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 6899 at kernel/signal.c:2431 do_jobctl_trap kernel/signal.c:2431 [inline]
> WARNING: CPU: 1 PID: 6899 at kernel/signal.c:2431 get_signal+0x1b5c/0x1f00 kernel/signal.c:2621
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 6899 Comm: syz-executor116 Not tainted 5.9.0-rc7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x198/0x1fd lib/dump_stack.c:118
>  panic+0x382/0x7fb kernel/panic.c:231
>  __warn.cold+0x20/0x4b kernel/panic.c:600
>  report_bug+0x1bd/0x210 lib/bug.c:198
>  handle_bug+0x38/0x90 arch/x86/kernel/traps.c:234
>  exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
>  asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
> RIP: 0010:do_jobctl_trap kernel/signal.c:2431 [inline]
> RIP: 0010:get_signal+0x1b5c/0x1f00 kernel/signal.c:2621
> Code: 00 48 c7 c2 40 da 8a 88 be d1 09 00 00 48 c7 c7 a0 da 8a 88 c6 05 09 8c 09 0a 01 e8 43 97 11 00 e9 42 f5 ff ff e8 14 78 2b 00 <0f> 0b 41 bc 00 80 00 00 e9 49 f9 ff ff 4c 89 ef e8 bf 4d 6c 00 e9
> RSP: 0018:ffffc90005537ce8 EFLAGS: 00010093
> RAX: 0000000000000000 RBX: 0000000100000000 RCX: ffffffff814abfc3
> RDX: ffff88809315c580 RSI: ffffffff814ac67c RDI: 0000000000000005
> RBP: 0000000000000000 R08: 0000000000000001 R09: ffff88809315ca0f
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000008000
> R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
>  arch_do_signal+0x82/0x2520 arch/x86/kernel/signal.c:811
>  exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
>  exit_to_user_mode_prepare+0x1ae/0x200 kernel/entry/common.c:192
>  syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:267
>  ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:287
> RIP: 0033:0x446809
> Code: e8 5c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007fbb8cdd1db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> RAX: 0000000000000000 RBX: 00000000006dbc28 RCX: 0000000000446809
> RDX: 9999999999999999 RSI: 0000000000000000 RDI: 000000000007a900
> RBP: 00000000006dbc20 R08: ffffffffffffffff R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc2c
> R13: 00007ffeca1e9fef R14: 00007fbb8cdd29c0 R15: 20c49ba5e353f7cf
> Shutting down cpus with NMI
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches