linux-kernel - Re: [syzbot] INFO: task hung in vhost_work_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220221163909.xfrgt6slp3ksqr2w@sgarzare-redhat>
Date:   Mon, 21 Feb 2022 17:39:09 +0100
From:   Stefano Garzarella <sgarzare@...hat.com>
To:     Anirudh Rayabharam <mail@...rudhrb.com>
Cc:     syzbot <syzbot+0abd373e2e50d704db87@...kaller.appspotmail.com>,
        Jason Wang <jasowang@...hat.com>, kvm <kvm@...r.kernel.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        Michael Tsirkin <mst@...hat.com>,
        netdev <netdev@...r.kernel.org>, syzkaller-bugs@...glegroups.com,
        Linux Virtualization <virtualization@...ts.linux-foundation.org>
Subject: Re: [syzbot] INFO: task hung in vhost_work_dev_flush

On Mon, Feb 21, 2022 at 09:23:04PM +0530, Anirudh Rayabharam wrote:
>On Mon, Feb 21, 2022 at 03:12:33PM +0100, Stefano Garzarella wrote:
>> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
>> f71077a4d84b
>>
>> Patch sent upstream:
>> https://lore.kernel.org/virtualization/20220221114916.107045-1-sgarzare@redhat.com/T/#u
>
>I don't see how your patch fixes this issue. It looks unrelated. It is
>surprising that syzbot is happy with it.
>
>I have sent a patch for this issue here:
>https://lore.kernel.org/lkml/20220221072852.31820-1-mail@anirudhrb.com/

It is related because the worker thread is accessing the iotlb that is 
going to be freed, so it could be corrupted/invalid.

Your patch seems right, but simply prevents iotlb from being set for the 
the specific test case, so it remains NULL and iotlb_access_ok() exits 
immediately.

Anyway, currently if nregions is 0 vhost_set_memory() sets an iotlb with 
no regions (the for loop is not executed), so I'm not sure 
iotlb_access_ok() cycles infinitely.

Stefano