linux-kernel - Re: [syzbot] [kernel?] possible deadlock in stack_depot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZWRbTP3GvohuKY3d@gmail.com>
Date:   Mon, 27 Nov 2023 10:03:08 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     xingwei lee <xrivendell7@...il.com>
Cc:     syzbot+186b55175d8360728234@...kaller.appspotmail.com,
        frederic@...nel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, tglx@...utronix.de
Subject: Re: [syzbot] [kernel?] possible deadlock in stack_depot_put


* xingwei lee <xrivendell7@...il.com> wrote:

> Sorry for containing HTML subpart, I'll repeat this mail.
> Hi, I reproduce this bug with repro.c and repro.txt and confirmed crash.
> 
> repro.txt
> r0 = socket$alg(0x26, 0x5, 0x0)
> bind$alg(r0, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0,
> 'ecb-cipher_null\x00'}, 0x58)
> r1 = accept$alg(r0, 0x0, 0x0)
> r2 = dup(r1)
> open(&(0x7f0000000140)='./file1\x00', 0x10f0c2, 0x0)
> r3 = dup(r1)
> mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040),
> 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3,
> @ANYBLOB=',wfdno=', @ANYRESHEX=r2])
> 
> repro.c
> 
> #define _GNU_SOURCE
> 
> #include <dirent.h>
> #include <endian.h>
> #include <errno.h>
> #include <fcntl.h>
> #include <signal.h>
> #include <stdarg.h>
> #include <stdbool.h>
> #include <stdint.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/prctl.h>
> #include <sys/stat.h>
> #include <sys/syscall.h>
> #include <sys/types.h>
> #include <sys/wait.h>
> #include <time.h>
> #include <unistd.h>
> 
> static void sleep_ms(uint64_t ms)
> {
> usleep(ms * 1000);
> }
> 
> static uint64_t current_time_ms(void)
> {
> struct timespec ts;
> if (clock_gettime(CLOCK_MONOTONIC, &ts))
> exit(1);
> return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
> }
> 
> static bool write_file(const char* file, const char* what, ...)
> {
> char buf[1024];
> va_list args;
> va_start(args, what);
> vsnprintf(buf, sizeof(buf), what, args);
> va_end(args);
> buf[sizeof(buf) - 1] = 0;
> int len = strlen(buf);
> int fd = open(file, O_WRONLY | O_CLOEXEC);
> if (fd == -1)
> return false;
> if (write(fd, buf, len) != len) {
> int err = errno;
> close(fd);
> errno = err;
> return false;

BTW., could you please run such autogenerated repro.c files through
"indent --linux-style"? See below, the code becomes much more readable.

Thanks,

	Ingo

============================>
#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;

	if (clock_gettime(CLOCK_MONOTONIC, &ts))
		exit(1);
	return (uint64_t) ts.tv_sec * 1000 + (uint64_t) ts.tv_nsec / 1000000;
}

static bool write_file(const char *file, const char *what, ...)
{
	char buf[1024];
	va_list args;

	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);

	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;

		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

static void kill_and_wait(int pid, int *status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR *dir = opendir("/sys/fs/fuse/connections");

	if (dir) {
		for (;;) {
			struct dirent *ent = readdir(dir);

			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0
			    || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];

			snprintf(abort, sizeof(abort),
				 "/sys/fs/fuse/connections/%s/abort",
				 ent->d_name);
			int fd = open(abort, O_WRONLY);

			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;

	for (;; iter++) {
		int pid = fork();

		if (pid < 0)
			exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();

		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
			if (current_time_ms() - start < 5000)
				continue;
			kill_and_wait(pid, &status);
			break;
		}
	}
}

uint64_t r[4] = { 0xffffffffffffffff, 0xffffffffffffffff,
	0xffffffffffffffff, 0xffffffffffffffff
};

void execute_one(void)
{
	intptr_t res = 0;

	res = syscall(__NR_socket, /*domain= */ 0x26ul, /*type= */ 5ul,
		      /*proto= */ 0);
	if (res != -1)
		r[0] = res;
	*(uint16_t *) 0x20000440 = 0x26;
	memcpy((void *)0x20000442, "skcipher\000\000\000\000\000\000", 14);
	*(uint32_t *) 0x20000450 = 0;
	*(uint32_t *) 0x20000454 = 0;
	memcpy((void *)0x20000458,
	       "ecb-cipher_null\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000",
	       64);
	syscall(__NR_bind, /*fd= */ r[0], /*addr= */ 0x20000440ul,	/*addrlen= */
		0x58ul);
	res = syscall(__NR_accept, /*fd= */ r[0], /*peer= */ 0ul,	/*peerlen= */
		      0ul);
	if (res != -1)
		r[1] = res;
	res = syscall(__NR_dup, /*oldfd= */ r[1]);
	if (res != -1)
		r[2] = res;
	memcpy((void *)0x20000140, "./file1\000", 8);
	syscall(__NR_open, /*file= */ 0x20000140ul, /*flags= */ 0x10f0c2ul,
		/*mode= */ 0ul);
	res = syscall(__NR_dup, /*oldfd= */ r[1]);
	if (res != -1)
		r[3] = res;
	memcpy((void *)0x20000000, "./file1\000", 8);
	memcpy((void *)0x20000040, "9p\000", 3);
	memcpy((void *)0x20000a40, "trans=fd,rfdno=", 15);
	sprintf((char *)0x20000a4f, "0x%016llx", (long long)r[3]);
	memcpy((void *)0x20000a61, ",wfdno=", 7);
	sprintf((char *)0x20000a68, "0x%016llx", (long long)r[2]);
	syscall(__NR_mount, /*src= */ 0ul, /*dst= */ 0x20000000ul,
		/*type= */ 0x20000040ul, /*flags= */ 0ul,	/*opts= */
		0x20000a40ul);

}

int main(void)
{
	syscall(__NR_mmap, /*addr= */ 0x1ffff000ul, /*len= */ 0x1000ul,
		/*prot= */ 0ul, /*flags= */ 0x32ul, /*fd= */ -1,	/*offset= */
		0ul);
	syscall(__NR_mmap, /*addr= */ 0x20000000ul, /*len= */ 0x1000000ul,
		/*prot= */ 7ul, /*flags= */ 0x32ul, /*fd= */ -1,	/*offset= */
		0ul);
	syscall(__NR_mmap, /*addr= */ 0x21000000ul, /*len= */ 0x1000ul,
		/*prot= */ 0ul, /*flags= */ 0x32ul, /*fd= */ -1,	/*offset= */
		0ul);
	loop();
	return 0;
}