linux-kernel - Re: [syzbot] [net?] INFO: task hung in unix_dgram

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 9 Feb 2024 12:47:45 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <syzbot+4fa4a2d1f5a5ee06f006@...kaller.appspotmail.com>
CC: <asml.silence@...il.com>, <axboe@...nel.dk>, <davem@...emloft.net>,
	<edumazet@...gle.com>, <kuba@...nel.org>, <kuniyu@...zon.com>,
	<linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>, <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [net?] INFO: task hung in unix_dgram_sendmsg

From: syzbot <syzbot+4fa4a2d1f5a5ee06f006@...kaller.appspotmail.com>
Date: Fri, 09 Feb 2024 11:02:22 -0800
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    1f719a2f3fa6 Merge tag 'net-6.8-rc4' of git://git.kernel.o..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16a21d04180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=53985487b59d9442
> dashboard link: https://syzkaller.appspot.com/bug?extid=4fa4a2d1f5a5ee06f006
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1636f042180000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=141c0cec180000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b8bd7b1c1c4d/disk-1f719a2f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/58ee6966cdfc/vmlinux-1f719a2f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3de15662a476/bzImage-1f719a2f.xz
> 
> The issue was bisected to:
> 
> commit 1279f9d9dec2d7462823a18c29ad61359e0a007d
> Author: Kuniyuki Iwashima <kuniyu@...zon.com>
> Date:   Sat Feb 3 18:31:49 2024 +0000
> 
>     af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17e71d7c180000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=14171d7c180000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10171d7c180000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+4fa4a2d1f5a5ee06f006@...kaller.appspotmail.com
> Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.")

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1279f9d9dec2d7462823a18c29ad61359e0a007d

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 3e4b986de94b..51acf795f096 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -340,10 +340,11 @@ static void __unix_gc(struct work_struct *work)
 	__skb_queue_purge(&hitlist);
 
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
-	list_for_each_entry_safe(u, next, &gc_candidates, link) {
-		struct sk_buff *skb = u->oob_skb;
+	while (!list_empty(&gc_candidates)) {
+		u = list_entry(gc_candidates.next, struct unix_sock, link);
+		if (u->oob_skb) {
+			struct sk_buff *skb = u->oob_skb;
 
-		if (skb) {
 			u->oob_skb = NULL;
 			kfree_skb(skb);
 		}