linux-kernel - Re: [linux-next:master] [mm,page_owner] 4bedfb314b: BUG:KASAN:null-ptr-deref_in_init_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZeblmHyVlxl_6HGC@localhost.localdomain>
Date: Tue, 5 Mar 2024 10:27:52 +0100
From: Oscar Salvador <osalvador@...e.de>
To: kernel test robot <oliver.sang@...el.com>
Cc: oe-lkp@...ts.linux.dev, lkp@...el.com,
	Linux Memory Management List <linux-mm@...ck.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Vlastimil Babka <vbabka@...e.cz>, Marco Elver <elver@...gle.com>,
	Andrey Konovalov <andreyknvl@...il.com>,
	Alexander Potapenko <glider@...gle.com>,
	Michal Hocko <mhocko@...e.com>, linux-kernel@...r.kernel.org
Subject: Re: [linux-next:master] [mm,page_owner]  4bedfb314b:
 BUG:KASAN:null-ptr-deref_in_init_page_owner

On Tue, Mar 05, 2024 at 02:08:23PM +0800, kernel test robot wrote:
> 
> [    6.582562][    T0] Node 0, zone    DMA32: page owner found early allocated 0 pages
> [    6.612136][    T0] Node 0, zone   Normal: page owner found early allocated 73871 pages
> [    6.612762][    T0] ==================================================================
> [ 6.613351][ T0] BUG: KASAN: null-ptr-deref in init_page_owner (arch/x86/include/asm/atomic.h:28) 
> [    6.613893][    T0] Write of size 4 at addr 000000000000001c by task swapper/0
> [    6.614434][    T0]
> [    6.614600][    T0] CPU: 0 PID: 0 Comm: swapper Tainted: G                T  6.8.0-rc5-00256-g4bedfb314bdd #1 29e70169ace75ef72d53825e983f3dcb1d5756d9
> [    6.615605][    T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> [    6.616367][    T0] Call Trace:
> [    6.616604][    T0]  <TASK>
> [ 6.616816][ T0] ? dump_stack_lvl (lib/dump_stack.c:?) 
> [ 6.617161][ T0] ? print_report (mm/kasan/report.c:?) 
> [ 6.617499][ T0] ? init_page_owner (arch/x86/include/asm/atomic.h:28) 

So, we are crashing here:

        /* Initialize dummy and failure stacks and link them to stack_list */
        dummy_stack.stack_record = __stack_depot_get_stack_record(dummy_handle);
        failure_stack.stack_record = __stack_depot_get_stack_record(failure_handle);
        refcount_set(&dummy_stack.stack_record->count, 1);
        refcount_set(&failure_stack.stack_record->count, 1);

when trying to set the refcount. Allegedly, because dummy_handle is 0.
I thought we fixed that with 

commit 3ee34eabac2abb6b1b6fcdebffe18870719ad000
Author: Oscar Salvador <osalvador@...e.de>
Date:   Thu Feb 15 22:59:01 2024 +0100

    lib/stackdepot: fix first entry having a 0-handle


But I guess this is different.
The obvious way out is to only set the refcount and link the stacks
if their handles are not 0.

Marco, could it be that stackdepot was too overloaded, that by the time
page_owner gets initialized, there are no more space for its stacks, and
hence return 0-handles?.


-- 
Oscar Salvador
SUSE Labs