linux-kernel - Re: [syzbot] [bpf?] possible deadlock in get_page_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 20 May 2024 19:44:31 +0800
From: Hou Tao <houtao@...weicloud.com>
To: Pengfei Xu <pengfei.xu@...el.com>,
 syzbot <syzbot+a7f061d2d16154538c58@...kaller.appspotmail.com>,
 ytcoode@...il.com
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, eddyz87@...il.com, haoluo@...gle.com,
 john.fastabend@...il.com, jolsa@...nel.org, kpsingh@...nel.org,
 linux-kernel@...r.kernel.org, martin.lau@...ux.dev, sdf@...gle.com,
 song@...nel.org, syzkaller-bugs@...glegroups.com, yonghong.song@...ux.dev,
 akpm@...ux-foundation.org
Subject: Re: [syzbot] [bpf?] possible deadlock in get_page_from_freelist

Hi

On 5/17/2024 3:15 PM, Pengfei Xu wrote:
> Hi Yuntao,
>
> Greeting!
>
> On 2024-04-14 at 19:28:16 -0700, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    7efd0a74039f Merge tag 'ata-6.9-rc4' of git://git.kernel.o..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1358aeed180000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=285be8dd6baeb438
>> dashboard link: https://syzkaller.appspot.com/bug?extid=a7f061d2d16154538c58
>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
> I used syzkaller and could reproduce the similar issue "WARNING in
> get_page_from_freelist" in v6.9 mainline kernel.

The warning report is different with the dead-lock syzbot report. The
warning is "WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1))" in
rmqueue() and it is caused by "kzalloc(sizeof(struct xfs_mount),
GFP_KERNEL | __GFP_NOFAIL)" in xfs_init_fs_context().
>
> Bisected and found first bad commit:
> "
> 816d334afa85 kexec: modify the meaning of the end parameter in kimage_is_destination_range()
> "
> Revert above commit on top of v6.9 kernel this issue was gone.
>
> All detailed info: https://github.com/xupengfe/syzkaller_logs/tree/main/240517_085953_get_page_from_freelist
> mount_*.gz are in above link.
> Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/rep.c
> Syzkaller syscall repro steps: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.prog
> Syzkaller report: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.report

I think it is a false positive, because without KASAN enabled, the size
of xfs_mount is about 2496 bytes and it is impossible to trigger the
WARN_ON_ONCE(). However with KASAN enabled, the size of xfs_mount will
be greater than 4096, so the warning will be triggered accordingly when
the 8KB-slab needs to refill its slabs.