lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALAgD-5Vx9-9VSqO1YVg9CS=uWzpYoSpV5zWaV+LZUWtqnw5Wg@mail.gmail.com>
Date: Wed, 28 Aug 2024 16:55:26 -0700
From: Xingyu Li <xli399@....edu>
To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, 
	pabeni@...hat.com, dsahern@...nel.org, kuniyu@...zon.com, 
	shaozhengchao@...wei.com, juntong.deng@...look.com, ryasuoka@...hat.com, 
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: Yu Hao <yhao016@....edu>
Subject: BUG: unable to handle kernel paging request in rht_lock

Hi,

We found a bug in Linux 6.10 using syzkaller. It is possibly a page fault  bug.
The bug report is as follows, but unfortunately there is no generated
syzkaller reproducer.

Bug report:
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
BUG: unable to handle page fault for address: ffffed1056223056
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 13ffee067 P4D 13ffee067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 89058 Comm: kworker/u4:20 Not tainted 6.10.0 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189
Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c
48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80
3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00
RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086
RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0
RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056
R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056
R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0
FS:  0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 test_and_set_bit_lock
include/asm-generic/bitops/instrumented-lock.h:57 [inline]
 bit_spin_lock include/linux/bit_spinlock.h:27 [inline]
 rht_lock+0xfd/0x230 include/linux/rhashtable.h:332
 __rhashtable_remove_fast_one include/linux/rhashtable.h:1012 [inline]
 __rhashtable_remove_fast include/linux/rhashtable.h:1093 [inline]
 rhashtable_remove_fast include/linux/rhashtable.h:1122 [inline]
 netlink_remove net/netlink/af_netlink.c:616 [inline]
 netlink_release+0x400/0x1b00 net/netlink/af_netlink.c:755
 __sock_release net/socket.c:659 [inline]
 sock_release+0x80/0x140 net/socket.c:687
 crypto_netlink_exit+0x3c/0x60 crypto/crypto_user.c:498
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x810/0xcd0 net/core/net_namespace.c:640
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0x977/0x1410 kernel/workqueue.c:3329
 worker_thread+0xaa0/0x1020 kernel/workqueue.c:3409
 kthread+0x2eb/0x380 kernel/kthread.c:389
 ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
CR2: ffffed1056223056
---[ end trace 0000000000000000 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189
Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c
48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80
3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00
RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086
RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0
RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056
R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056
R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0
FS:  0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 4 bytes skipped:
   0: df 4d 8d             fisttps -0x73(%rbp)
   3: 34 19                 xor    $0x19,%al
   5: 4c 89 f5             mov    %r14,%rbp
   8: 4c 29 dd             sub    %r11,%rbp
   b: 48 83 fd 10           cmp    $0x10,%rbp
   f: 7f 2c                 jg     0x3d
  11: 48 85 ed             test   %rbp,%rbp
  14: 0f 84 58 01 00 00     je     0x172
  1a: 49 01 de             add    %rbx,%r14
  1d: 4c 89 dd             mov    %r11,%rbp
  20: 4c 29 f5             sub    %r14,%rbp
  23: 48 01 dd             add    %rbx,%rbp
* 26: 41 80 3b 00           cmpb   $0x0,(%r11) <-- trapping instruction
  2a: 0f 85 dd 01 00 00     jne    0x20d
  30: 49 ff c3             inc    %r11
  33: 48 ff c5             inc    %rbp
  36: 75 ee                 jne    0x26
  38: e9                   .byte 0xe9
  39: 35                   .byte 0x35
  3a: 01 00                 add    %eax,(%rax)


-- 
Yours sincerely,
Xingyu

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ