[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALAgD-5Vx9-9VSqO1YVg9CS=uWzpYoSpV5zWaV+LZUWtqnw5Wg@mail.gmail.com>
Date: Wed, 28 Aug 2024 16:55:26 -0700
From: Xingyu Li <xli399@....edu>
To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
pabeni@...hat.com, dsahern@...nel.org, kuniyu@...zon.com,
shaozhengchao@...wei.com, juntong.deng@...look.com, ryasuoka@...hat.com,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: Yu Hao <yhao016@....edu>
Subject: BUG: unable to handle kernel paging request in rht_lock
Hi,
We found a bug in Linux 6.10 using syzkaller. It is possibly a page fault bug.
The bug report is as follows, but unfortunately there is no generated
syzkaller reproducer.
Bug report:
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
BUG: unable to handle page fault for address: ffffed1056223056
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 13ffee067 P4D 13ffee067 PUD 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 89058 Comm: kworker/u4:20 Not tainted 6.10.0 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189
Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c
48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80
3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00
RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086
RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0
RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056
R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056
R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0
FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
test_and_set_bit_lock
include/asm-generic/bitops/instrumented-lock.h:57 [inline]
bit_spin_lock include/linux/bit_spinlock.h:27 [inline]
rht_lock+0xfd/0x230 include/linux/rhashtable.h:332
__rhashtable_remove_fast_one include/linux/rhashtable.h:1012 [inline]
__rhashtable_remove_fast include/linux/rhashtable.h:1093 [inline]
rhashtable_remove_fast include/linux/rhashtable.h:1122 [inline]
netlink_remove net/netlink/af_netlink.c:616 [inline]
netlink_release+0x400/0x1b00 net/netlink/af_netlink.c:755
__sock_release net/socket.c:659 [inline]
sock_release+0x80/0x140 net/socket.c:687
crypto_netlink_exit+0x3c/0x60 crypto/crypto_user.c:498
ops_exit_list net/core/net_namespace.c:173 [inline]
cleanup_net+0x810/0xcd0 net/core/net_namespace.c:640
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0x977/0x1410 kernel/workqueue.c:3329
worker_thread+0xaa0/0x1020 kernel/workqueue.c:3409
kthread+0x2eb/0x380 kernel/kthread.c:389
ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
CR2: ffffed1056223056
---[ end trace 0000000000000000 ]---
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189
Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c
48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80
3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00
RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086
RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0
RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056
R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056
R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0
FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 4 bytes skipped:
0: df 4d 8d fisttps -0x73(%rbp)
3: 34 19 xor $0x19,%al
5: 4c 89 f5 mov %r14,%rbp
8: 4c 29 dd sub %r11,%rbp
b: 48 83 fd 10 cmp $0x10,%rbp
f: 7f 2c jg 0x3d
11: 48 85 ed test %rbp,%rbp
14: 0f 84 58 01 00 00 je 0x172
1a: 49 01 de add %rbx,%r14
1d: 4c 89 dd mov %r11,%rbp
20: 4c 29 f5 sub %r14,%rbp
23: 48 01 dd add %rbx,%rbp
* 26: 41 80 3b 00 cmpb $0x0,(%r11) <-- trapping instruction
2a: 0f 85 dd 01 00 00 jne 0x20d
30: 49 ff c3 inc %r11
33: 48 ff c5 inc %rbp
36: 75 ee jne 0x26
38: e9 .byte 0xe9
39: 35 .byte 0x35
3a: 01 00 add %eax,(%rax)
--
Yours sincerely,
Xingyu
Powered by blists - more mailing lists