linux-kernel - Re: "INFO: rcu detected stall in sys_sendfile64" in Linux kernel version 6.13.0-rc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250104000408.GE1977892@ZenIV>
Date: Sat, 4 Jan 2025 00:04:08 +0000
From: Al Viro <viro@...iv.linux.org.uk>
To: cheung wall <zzqq0103.hey@...il.com>
Cc: Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: "INFO: rcu detected stall in sys_sendfile64" in Linux kernel
 version 6.13.0-rc2

On Fri, Jan 03, 2025 at 04:20:28PM +0800, cheung wall wrote:
> Hello,
> 
> I am writing to report a potential vulnerability identified in the
> Linux Kernel version 6.13.0-rc2. This issue was discovered using our
> custom vulnerability discovery tool.
> 
> HEAD commit: fac04efc5c793dccbd07e2d59af9f90b7fc0dca4 (tag: v6.13-rc2)
> 
> Detailed Call Stack:
> 
> ------------[ cut here begin]------------

Ugh...  Your tool is, by the look of it, some kind of fuzzer.
If that is correct, you really need to do a lot of things
for it to be useful.

"Something done by my userland code has ended up with this spew into
kernel log" _may_ be of use in some cases, but examples you've posted
are not of that sort.

The things missing:
	* what _was_ done by the userland to trigger that?
	* how reproducible it is?
	* which commit (if any) has introduced that behaviour?
Might or might not be available, but "bump the version number to
6.13-rc2" is very unlikely to be it.
	* can the reproducer (if available) be trimmed down?

You really would be better off if you described what that tool is
trying to do and what are your plans for it - missing parts, etc.

As it is, you are dumping a stream of low-quality output on people
who are not in position to do anything useful with it.  In effect,
you are training everyone to ignore anything you post, which is
probably not the desired result.