[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <67e919bf.050a0220.1547ec.00a0.GAE@google.com>
Date: Sun, 30 Mar 2025 03:15:27 -0700
From: syzbot <syzbot+8bca99e91de7e060e4ea@...kaller.appspotmail.com>
To: gnoack@...gle.com, jmorris@...ei.org, linux-kernel@...r.kernel.org,
linux-security-module@...r.kernel.org, mic@...ikod.net, paul@...l-moore.com,
serge@...lyn.com, syzkaller-bugs@...glegroups.com
Subject: [syzbot] [lsm?] WARNING in free_ruleset
Hello,
syzbot found the following issue on:
HEAD commit: 7d06015d936c Merge tag 'pci-v6.15-changes' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c4fbb0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2dde96545058477
dashboard link: https://syzkaller.appspot.com/bug?extid=8bca99e91de7e060e4ea
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13380404580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=174f764c580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-7d06015d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a3714415ac07/vmlinux-7d06015d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/60a299508e73/Image-7d06015d.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8bca99e91de7e060e4ea@...kaller.appspotmail.com
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x30/0xe0 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x10c/0x138 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __ll_sc_atomic_fetch_sub_release arch/arm64/include/asm/atomic_ll_sc.h:96 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __refcount_sub_and_test include/linux/refcount.h:264 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 refcount_dec_and_test include/linux/refcount.h:325 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 landlock_put_hierarchy security/landlock/domain.h:164 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 free_ruleset+0x144/0x174 security/landlock/ruleset.c:490
Modules linked in:
CPU: 1 UID: 0 PID: 3298 Comm: syz-executor356 Not tainted 6.14.0-syzkaller-09584-g7d06015d936c #0 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : landlock_free_hierarchy_details security/landlock/domain.h:133 [inline]
pc : landlock_put_hierarchy security/landlock/domain.h:168 [inline]
pc : free_ruleset+0x144/0x174 security/landlock/ruleset.c:490
lr : landlock_put_hierarchy security/landlock/domain.h:167 [inline]
lr : free_ruleset+0xdc/0x174 security/landlock/ruleset.c:490
sp : ffff800089483d30
x29: ffff800089483d30 x28: f7f0000005ba0000 x27: 0000000000000000
x26: 0000000000000000 x25: fcf000000415ca80 x24: fcf00000040a7438
x23: 00000000ffffffff x22: 0000000000000001 x21: fcf00000040a7420
x20: fcf00000040a7420 x19: f1f000000678ca00 x18: 00000000fffffffd
x17: 0000000000000000 x16: 0000000000000000 x15: ffff800089483270
x14: 00000000ffffffea x13: ffff800089483808 x12: ffff80008298eb10
x11: 0000000000000001 x10: 0000000000000001 x9 : 000000000002ffe8
x8 : f7f0000005ba0000 x7 : ffff800089483fd8 x6 : 00000000000affa8
x5 : fff000007f8e3588 x4 : ffff800089484000 x3 : 0000000000000000
x2 : fcf00000040a7458 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
__ll_sc_atomic_fetch_sub_release arch/arm64/include/asm/atomic_ll_sc.h:96 [inline] (P)
arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] (P)
raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline] (P)
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] (P)
__refcount_sub_and_test include/linux/refcount.h:264 [inline] (P)
__refcount_dec_and_test include/linux/refcount.h:307 [inline] (P)
refcount_dec_and_test include/linux/refcount.h:325 [inline] (P)
landlock_put_hierarchy security/landlock/domain.h:164 [inline] (P)
free_ruleset+0x144/0x174 security/landlock/ruleset.c:490 (P)
landlock_put_ruleset security/landlock/ruleset.c:498 [inline]
landlock_put_ruleset security/landlock/ruleset.c:494 [inline]
__free_landlock_put_ruleset security/landlock/ruleset.h:200 [inline]
landlock_merge_ruleset+0x210/0x440 security/landlock/ruleset.c:534
__do_sys_landlock_restrict_self security/landlock/syscalls.c:549 [inline]
__se_sys_landlock_restrict_self security/landlock/syscalls.c:479 [inline]
__arm64_sys_landlock_restrict_self+0xb0/0x250 security/landlock/syscalls.c:479
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x30/0xe0 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x10c/0x138 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:600
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Powered by blists - more mailing lists