netdev - Recent Linus' tree, kernel BUG at fs/inode.c:1436!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Dec 2014 14:34:00 +0300
From:	Pavel Emelyanov <xemul@...allels.com>
To:	Linux Netdev List <netdev@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>
Subject: Recent Linus' tree, kernel BUG at fs/inode.c:1436!

Hi,

It looks like there's a strange refcount underflow in VFS/socket code.
The proggie [1] crashes the recent Linus' tree (d790be38 Merge tag
'modules-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux) 
with the calltrace [2].

If in the proggie the psk is replaced with non-socket descriptor the
issue doesn't appear.

Thanks,
Pavel


[1]--------------------------------------------

#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <stdio.h>
#include <fcntl.h>

int main(int argc, char **argv)
{
	int psk, proc;
	char buf[1024];

	psk = socket(PF_LOCAL, SOCK_STREAM, 0);
	sprintf(buf, "/proc/self/fd/%d", psk);
	proc = open(buf, O_RDONLY);
	close(proc);
	close(psk);

	return 0;
}

[2]--------------------------------------------

[  322.823998] ------------[ cut here ]------------
[  322.824251] kernel BUG at fs/inode.c:1436!
[  322.824251] invalid opcode: 0000 [#6] SMP 
[  322.824251] Modules linked in: serio_raw ata_generic
[  322.824251] CPU: 0 PID: 1058 Comm: a.out Tainted: G      D        3.18.0-criu+ #10
[  322.824251] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  322.824251] task: ffff88003ca7d070 ti: ffff880037058000 task.ti: ffff880037058000
[  322.824251] RIP: 0010:[<ffffffff811521bf>]  [<ffffffff811521bf>] iput+0x13f/0x180
[  322.824251] RSP: 0018:ffff88003705be08  EFLAGS: 00010202
[  322.824251] RAX: 0000000000000000 RBX: ffff88003dd0dbb0 RCX: dead000000200200
[  322.824251] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88003dd0dbb0
[  322.824251] RBP: ffff88003705be28 R08: ffff88003d187a50 R09: ffff88003fc15820
[  322.824251] R10: ffffffff81392d4e R11: ffffea0000f74300 R12: ffff88003dd0dbb0
[  322.824251] R13: ffff88003d187a18 R14: 0000000000000000 R15: ffff88003d1879c0
[  322.824251] FS:  00007f1720ba7740(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
[  322.824251] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  322.824251] CR2: 00007f17206c4630 CR3: 000000003731d000 CR4: 00000000000006f0
[  322.824251] Stack:
[  322.824251]  ffff88003d1879c0 ffff88003dd0dbb0 ffff88003d187a18 0000000000000000
[  322.824251]  ffff88003705be58 ffffffff8114d710 ffff88003705be58 0000000000000000
[  322.824251]  ffff88003d187a18 ffff88003dd0dbb0 ffff88003705be88 ffffffff8114d7fd
[  322.824251] Call Trace:
[  322.824251]  [<ffffffff8114d710>] __dentry_kill+0x180/0x1d0
[  322.824251]  [<ffffffff8114d7fd>] dput+0x9d/0x160
[  322.824251]  [<ffffffff81139198>] __fput+0x168/0x1e0
[  322.824251]  [<ffffffff81139259>] ____fput+0x9/0x10
[  322.824251]  [<ffffffff81065d2f>] task_work_run+0xaf/0xf0
[  322.824251]  [<ffffffff81002c71>] do_notify_resume+0x51/0x80
[  322.824251]  [<ffffffff81494920>] int_signal+0x12/0x17
[  322.824251] Code: 00 00 00 eb a0 0f 1f 80 00 00 00 00 48 81 8b 90 00 00 00 00 01 00 00 48 89 df e8 7d fe ff ff 80 83 80 00 00 00 01 e9 fb fe ff ff <0f> 0b be 71 05 00 00 48 c7 c7 53 2a 75 81 e8 5e a9 ef ff e9 06 
[  322.824251] RIP  [<ffffffff811521bf>] iput+0x13f/0x180
[  322.824251]  RSP <ffff88003705be08>
[  322.855968] ---[ end trace 2e35ddcef73fed30 ]---
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html