netdev - Re: suspicious RCU usage (netlink/rhashtable)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEfhGiwEhWqwtbAhbaVCEohePUyUC+f-Ap6b4oHk1Mdkg+ZKUA@mail.gmail.com>
Date:	Tue, 22 Dec 2015 15:51:19 -0500
From:	Craig Gallek <kraigatgoog@...il.com>
To:	Dave Jones <davej@...emonkey.org.uk>
Cc:	netdev@...r.kernel.org, herbert@...dor.apana.org.au,
	David Miller <davem@...emloft.net>
Subject: Re: suspicious RCU usage (netlink/rhashtable)

On Tue, Dec 22, 2015 at 3:45 PM, Dave Jones <davej@...emonkey.org.uk> wrote:
> ===============================
> [ INFO: suspicious RCU usage. ]
> 4.4.0-rc6-think+ #1 Not tainted
> -------------------------------
> lib/rhashtable.c:522 suspicious rcu_dereference_protected() usage!
>
> other info that might help us debug this:
>
>
> rcu_scheduler_active = 1, debug_locks = 0
> 2 locks held by trinity-c1/3652:
>  #0:  (&p->lock){+.+.+.}, at: [<ffffffff9a3335a7>] seq_read+0xd7/0x900
>  #1:  (&(&ht->lock)->rlock){+.+...}, at: [<ffffffff9a56f29d>] rhashtable_walk_init+0x9d/0x170
>
> stack backtrace:
> CPU: 0 PID: 3652 Comm: trinity-c1 Not tainted 4.4.0-rc6-think+ #1
>  ffffffff9af6ac60 000000003fc014d4 ffff8800cff779e0 ffffffff9a548da1
>  ffff880459b8b700 ffff8800cff77a10 ffffffff9a131068 ffff8800cdd32c48
>  ffff880464af8000 ffff8800cdd32c58 ffff880464af8160 ffff8800cff77a48
> Call Trace:
>  [<ffffffff9a548da1>] dump_stack+0x4e/0x7d
>  [<ffffffff9a131068>] lockdep_rcu_suspicious+0xf8/0x110
>  [<ffffffff9a56f363>] rhashtable_walk_init+0x163/0x170
>  [<ffffffff9ab54399>] netlink_walk_start+0x49/0x90
>  [<ffffffff9ab54ad0>] netlink_seq_start+0x40/0x90
>  [<ffffffff9a33368f>] seq_read+0x1bf/0x900
>  [<ffffffff9a3334d0>] ? seq_lseek+0x1b0/0x1b0
>  [<ffffffff9a2a37b0>] ? __might_fault+0xe0/0xf0
>  [<ffffffff9a2a3757>] ? __might_fault+0x87/0xf0
>  [<ffffffff9a2f91a9>] ? rw_copy_check_uvector+0x139/0x170
>  [<ffffffff9a3ab78f>] proc_reg_read+0x7f/0xc0
>  [<ffffffff9a2f6a70>] do_loop_readv_writev+0xe0/0x110
>  [<ffffffff9a3ab710>] ? proc_reg_write+0xc0/0xc0
>  [<ffffffff9a2f7c2b>] do_readv_writev+0x38b/0x3c0
>  [<ffffffff9a3ab710>] ? proc_reg_write+0xc0/0xc0
>  [<ffffffff9a2f78a0>] ? vfs_write+0x260/0x260
>  [<ffffffff9a12ecc5>] ? __lock_is_held+0x25/0xd0
>  [<ffffffff9a133d73>] ? mark_held_locks+0x23/0xc0
>  [<ffffffff9a25b1ba>] ? context_tracking_exit.part.5+0x2a/0x50
>  [<ffffffff9a133f96>] ? trace_hardirqs_on_caller+0x186/0x280
>  [<ffffffff9a13409d>] ? trace_hardirqs_on+0xd/0x10
>  [<ffffffff9a2f7cb6>] vfs_readv+0x56/0x70
>  [<ffffffff9a2f967d>] SyS_preadv+0x15d/0x180
>  [<ffffffff9a2f9520>] ? SyS_writev+0x1a0/0x1a0
>  [<ffffffff9a002017>] ? trace_hardirqs_on_thunk+0x17/0x19
>  [<ffffffff9aceb4d7>] entry_SYSCALL_64_fastpath+0x12/0x6b

I was actually just looking at this as well (though a slightly
different stack).  The issue is with: c6ff5268293e rhashtable: Fix
walker list corruption

It changed the lock acquired in rhashtable_walk_init to use the new
spinlock, but the rht_dereference macro expects the mutex.  I was
still trying to track down which repository this change came in
through, though...
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html