netdev - Re: BUG: MAX_LOCKDEP_CHAIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <068bf2f6512c10fd4ca71ea6017e27fa5928d166.camel@kernel.crashing.org>
Date:   Fri, 12 Apr 2019 07:50:20 +1000
From:   Benjamin Herrenschmidt <benh@...nel.crashing.org>
To:     davem@...emloft.net, gregkh@...uxfoundation.org,
        johan.hedberg@...il.com, linux-bluetooth@...r.kernel.org,
        linux-kernel@...r.kernel.org, marcel@...tmann.org,
        netdev@...r.kernel.org, rafael@...nel.org,
        syzkaller-bugs@...glegroups.com, tj@...nel.org,
        torvalds@...ux-foundation.org
Subject: Re: BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!

On Thu, 2019-04-11 at 05:14 -0700, syzbot wrote:
> syzbot has bisected this bug to:
> 
> commit 726e41097920a73e4c7c33385dcc0debb1281e18
> Author: Benjamin Herrenschmidt <benh@...nel.crashing.org>
> Date:   Tue Jul 10 00:29:10 2018 +0000
> 
>      drivers: core: Remove glue dirs from sysfs earlier

Greg, any idea what this is ? The log isn't terribly readable. The
above patch fixes a real bug that causes use after free and memory
corruption under some circumstances. I wonder if the BT stack is itself
manipulating stale objects ?

Ben.

> bisection log:  
> https://syzkaller.appspot.com/x/bisect.txt?x=15f69eaf200000
> start commit:   771acc7e Bluetooth: btusb: request wake pin with
> NOAUTOEN
> git tree:       upstream
> final crash:    
> https://syzkaller.appspot.com/x/report.txt?x=17f69eaf200000
> console output: 
> https://syzkaller.appspot.com/x/log.txt?x=13f69eaf200000
> kernel config:  
> https://syzkaller.appspot.com/x/.config?x=4fb64439e07a1ec0
> dashboard link: 
> https://syzkaller.appspot.com/bug?extid=91fd909b6e62ebe06131
> syz repro:      
> https://syzkaller.appspot.com/x/repro.syz?x=11770a8f200000
> C reproducer:   
> https://syzkaller.appspot.com/x/repro.c?x=128c945b200000
> 
> Reported-by: syzbot+91fd909b6e62ebe06131@...kaller.appspotmail.com
> Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs
> earlier")
> 
> For information about bisection process see: 
> https://goo.gl/tpsmEJ#bisection