netdev - unbounded recursion through bond_netdev_event notifier? [was: BUG: stack guard page was hit in update_stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG48ez3tsUWA8tXL7rVMJ+CEpuNmxZrX=RjFhvMcu1SkvXkHDw@mail.gmail.com>
Date:   Tue, 4 Feb 2020 14:02:58 +0100
From:   Jann Horn <jannh@...gle.com>
To:     syzbot <syzbot+c2fb6f9ddcea95ba49b5@...kaller.appspotmail.com>,
        Network Development <netdev@...r.kernel.org>,
        Jay Vosburgh <j.vosburgh@...il.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>
Cc:     Borislav Petkov <bp@...en8.de>, "H . Peter Anvin" <hpa@...or.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        kernel list <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "the arch/x86 maintainers" <x86@...nel.org>
Subject: unbounded recursion through bond_netdev_event notifier? [was: BUG:
 stack guard page was hit in update_stack_state]

On Tue, Feb 4, 2020 at 5:43 AM syzbot
<syzbot+c2fb6f9ddcea95ba49b5@...kaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    b3a60822 Merge branch 'for-v5.6' of git://git.kernel.org:/..
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=147ae5f1e00000

In the console output, you can see that this seems to be an unbounded
recursion bug. The stack trace is unreliable, but it looks like the
actual recursion might be something like the following, where a netdev
change triggers the bond_netdev_event notifier, which in turn causes
another netdev change, and so on:

[  734.548523][T28658]  ? netdev_lower_get_next_private+0x85/0xb0
[  734.554632][T28658]  ? bond_compute_features.isra.0+0x56a/0xa80
[inlined bond_slave_netdev_event ?]
[  734.572769][T28658]  ? bond_netdev_event+0x71a/0x950
[  734.577901][T28658]  ? notifier_call_chain+0xc2/0x230
[  734.583113][T28658]  ? raw_notifier_call_chain+0x2e/0x40
[  734.588589][T28658]  ? call_netdevice_notifiers_info+0xba/0x130
[  734.594765][T28658]  ? netdev_update_features+0xc7/0xd0
[  734.600142][T28658]  ? __netdev_update_features+0x13e0/0x13e0
[...]
[  734.617522][T28658]  ? netdev_upper_get_next_dev_rcu+0xac/0x110
[  734.623605][T28658]  ? __netdev_update_features+0x8af/0x13e0
[...]
[  734.649988][T28658]  ? netdev_change_features+0x64/0xb0
[...]


> kernel config:  https://syzkaller.appspot.com/x/.config?x=614e56d86457f3a7

says CONFIG_UNWINDER_FRAME_POINTER=y. Unfortunately, the x86 frame
pointer unwinder apparently can't unwind out of a double fault...
maybe it'd be better to use ORC for syzkaller?

> dashboard link: https://syzkaller.appspot.com/bug?extid=c2fb6f9ddcea95ba49b5
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+c2fb6f9ddcea95ba49b5@...kaller.appspotmail.com