netdev - BUG: WARNING: ODEBUG bug in sk_stop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CANikGpcbOMa9mGroj2jK0s9Rk0zThyaixf3wQa0ZR-7oh-50Rg@mail.gmail.com>
Date: Sun, 25 Aug 2024 16:20:43 -0700
From: Juefei Pu <juefei.pu@...il.ucr.edu>
To: jmaloy@...hat.com, ying.xue@...driver.com, davem@...emloft.net, 
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, 
	netdev@...r.kernel.org, tipc-discussion@...ts.sourceforge.net, 
	linux-kernel@...r.kernel.org
Subject: BUG: WARNING: ODEBUG bug in sk_stop_timer

Hello,
We found the following issue using syzkaller on Linux v6.10.
In `tipc_release`, an ODEBUG warning was triggered when executing
`sk_stop_timer(sk, &sk->sk_timer);`. It seems that the function was called
without checking whether `sk->sk_timer` is initialized.

Unfortunately, the syzkaller failed to generate a reproducer.
But at least we have the report:

------------[ cut here ]------------
ODEBUG: assert_init not available (active state 0) object:
ffff8880254e10a0 object type: timer_list hint:
tipc_sk_timeout+0x0/0xab0
WARNING: CPU: 0 PID: 11 at lib/debugobjects.c:517
debug_print_object+0x176/0x1e0 lib/debugobjects.c:514
Modules linked in:
CPU: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.10.0 #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:debug_print_object+0x176/0x1e0 lib/debugobjects.c:514
Code: df e8 6e e9 95 fd 4c 8b 0b 48 c7 c7 a0 61 a9 8b 48 8b 74 24 08
48 89 ea 44 89 e1 4d 89 f8 ff 34 24 e8 de 2c f7 fc 48 83 c4 08 <0f> 0b
ff 05 42 1e c6 0a 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d
RSP: 0018:ffffc900000df6f8 EFLAGS: 00010282
RAX: 2f987b8e4002d300 RBX: ffffffff8b4ee740 RCX: ffff8880156dbc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff8ba96360 R08: ffffffff8155a25a R09: 1ffff9200001be7c
R10: dffffc0000000000 R11: fffff5200001be7d R12: 0000000000000000
R13: ffffffff8ba96248 R14: dffffc0000000000 R15: ffff8880254e10a0
FS:  0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc21fbbff8 CR3: 000000003a1e4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 debug_object_assert_init+0x35f/0x420 lib/debugobjects.c:910
 debug_timer_assert_init kernel/time/timer.c:846 [inline]
 debug_assert_init kernel/time/timer.c:891 [inline]
 __timer_delete kernel/time/timer.c:1413 [inline]
 timer_delete+0x98/0x150 kernel/time/timer.c:1453
 del_timer include/linux/timer.h:202 [inline]
 sk_stop_timer+0x18/0x90 net/core/sock.c:3426
 tipc_release+0x75f/0x1610 net/tipc/socket.c:645
 __sock_release net/socket.c:659 [inline]
 sock_release+0x80/0x140 net/socket.c:687
 tipc_topsrv_stop net/tipc/topsrv.c:718 [inline]
 tipc_topsrv_exit_net+0x2b4/0x2f0 net/tipc/topsrv.c:730
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x810/0xcd0 net/core/net_namespace.c:640
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0x977/0x1410 kernel/workqueue.c:3329
 worker_thread+0xaa0/0x1020 kernel/workqueue.c:3409
 kthread+0x2eb/0x380 kernel/kthread.c:389
 ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244
 </TASK>