| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALAgD-5Vx9-9VSqO1YVg9CS=uWzpYoSpV5zWaV+LZUWtqnw5Wg@mail.gmail.com> Date: Wed, 28 Aug 2024 16:55:26 -0700 From: Xingyu Li <xli399@....edu> To: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, dsahern@...nel.org, kuniyu@...zon.com, shaozhengchao@...wei.com, juntong.deng@...look.com, ryasuoka@...hat.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Cc: Yu Hao <yhao016@....edu> Subject: BUG: unable to handle kernel paging request in rht_lock Hi, We found a bug in Linux 6.10 using syzkaller. It is possibly a page fault bug. The bug report is as follows, but unfortunately there is no generated syzkaller reproducer. Bug report: veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed BUG: unable to handle page fault for address: ffffed1056223056 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 13ffee067 P4D 13ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 89058 Comm: kworker/u4:20 Not tainted 6.10.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189 Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c 48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80 3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00 RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086 RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0 RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056 R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056 R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0 FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> instrument_atomic_read_write include/linux/instrumented.h:96 [inline] test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline] bit_spin_lock include/linux/bit_spinlock.h:27 [inline] rht_lock+0xfd/0x230 include/linux/rhashtable.h:332 __rhashtable_remove_fast_one include/linux/rhashtable.h:1012 [inline] __rhashtable_remove_fast include/linux/rhashtable.h:1093 [inline] rhashtable_remove_fast include/linux/rhashtable.h:1122 [inline] netlink_remove net/netlink/af_netlink.c:616 [inline] netlink_release+0x400/0x1b00 net/netlink/af_netlink.c:755 __sock_release net/socket.c:659 [inline] sock_release+0x80/0x140 net/socket.c:687 crypto_netlink_exit+0x3c/0x60 crypto/crypto_user.c:498 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x810/0xcd0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0x977/0x1410 kernel/workqueue.c:3329 worker_thread+0xaa0/0x1020 kernel/workqueue.c:3409 kthread+0x2eb/0x380 kernel/kthread.c:389 ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: CR2: ffffed1056223056 ---[ end trace 0000000000000000 ]--- RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline] RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline] RIP: 0010:kasan_check_range+0x81/0x2a0 mm/kasan/generic.c:189 Code: 00 00 fc ff df 4d 8d 34 19 4c 89 f5 4c 29 dd 48 83 fd 10 7f 2c 48 85 ed 0f 84 58 01 00 00 49 01 de 4c 89 dd 4c 29 f5 48 01 dd <41> 80 3b 00 0f 85 dd 01 00 00 49 ff c3 48 ff c5 75 ee e9 35 01 00 RSP: 0018:ffffc9000a4bf830 EFLAGS: 00010086 RAX: 1ffff11007734201 RBX: dffffc0000000001 RCX: ffffffff89131dcd RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff8882b11182b0 RBP: ffffffffffffffff R08: ffff8882b11182b7 R09: 1ffff11056223056 R10: dffffc0000000000 R11: ffffed1056223056 R12: 1ffff11056223056 R13: 0000000000000246 R14: dfffe91056223058 R15: ffff8882b11182b0 FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1056223056 CR3: 000000000d932000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 4 bytes skipped: 0: df 4d 8d fisttps -0x73(%rbp) 3: 34 19 xor $0x19,%al 5: 4c 89 f5 mov %r14,%rbp 8: 4c 29 dd sub %r11,%rbp b: 48 83 fd 10 cmp $0x10,%rbp f: 7f 2c jg 0x3d 11: 48 85 ed test %rbp,%rbp 14: 0f 84 58 01 00 00 je 0x172 1a: 49 01 de add %rbx,%r14 1d: 4c 89 dd mov %r11,%rbp 20: 4c 29 f5 sub %r14,%rbp 23: 48 01 dd add %rbx,%rbp * 26: 41 80 3b 00 cmpb $0x0,(%r11) <-- trapping instruction 2a: 0f 85 dd 01 00 00 jne 0x20d 30: 49 ff c3 inc %r11 33: 48 ff c5 inc %rbp 36: 75 ee jne 0x26 38: e9 .byte 0xe9 39: 35 .byte 0x35 3a: 01 00 add %eax,(%rax) -- Yours sincerely, Xingyu
Powered by blists - more mailing lists