Re: posix timer: general protection fault in cleanup_timers

From	idaifish <idaifish@gmail.com>
Newsgroups	linux.kernel
Subject	Re: posix timer: general protection fault in cleanup_timers
Date	2017-06-13 10:00 +0200
Message-ID	<tROU3-5d9-29@gated-at.bofh.it> (permalink)
References	<tRMpb-3Pk-9@gated-at.bofh.it> <tRMpb-3Pk-11@gated-at.bofh.it> <tRMpb-3Pk-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

My first report has already attached the C reproducer and .config.

I've tested on my Ubuntu16.04 (4.4.0-79-generic #100-Ubuntu SMP x86_64).
The reproducer can cause my computer to freeze.



2017-06-13 13:11 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> On Tue, Jun 13, 2017 at 4:27 AM,  <idaifish@gmail.com> wrote:
>> Update:  got another reproducible KASAN report on commit
>> 32c1431eea4881a6b17bd7c639315010aeefa452(4.12-rc5) :
>
> Hi,
>
> If it's reproducible, please provide the reproducer.
>
>
>> ==================================================================
>> BUG: KASAN: use-after-free in cleanup_timers_list
>> kernel/time/posix-cpu-timers.c:401 [inline]
>> BUG: KASAN: use-after-free in cleanup_timers+0x35e/0x430
>> kernel/time/posix-cpu-timers.c:415
>> Read of size 8 at addr ffff88006c9229f0 by task syz-executor0/29927
>>
>> CPU: 2 PID: 29927 Comm: syz-executor0 Not tainted 4.12.0-rc5 #1
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:16 [inline]
>>  dump_stack+0x83/0xbc lib/dump_stack.c:52
>>  print_address_description+0x73/0x290 mm/kasan/report.c:252
>>  kasan_report_error mm/kasan/report.c:351 [inline]
>>  kasan_report+0x22b/0x340 mm/kasan/report.c:408
>>  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
>>  cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
>>  cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
>>  posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>>  __exit_signal kernel/exit.c:103 [inline]
>>  release_task+0x1b7/0x12c0 kernel/exit.c:199
>>  exit_notify kernel/exit.c:748 [inline]
>>  do_exit+0x15ba/0x2c60 kernel/exit.c:900
>>  do_group_exit+0xf6/0x340 kernel/exit.c:982
>>  get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>>  do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>>  exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>>  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>>  syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>>  entry_SYSCALL_64_fastpath+0xa3/0xa5
>> RIP: 0033:0x450439
>> RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
>>
>> Allocated by task 29927:
>>  save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
>>  save_stack+0x46/0xd0 mm/kasan/kasan.c:513
>>  set_track mm/kasan/kasan.c:525 [inline]
>>  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617
>>  kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:555
>>  slab_post_alloc_hook mm/slab.h:456 [inline]
>>  slab_alloc_node mm/slub.c:2718 [inline]
>>  slab_alloc mm/slub.c:2726 [inline]
>>  kmem_cache_alloc+0xb9/0x180 mm/slub.c:2731
>>  kmem_cache_zalloc include/linux/slab.h:655 [inline]
>>  alloc_posix_timer kernel/time/posix-timers.c:551 [inline]
>>  SYSC_timer_create kernel/time/posix-timers.c:618 [inline]
>>  SyS_timer_create+0x167/0x1020 kernel/time/posix-timers.c:603
>>  entry_SYSCALL_64_fastpath+0x1a/0xa5
>>
>> Freed by task 26611:
>>  save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
>>  save_stack+0x46/0xd0 mm/kasan/kasan.c:513
>>  set_track mm/kasan/kasan.c:525 [inline]
>>  kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590
>>  slab_free_hook mm/slub.c:1357 [inline]
>>  slab_free_freelist_hook mm/slub.c:1379 [inline]
>>  slab_free mm/slub.c:2961 [inline]
>>  kmem_cache_free+0x72/0x1a0 mm/slub.c:2983
>>  k_itimer_rcu_free+0x1d/0x20 kernel/time/posix-timers.c:566
>>  __rcu_reclaim kernel/rcu/rcu.h:195 [inline]
>>  rcu_do_batch kernel/rcu/tree.c:2800 [inline]
>>  invoke_rcu_callbacks kernel/rcu/tree.c:3057 [inline]
>>  __rcu_process_callbacks kernel/rcu/tree.c:3024 [inline]
>>  rcu_process_callbacks+0x3a4/0x1610 kernel/rcu/tree.c:3041
>>  __do_softirq+0x1be/0x59c kernel/softirq.c:284
>>
>> The buggy address belongs to the object at ffff88006c922998
>>  which belongs to the cache posix_timers_cache of size 216
>> The buggy address is located 88 bytes inside of
>>  216-byte region [ffff88006c922998, ffff88006c922a70)
>> The buggy address belongs to the page:
>> page:ffffea0001b24800 count:1 mapcount:0 mapping:          (null)
>> index:0xffff88006c920af8 compound_mapcount: 0
>> flags: 0x500000000008100(slab|head)
>> raw: 0500000000008100 0000000000000000 ffff88006c920af8 00000001001d0002
>> raw: ffff88006c9f9850 ffff88006c9f9850 ffff88006d81aac0 0000000000000000
>> page dumped because: kasan: bad access detected
>>
>> Memory state around the buggy address:
>>  ffff88006c922880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>  ffff88006c922900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>>ffff88006c922980: fc fc fc fb fb fb fb fb fb fb fb fb fb fb fb fb
>>                                                              ^
>>  ffff88006c922a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
>>  ffff88006c922a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ==================================================================
>> Disabling lock debugging due to kernel taint
>> Kernel panic - not syncing: panic_on_warn set ...
>>
>> CPU: 2 PID: 29927 Comm: syz-executor0 Tainted: G    B           4.12.0-rc5
>> #1
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:16 [inline]
>>  dump_stack+0x83/0xbc lib/dump_stack.c:52
>>  panic+0x1af/0x388 kernel/panic.c:180
>>  kasan_end_report+0x50/0x50 mm/kasan/report.c:176
>>  kasan_report_error mm/kasan/report.c:356 [inline]
>>  kasan_report+0x13b/0x340 mm/kasan/report.c:408
>>  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
>>  cleanup_timers_list kernel/time/posix-cpu-timers.c:401 [inline]
>>  cleanup_timers+0x35e/0x430 kernel/time/posix-cpu-timers.c:415
>>  posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>>  __exit_signal kernel/exit.c:103 [inline]
>>  release_task+0x1b7/0x12c0 kernel/exit.c:199
>>  exit_notify kernel/exit.c:748 [inline]
>>  do_exit+0x15ba/0x2c60 kernel/exit.c:900
>>  do_group_exit+0xf6/0x340 kernel/exit.c:982
>>  get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>>  do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>>  exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>>  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>>  syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>>  entry_SYSCALL_64_fastpath+0xa3/0xa5
>> RIP: 0033:0x450439
>> RSP: 002b:00007fd78ca08cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffe2264c6cf R14: 00007fd78ca099c0 R15: 0000000000000000
>> Shutting down cpus with NMI
>> Dumping ftrace buffer:
>>    (ftrace buffer empty)
>> Kernel Offset: disabled
>> Rebooting in 86400 seconds..
>>
>>
>> 在 2017年6月8日星期四 UTC+8下午5:30:27，idaifish写道：
>>>
>>> Hi:
>>>
>>> I've got the following error report while fuzzing the kernel with
>>> syzkaller on 4.12.0-rc3.
>>>
>>> PoC and config are attached.
>>>
>>>
>>> ------------------------------------------------------------------------------------------------------------------
>>>
>>> kasan: GPF could be caused by NULL-ptr deref or user memory access
>>> general protection fault: 0000 [#1] SMP KASAN
>>> Dumping ftrace buffer:
>>>    (ftrace buffer empty)
>>> Modules linked in:
>>> CPU: 2 PID: 11989 Comm: syz-executor0 Not tainted 4.12.0-rc3 #1
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
>>> Ubuntu-1.8.2-1ubuntu1 04/01/2014
>>> task: ffff88006d4f2980 task.stack: ffff88006acb0000
>>> RIP: 0010:__list_del include/linux/list.h:104 [inline]
>>> RIP: 0010:__list_del_entry include/linux/list.h:119 [inline]
>>> RIP: 0010:list_del_init include/linux/list.h:158 [inline]
>>> RIP: 0010:cleanup_timers_list kernel/time/posix-cpu-timers.c:402 [inline]
>>> RIP: 0010:cleanup_timers+0x299/0x430 kernel/time/posix-cpu-timers.c:415
>>> RSP: 0018:ffff88006acb7988 EFLAGS: 00010002
>>> RAX: ffff88006d4f2980 RBX: ffff88006bff3940 RCX: 0000000000000001
>>> RDX: ffffffff81266ad0 RSI: 0000000000000000 RDI: 0000000000000008
>>> RBP: ffff88006acb79c8 R08: 0000000000000000 R09: 0000000000000002
>>> R10: 00000000f17eaa6c R11: 000000006ec117ba R12: 0000000000000000
>>> R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88006bff3940
>>> FS:  0000000000000000(0000) GS:ffff88006e400000(0000)
>>> knlGS:0000000000000000
>>> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00000000204f5000 CR3: 000000000380e000 CR4: 00000000000006e0
>>> DR0: 0000000000000042 DR1: 0000000000008000 DR2: 0000000000000000
>>> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
>>> Call Trace:
>>>  posix_cpu_timers_exit+0x19/0x20 kernel/time/posix-cpu-timers.c:425
>>>  __exit_signal kernel/exit.c:103 [inline]
>>>  release_task+0x1b7/0x12c0 kernel/exit.c:199
>>>  exit_notify kernel/exit.c:748 [inline]
>>>  do_exit+0x15ba/0x2c60 kernel/exit.c:900
>>>  do_group_exit+0xf6/0x340 kernel/exit.c:982
>>>  get_signal+0x5c2/0x11b0 kernel/signal.c:2318
>>>  do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:808
>>>  exit_to_usermode_loop+0xe5/0x130 arch/x86/entry/common.c:157
>>>  prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
>>>  syscall_return_slowpath+0xd6/0x100 arch/x86/entry/common.c:263
>>>  entry_SYSCALL_64_fastpath+0xa3/0xa5
>>> RIP: 0033:0x450439
>>> RSP: 002b:00007fce47004cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
>>> RAX: fffffffffffffe00 RBX: 0000000000718020 RCX: 0000000000450439
>>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718020
>>> RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>>> R13: 00007fff1a12cddf R14: 00007fce470059c0 R15: 0000000000000000
>>> Code: 00 e8 9c a0 09 00 48 8d 7b 08 48 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f
>>> 85 c2 00 00 00 49 8d 7e 08 48 8b 53 08 48 89 f9 48 c1 e9 03 <42> 80 3c 29 00
>>> 0f 85 96 00 00 00 48 89 d1 49 89 56 08 48 c1 e9
>>> RIP: __list_del include/linux/list.h:104 [inline] RSP: ffff88006acb7988
>>> RIP: __list_del_entry include/linux/list.h:119 [inline] RSP:
>>> ffff88006acb7988
>>> RIP: list_del_init include/linux/list.h:158 [inline] RSP: ffff88006acb7988
>>> RIP: cleanup_timers_list kernel/time/posix-cpu-timers.c:402 [inline] RSP:
>>> ffff88006acb7988
>>> RIP: cleanup_timers+0x299/0x430 kernel/time/posix-cpu-timers.c:415 RSP:
>>> ffff88006acb7988
>>> ---[ end trace ac8e042e922b484f ]---
>>> Kernel panic - not syncing: Fatal exception
>>> Dumping ftrace buffer:
>>>    (ftrace buffer empty)
>>> Kernel Offset: disabled
>>> Rebooting in 86400 seconds..
>>>
>>>
>>> -----------
>>> Regards,
>>> idaifish
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "syzkaller" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to syzkaller+unsubscribe@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.



-- 
Regards,
idaifish

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: posix timer: general protection fault in cleanup_timers Dmitry Vyukov <dvyukov@google.com> - 2017-06-13 07:20 +0200
  Re: posix timer: general protection fault in cleanup_timers idaifish <idaifish@gmail.com> - 2017-06-13 10:00 +0200

csiph-web