Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1723775
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection |
| Date | 2017-08-31 04:30 +0200 |
| Message-ID | <uknoZ-8a0-7@gated-at.bofh.it> (permalink) |
| References | (8 earlier) <ukf86-2PE-17@gated-at.bofh.it> <ukfrs-2W1-5@gated-at.bofh.it> <ukgGR-3SG-9@gated-at.bofh.it> <ukh9U-44p-3@gated-at.bofh.it> <uknfj-84l-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, Aug 30, 2017 at 7:09 PM, Mike Galbraith <efault@gmx.de> wrote:
> On Wed, 2017-08-30 at 12:46 -0700, Kees Cook wrote:
>>
>> With CONFIG_ARCH_HAS_REFCOUNT=y and this patch, do you get an earlier splat?
>
> Yup, first gripe below.
>
> [ 2.448393] refcount_t silent saturation at skb_unref.part.36+0x12/0x1a in (haveged)[136], uid/euid: 0/0
> [ 2.454975] ------------[ cut here ]------------
> [ 2.456452] WARNING: CPU: 1 PID: 136 at kernel/panic.c:612 refcount_error_report+0xa0/0xa4
> [ 2.456452] Modules linked in: scsi_mod(E+) autofs4(E)
> [ 2.456456] CPU: 1 PID: 136 Comm: (haveged) Tainted: G E 4.13.0.g152d54a-tip-default #47
> [ 2.456456] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
> [ 2.456457] task: ffff880137f65640 task.stack: ffffc9000093c000
> [ 2.456458] RIP: 0010:refcount_error_report+0xa0/0xa4
> [ 2.456459] RSP: 0018:ffffc9000093fa38 EFLAGS: 00010282
> [ 2.456459] RAX: 000000000000005c RBX: ffffffff81a33864 RCX: 0000000000000830
> [ 2.456459] RDX: 0000000000000001 RSI: 0000000000000082 RDI: 0000000000000246
> [ 2.456460] RBP: ffffc9000093fb88 R08: 000000008e8d4f61 R09: 0000000000000000
> [ 2.456462] R10: 0000000000000000 R11: ffff880137f61600 R12: ffff880137f65640
> [ 2.456463] R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000006
> [ 2.456464] FS: 00007f5a33a14880(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
> [ 2.456464] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 2.456464] CR2: 00007ffe37ca0c88 CR3: 0000000137f74005 CR4: 00000000001606e0
> [ 2.456467] Call Trace:
> [ 2.456478] ex_handler_refcount+0x63/0x70
> [ 2.456479] fixup_exception+0x32/0x40
> [ 2.456482] do_trap+0x11b/0x180
> [ 2.456493] do_error_trap+0x70/0xd0
> [ 2.456497] ? skb_unref.part.36+0x10/0x1a
> [ 2.456502] ? idr_get_free+0xcb/0x2f0
> [ 2.456505] invalid_op+0x1e/0x30
> [ 2.456510] RIP: 0010:skb_unref.part.36+0x12/0x1a
> [ 2.456510] RSP: 0018:ffffc9000093fc30 EFLAGS: 00010202
> [ 2.456510] RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffff880137df9ee4
> [ 2.456511] RDX: ffff880137df0518 RSI: ffff880137df9e00 RDI: ffff880137df9e00
> [ 2.456511] RBP: ffff880137df9e00 R08: ffff880137e30018 R09: ffffffff816b91f0
> [ 2.456511] R10: 0000000000000017 R11: 00000000fffffff4 R12: 0000000000000000
> [ 2.456512] R13: ffff88013a4e9000 R14: 0000000000000000 R15: ffff880137e30000
> [ 2.456513] ? cleanup_uevent_env+0x10/0x10
> [ 2.456520] kfree_skb+0x3f/0xa0
> [ 2.456525] netlink_broadcast_filtered+0x2c8/0x420
> [ 2.456530] ? cleanup_uevent_env+0x10/0x10
> [ 2.456531] kobject_uevent_env+0x476/0x650
> [ 2.456540] device_add+0x41e/0x5f0
> [ 2.456550] netdev_register_kobject+0x8e/0x170
> [ 2.456553] register_netdevice+0x27a/0x3d0
> [ 2.456557] register_netdev+0x16/0x30
> [ 2.456562] loopback_net_init+0x48/0xa0
> [ 2.456567] ops_init+0x39/0x110
> [ 2.456568] setup_net+0x85/0x130
> [ 2.456569] copy_net_ns+0xb9/0x1f0
> [ 2.456571] create_new_namespaces+0x11a/0x1b0
> [ 2.456577] unshare_nsproxy_namespaces+0x55/0xa0
> [ 2.456578] SyS_unshare+0x18d/0x330
> [ 2.456581] entry_SYSCALL_64_fastpath+0x1a/0xa5
> [ 2.456584] RIP: 0033:0x7f5a320669f7
> [ 2.456585] RSP: 002b:00007ffcd1e10908 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
> [ 2.456585] RAX: ffffffffffffffda RBX: 000000000159ae48 RCX: 00007f5a320669f7
> [ 2.456586] RDX: 000000000000000b RSI: 00007ffcd1e10910 RDI: 0000000040000000
> [ 2.456588] RBP: 00007ffcd1e10cf0 R08: 0000000000000001 R09: 00000000015b8d20
> [ 2.456588] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000000
> [ 2.456588] R13: 00000000ffffffff R14: 00000000ffffffff R15: 0000000000000000
> [ 2.456589] Code: 10 09 00 00 48 8b 95 80 00 00 00 49 8d 8c 24 f0 0a 00 00 41 89 c1 44 89 2c 24 48 89 de 48 c7 c7 80 70 a3 81 31 c0 e8 bd f1 05 00 <0f> ff eb 88 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 49 89
> [ 2.456599] ---[ end trace d3215cc8334d8520 ]---
Interesting! Can you try with 633547973ffc3 ("net: convert
sk_buff.users from atomic_t to refcount_t") reverted? I'll see if
running haveged will help me trigger this on my system...
-Kees
--
Kees Cook
Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-29 11:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-29 18:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-29 20:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-29 20:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 07:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 18:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 19:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 19:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 20:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 21:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 21:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 04:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 04:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 05:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 06:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 06:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 06:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 16:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 19:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 19:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 20:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 09:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 15:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 19:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 20:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 21:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 21:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 21:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 21:30 +0200
csiph-web