Hello,
syzbot hit the following crash on upstream commit
af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000)
Merge tag 'leds_for-4.16-rc3' of
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
So far this crash happened 27 times on
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master,
net-next, upstream.
C reproducer is attached.
syzkaller reproducer is attached.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: [email protected]
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.
WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init
include/net/sock.h:638 [inline]
WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638
smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 9921 Comm: syzkaller089677 Not tainted 4.16.0-rc2+ #324
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
RIP: 0010:sk_del_node_init include/net/sock.h:638 [inline]
RIP: 0010:smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
RSP: 0018:ffff8801b639f198 EFLAGS: 00010293
RAX: ffff8801b684a340 RBX: 1ffff10036c73e37 RCX: ffffffff85a3f1f5
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 1ffff10036c73e3b
RBP: ffff8801b639f280 R08: dffffc0000000000 R09: 0000000000000004
R10: ffff8801b639f050 R11: 0000000000000004 R12: ffff8801b639f258
R13: ffffffff87669b40 R14: ffff8801c08d57c0 R15: 1ffff10036c73e3b
smc_release+0x321/0x580 net/smc/af_smc.c:148
sock_release+0x8d/0x1e0 net/socket.c:595
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x327/0x7e0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x199/0x270 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x9bb/0x1ad0 kernel/exit.c:865
do_group_exit+0x149/0x400 kernel/exit.c:968
get_signal+0x73a/0x16d0 kernel/signal.c:2469
do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
do_syscall_64+0x6e5/0x940 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x44cad9
RSP: 002b:00007fbf24687ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
RAX: 0000000000000001 RBX: 0000000000700024 RCX: 000000000044cad9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000080
RBP: 0000000000700020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000080ef3f R14: 00007fbf246889c0 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to [email protected].
syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
On Fri, 2018-02-23 at 07:59 -0800, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on upstream commit
> af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000)
> Merge tag 'leds_for-4.16-rc3' of
> git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
>
> So far this crash happened 27 times on
> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master,
> net-next, upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: [email protected]
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init
> include/net/sock.h:638 [inline]
> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638
> smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
> Kernel panic - not syncing: panic_on_warn set ...
>
> CPU: 1 PID: 9921 Comm: syzkaller089677 Not tainted 4.16.0-rc2+ #324
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x194/0x24d lib/dump_stack.c:53
> panic+0x1e4/0x41c kernel/panic.c:183
> __warn+0x1dc/0x200 kernel/panic.c:547
> report_bug+0x211/0x2d0 lib/bug.c:184
> fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
> fixup_bug arch/x86/kernel/traps.c:247 [inline]
> do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
> do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
> invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
> RIP: 0010:sk_del_node_init include/net/sock.h:638 [inline]
> RIP: 0010:smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
> RSP: 0018:ffff8801b639f198 EFLAGS: 00010293
> RAX: ffff8801b684a340 RBX: 1ffff10036c73e37 RCX: ffffffff85a3f1f5
> RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 1ffff10036c73e3b
> RBP: ffff8801b639f280 R08: dffffc0000000000 R09: 0000000000000004
> R10: ffff8801b639f050 R11: 0000000000000004 R12: ffff8801b639f258
> R13: ffffffff87669b40 R14: ffff8801c08d57c0 R15: 1ffff10036c73e3b
> smc_release+0x321/0x580 net/smc/af_smc.c:148
> sock_release+0x8d/0x1e0 net/socket.c:595
> sock_close+0x16/0x20 net/socket.c:1149
> __fput+0x327/0x7e0 fs/file_table.c:209
> ____fput+0x15/0x20 fs/file_table.c:243
> task_work_run+0x199/0x270 kernel/task_work.c:113
> exit_task_work include/linux/task_work.h:22 [inline]
> do_exit+0x9bb/0x1ad0 kernel/exit.c:865
> do_group_exit+0x149/0x400 kernel/exit.c:968
> get_signal+0x73a/0x16d0 kernel/signal.c:2469
> do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
> exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
> prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
> syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
> do_syscall_64+0x6e5/0x940 arch/x86/entry/common.c:292
> entry_SYSCALL_64_after_hwframe+0x42/0xb7
> RIP: 0033:0x44cad9
> RSP: 002b:00007fbf24687ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
> RAX: 0000000000000001 RBX: 0000000000700024 RCX: 000000000044cad9
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000080
> RBP: 0000000000700020 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 000000000080ef3f R14: 00007fbf246889c0 R15: 0000000000000005
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
>
>
> ---
> This bug is generated by a dumb bot. It may contain errors.
> See https://goo.gl/tpsmEJ for details.
> Direct all questions to [email protected].
>
> syzbot will keep track of this bug report.
> If you forgot to add the Reported-by tag, once the fix for this bug is
> merged
> into any tree, please reply to this email with:
> #syz fix: exact-commit-title
> If you want to test a patch for this bug, please reply with:
> #syz test: git://repo/address.git branch
> and provide the patch inline or as an attachment.
> To mark this as a duplicate of another syzbot report, please reply with:
> #syz dup: exact-subject-of-another-report
> If it's a one-off invalid bug report, please reply with:
> #syz invalid
> Note: if the crash happens again, it will cause creation of a new bug
> report.
> Note: all commands must start from beginning of the line in the email body.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
Hello,
syzbot has tested the proposed patch but the reproducer still triggered
crash:
WARNING in smc_unhash_sk
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
WARNING: CPU: 0 PID: 4437 at ./include/net/sock.h:639 sk_del_node_init
include/net/sock.h:639 [inline]
WARNING: CPU: 0 PID: 4437 at ./include/net/sock.h:639
smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 4437 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #59
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
RIP: 0010:sk_del_node_init include/net/sock.h:639 [inline]
RIP: 0010:smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
RSP: 0018:ffff8801b95b7198 EFLAGS: 00010293
RAX: ffff8801b8d7a5c0 RBX: 1ffff100372b6e37 RCX: ffffffff85a47785
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 1ffff100372b6e3b
RBP: ffff8801b95b7280 R08: dffffc0000000000 R09: 0000000000000004
R10: ffff8801b95b7050 R11: 0000000000000005 R12: ffff8801b95b7258
R13: ffffffff87671f00 R14: ffff8801b97c37c0 R15: 1ffff100372b6e3b
smc_release+0x321/0x580 net/smc/af_smc.c:148
sock_release+0x8d/0x1e0 net/socket.c:594
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x327/0x7e0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x199/0x270 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x9bb/0x1ad0 kernel/exit.c:865
do_group_exit+0x149/0x400 kernel/exit.c:968
get_signal+0x73a/0x16d0 kernel/signal.c:2469
do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
do_syscall_64+0x6e5/0x940 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x47f4f1
RSP: 002b:0000000000a3ea20 EFLAGS: 00000293 ORIG_RAX: 0000000000000023
RAX: fffffffffffffdfc RBX: 000000000072bea0 RCX: 000000000047f4f1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000a3ea30
RBP: 000000000072ca20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000a3ea10 R11: 0000000000000293 R12: 0000000000000059
R13: ffffffffffffffff R14: 0000000000000001 R15: 0000000000000005
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
Tested on net-next commit
3808b51911fe1a2bf8d6f4f2836d4c51aa29a6fd (Tue Feb 27 01:58:25 2018 +0000)
Merge branch '10GbE' of
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue
compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.
Raw console output is attached.
On Tue, Feb 27, 2018 at 1:23 PM, Davide Caratti <[email protected]> wrote:
> On Fri, 2018-02-23 at 07:59 -0800, syzbot wrote:
>> Hello,
>>
>> syzbot hit the following crash on upstream commit
>> af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000)
>> Merge tag 'leds_for-4.16-rc3' of
>> git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
>>
>> So far this crash happened 27 times on
>> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master,
>> net-next, upstream.
>> C reproducer is attached.
>> syzkaller reproducer is attached.
>> Raw console output is attached.
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: [email protected]
>> It will help syzbot understand when the bug is fixed. See footer for
>> details.
>> If you forward the report, please keep this part and the footer.
>>
>> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init
>> include/net/sock.h:638 [inline]
>> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638
>> smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
>> Kernel panic - not syncing: panic_on_warn set ...
>>
>> CPU: 1 PID: 9921 Comm: syzkaller089677 Not tainted 4.16.0-rc2+ #324
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
>> Google 01/01/2011
>> Call Trace:
>> __dump_stack lib/dump_stack.c:17 [inline]
>> dump_stack+0x194/0x24d lib/dump_stack.c:53
>> panic+0x1e4/0x41c kernel/panic.c:183
>> __warn+0x1dc/0x200 kernel/panic.c:547
>> report_bug+0x211/0x2d0 lib/bug.c:184
>> fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
>> fixup_bug arch/x86/kernel/traps.c:247 [inline]
>> do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
>> do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
>> invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
>> RIP: 0010:sk_del_node_init include/net/sock.h:638 [inline]
>> RIP: 0010:smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
>> RSP: 0018:ffff8801b639f198 EFLAGS: 00010293
>> RAX: ffff8801b684a340 RBX: 1ffff10036c73e37 RCX: ffffffff85a3f1f5
>> RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 1ffff10036c73e3b
>> RBP: ffff8801b639f280 R08: dffffc0000000000 R09: 0000000000000004
>> R10: ffff8801b639f050 R11: 0000000000000004 R12: ffff8801b639f258
>> R13: ffffffff87669b40 R14: ffff8801c08d57c0 R15: 1ffff10036c73e3b
>> smc_release+0x321/0x580 net/smc/af_smc.c:148
>> sock_release+0x8d/0x1e0 net/socket.c:595
>> sock_close+0x16/0x20 net/socket.c:1149
>> __fput+0x327/0x7e0 fs/file_table.c:209
>> ____fput+0x15/0x20 fs/file_table.c:243
>> task_work_run+0x199/0x270 kernel/task_work.c:113
>> exit_task_work include/linux/task_work.h:22 [inline]
>> do_exit+0x9bb/0x1ad0 kernel/exit.c:865
>> do_group_exit+0x149/0x400 kernel/exit.c:968
>> get_signal+0x73a/0x16d0 kernel/signal.c:2469
>> do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
>> exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
>> prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
>> syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
>> do_syscall_64+0x6e5/0x940 arch/x86/entry/common.c:292
>> entry_SYSCALL_64_after_hwframe+0x42/0xb7
>> RIP: 0033:0x44cad9
>> RSP: 002b:00007fbf24687ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
>> RAX: 0000000000000001 RBX: 0000000000700024 RCX: 000000000044cad9
>> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000080
>> RBP: 0000000000700020 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
>> R13: 000000000080ef3f R14: 00007fbf246889c0 R15: 0000000000000005
>> Dumping ftrace buffer:
>> (ftrace buffer empty)
>> Kernel Offset: disabled
>> Rebooting in 86400 seconds..
>>
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
Hi Davide,
Any progress on this?
This is syzbot top crasher at the moment with 86000+ machines crashed:
https://syzkaller.appspot.com/bug?id=004b0f7b61d4901cbfecfc33de7996e8cbe0a278
Hi Ursula,
On Fri, Feb 23, 2018 at 07:59:01AM -0800, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on upstream commit
> af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000)
> Merge tag 'leds_for-4.16-rc3' of
> git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
>
> So far this crash happened 27 times on
> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master,
> net-next, upstream.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: [email protected]
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init
> include/net/sock.h:638 [inline]
> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638
> smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
> Kernel panic - not syncing: panic_on_warn set ...
This is still happening and it can be easily reproduced with:
#include <sys/socket.h>
int main()
{
char buf[64] = { 0 };
struct iovec iov = { .iov_base = buf, .iov_len = sizeof(buf) };
struct msghdr msg = { .msg_iov = &iov, .msg_iovlen = 1 };
int fd;
fd = socket(AF_SMC, SOCK_STREAM, 0);
sendmsg(fd, &msg, MSG_FASTOPEN);
}
It seems the following sock_put() in smc_release() is done without any previous
sock_hold(), causing a use-after-free:
if (smc->use_fallback) {
sock_put(sk); /* passive closing */
sk->sk_state = SMC_CLOSED;
sk->sk_state_change(sk);
}
This is the output on latest Linus tree (commit fc36def997cfd6cb):
WARNING: CPU: 2 PID: 216 at include/net/sock.h:644 smc_unhash_sk+0x74/0x80 net/smc/af_smc.c:89
CPU: 2 PID: 216 Comm: syz_smc_unhash Not tainted 4.18.0-rc3-00113-gfc36def997cfd #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:smc_unhash_sk+0x74/0x80 net/smc/af_smc.c:89
Code: 8d bb 80 00 00 00 e8 9b 4a bc ff 48 8b 73 28 ba ff ff ff ff 48 8b 7b 30 e8 d9 a6 d4 ff 4c 89 e7 e8 e1 5b 02 00 5b 41 5c 5d c3 <0f> 0b eb d1 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 49 89 cf 41
RSP: 0018:ffffc900007cfd58 EFLAGS: 00010246
RAX: 0000000000000001 RBX: ffff8800792df7c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8270dda0 RDI: ffffffff81e92da0
RBP: ffffc900007cfd68 R08: ffffffff8270dda0 R09: 0000000000000001
R10: ffff88007933cbb8 R11: 0000000000000002 R12: ffffffff81e92da0
R13: 0000000000000000 R14: ffff8800792dfb20 R15: ffff8800792df840
FS: 00007ff24690e740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff245fe3eb0 CR3: 0000000001e0f000 CR4: 00000000003406e0
Call Trace:
smc_release+0x10a/0x1c0 net/smc/af_smc.c:162
__sock_release+0x31/0x80 net/socket.c:599
sock_close+0x10/0x20 net/socket.c:1150
__fput+0xb4/0x1f0 fs/file_table.c:209
____fput+0x9/0x10 fs/file_table.c:243
task_work_run+0x86/0xc0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x27a/0xa30 kernel/exit.c:865
do_group_exit+0x3c/0xc0 kernel/exit.c:968
__do_sys_exit_group kernel/exit.c:979 [inline]
__se_sys_exit_group kernel/exit.c:977 [inline]
__x64_sys_exit_group+0x13/0x20 kernel/exit.c:977
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff245fe3ee8
Code: Bad RIP value.
RSP: 002b:00007ffcd2bdcae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff245fe3ee8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007ff2462cd6d8 R08: 00000000000000e7 R09: ffffffffffffff80
R10: 00007ff2464da100 R11: 0000000000000246 R12: 00007ff2462cd6d8
R13: 00007ff2462d2be0 R14: 0000000000000000 R15: 0000000000000000
irq event stamp: 1821
hardirqs last enabled at (1819): [<ffffffff81053a5a>] __local_bh_enable_ip+0x7a/0xd0 kernel/softirq.c:190
hardirqs last disabled at (1821): [<ffffffff81800f23>] error_entry+0x73/0xc0 arch/x86/entry/entry_64.S:1262
softirqs last enabled at (1818): [<ffffffff8144f8ad>] spin_unlock_bh include/linux/spinlock.h:355 [inline]
softirqs last enabled at (1818): [<ffffffff8144f8ad>] release_sock+0x7d/0xb0 net/core/sock.c:2862
softirqs last disabled at (1820): [<ffffffff81706e0d>] smc_unhash_sk+0x1d/0x80 net/smc/af_smc.c:85
---[ end trace f41d8ae31daf1115 ]---
------------[ cut here ]------------
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 2 PID: 216 at lib/refcount.c:228 refcount_dec+0x33/0x40 lib/refcount.c:228
CPU: 2 PID: 216 Comm: syz_smc_unhash Tainted: G W 4.18.0-rc3-00113-gfc36def997cfd #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:refcount_dec+0x33/0x40 lib/refcount.c:228
Code: 48 89 e5 e8 6f ff ff ff 84 c0 75 02 5d c3 80 3d 85 94 bc 00 00 75 f5 48 c7 c7 40 43 d8 81 c6 05 75 94 bc 00 01 e8 d3 3f d8 ff <0f> 0b 5d c3 66 0f 1f 84 00 00 00 00 00 55 b8 01 00 00 00 31 d2 48
RSP: 0018:ffffc900007cfd48 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8800792df7c0 RCX: 0000000000000006
RDX: 0000000000000007 RSI: ffff88007933cbe0 RDI: ffff88007fd15410
RBP: ffffc900007cfd48 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e92da0
R13: 0000000000000000 R14: ffff8800792dfb20 R15: ffff8800792df840
FS: 00007ff24690e740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff245fe3ebe CR3: 0000000001e0f000 CR4: 00000000003406e0
Call Trace:
__sock_put include/net/sock.h:635 [inline]
sk_del_node_init include/net/sock.h:645 [inline]
smc_unhash_sk+0x55/0x80 net/smc/af_smc.c:86
smc_release+0x10a/0x1c0 net/smc/af_smc.c:162
__sock_release+0x31/0x80 net/socket.c:599
sock_close+0x10/0x20 net/socket.c:1150
__fput+0xb4/0x1f0 fs/file_table.c:209
____fput+0x9/0x10 fs/file_table.c:243
task_work_run+0x86/0xc0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x27a/0xa30 kernel/exit.c:865
do_group_exit+0x3c/0xc0 kernel/exit.c:968
__do_sys_exit_group kernel/exit.c:979 [inline]
__se_sys_exit_group kernel/exit.c:977 [inline]
__x64_sys_exit_group+0x13/0x20 kernel/exit.c:977
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff245fe3ee8
Code: Bad RIP value.
RSP: 002b:00007ffcd2bdcae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff245fe3ee8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007ff2462cd6d8 R08: 00000000000000e7 R09: ffffffffffffff80
R10: 00007ff2464da100 R11: 0000000000000246 R12: 00007ff2462cd6d8
R13: 00007ff2462d2be0 R14: 0000000000000000 R15: 0000000000000000
irq event stamp: 1841
hardirqs last enabled at (1840): [<ffffffff810a4297>] console_unlock+0x407/0x520 kernel/printk/printk.c:2422
hardirqs last disabled at (1841): [<ffffffff81800f23>] error_entry+0x73/0xc0 arch/x86/entry/entry_64.S:1262
softirqs last enabled at (1818): [<ffffffff8144f8ad>] spin_unlock_bh include/linux/spinlock.h:355 [inline]
softirqs last enabled at (1818): [<ffffffff8144f8ad>] release_sock+0x7d/0xb0 net/core/sock.c:2862
softirqs last disabled at (1820): [<ffffffff81706e0d>] smc_unhash_sk+0x1d/0x80 net/smc/af_smc.c:85
---[ end trace f41d8ae31daf1116 ]---
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 2 PID: 216 at lib/refcount.c:187 refcount_sub_and_test+0x4c/0x60 lib/refcount.c:187
CPU: 2 PID: 216 Comm: syz_smc_unhash Tainted: G W 4.18.0-rc3-00113-gfc36def997cfd #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
RIP: 0010:refcount_sub_and_test+0x4c/0x60 lib/refcount.c:187
Code: 5d 0f 94 c0 c3 83 f8 ff 75 df 31 c0 5d c3 80 3d ed 94 bc 00 00 75 f3 48 c7 c7 18 43 d8 81 c6 05 dd 94 bc 00 01 e8 3a 40 d8 ff <0f> 0b 31 c0 eb dc 31 c0 c3 90 66 2e 0f 1f 84 00 00 00 00 00 55 48
RSP: 0018:ffffc900007cfd58 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8800792df7c0 RCX: 0000000000000006
RDX: 0000000000000007 RSI: ffff88007933cbb8 RDI: ffff88007fd15410
RBP: ffffc900007cfd58 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88007cf16b80
R13: 0000000000000000 R14: ffff8800792dfb20 R15: ffff8800792df840
FS: 00007ff24690e740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff245fe3ebe CR3: 0000000001e0f000 CR4: 00000000003406e0
Call Trace:
refcount_dec_and_test+0x11/0x20 lib/refcount.c:212
sock_put include/net/sock.h:1666 [inline]
smc_release+0x112/0x1c0 net/smc/af_smc.c:163
__sock_release+0x31/0x80 net/socket.c:599
sock_close+0x10/0x20 net/socket.c:1150
__fput+0xb4/0x1f0 fs/file_table.c:209
____fput+0x9/0x10 fs/file_table.c:243
task_work_run+0x86/0xc0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x27a/0xa30 kernel/exit.c:865
do_group_exit+0x3c/0xc0 kernel/exit.c:968
__do_sys_exit_group kernel/exit.c:979 [inline]
__se_sys_exit_group kernel/exit.c:977 [inline]
__x64_sys_exit_group+0x13/0x20 kernel/exit.c:977
do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7ff245fe3ee8
Code: Bad RIP value.
RSP: 002b:00007ffcd2bdcae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff245fe3ee8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00007ff2462cd6d8 R08: 00000000000000e7 R09: ffffffffffffff80
R10: 00007ff2464da100 R11: 0000000000000246 R12: 00007ff2462cd6d8
R13: 00007ff2462d2be0 R14: 0000000000000000 R15: 0000000000000000
irq event stamp: 1880
hardirqs last enabled at (1879): [<ffffffff810a4297>] console_unlock+0x407/0x520 kernel/printk/printk.c:2422
hardirqs last disabled at (1880): [<ffffffff81800f23>] error_entry+0x73/0xc0 arch/x86/entry/entry_64.S:1262
softirqs last enabled at (1862): [<ffffffff81a001b2>] __do_softirq+0x1b2/0x23f kernel/softirq.c:314
softirqs last disabled at (1847): [<ffffffff81800caa>] do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1046
---[ end trace f41d8ae31daf1117 ]---
On 07/04/2018 10:01 PM, Eric Biggers wrote:
> Hi Ursula,
>
> On Fri, Feb 23, 2018 at 07:59:01AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot hit the following crash on upstream commit
>> af3e79d29555b97dd096e2f8e36a0f50213808a8 (Tue Feb 20 18:05:02 2018 +0000)
>> Merge tag 'leds_for-4.16-rc3' of
>> git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds
>>
>> So far this crash happened 27 times on
>> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master,
>> net-next, upstream.
>> C reproducer is attached.
>> syzkaller reproducer is attached.
>> Raw console output is attached.
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: [email protected]
>> It will help syzbot understand when the bug is fixed. See footer for
>> details.
>> If you forward the report, please keep this part and the footer.
>>
>> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638 sk_del_node_init
>> include/net/sock.h:638 [inline]
>> WARNING: CPU: 1 PID: 9921 at ./include/net/sock.h:638
>> smc_unhash_sk+0x335/0x450 net/smc/af_smc.c:90
>> Kernel panic - not syncing: panic_on_warn set ...
>
> This is still happening and it can be easily reproduced with:
>
> #include <sys/socket.h>
>
> int main()
> {
> char buf[64] = { 0 };
> struct iovec iov = { .iov_base = buf, .iov_len = sizeof(buf) };
> struct msghdr msg = { .msg_iov = &iov, .msg_iovlen = 1 };
> int fd;
>
> fd = socket(AF_SMC, SOCK_STREAM, 0);
> sendmsg(fd, &msg, MSG_FASTOPEN);
> }
>
> It seems the following sock_put() in smc_release() is done without any previous
> sock_hold(), causing a use-after-free:
>
> if (smc->use_fallback) {
> sock_put(sk); /* passive closing */
> sk->sk_state = SMC_CLOSED;
> sk->sk_state_change(sk);
> }
>
Sorry for the delay. Now patch is submitted for the net-tree.