Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753174AbbKZSFX (ORCPT ); Thu, 26 Nov 2015 13:05:23 -0500 Received: from mail-ig0-f176.google.com ([209.85.213.176]:35116 "EHLO mail-ig0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751277AbbKZSFS (ORCPT ); Thu, 26 Nov 2015 13:05:18 -0500 Subject: Re: GPF in process_one_work (flush_to_ldisc) To: Dmitry Vyukov , Greg Kroah-Hartman , Jiri Slaby , LKML References: Cc: syzkaller , Kostya Serebryany , Alexander Potapenko , Eric Dumazet , Sasha Levin , J Freyensee From: Peter Hurley Message-ID: <565749DB.5030109@hurleysoftware.com> Date: Thu, 26 Nov 2015 13:05:15 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 8437 Lines: 198 + James Freyensee (author of N_TRACESINK line discipline) On 11/26/2015 09:17 AM, Dmitry Vyukov wrote: > Hello, > > The following program triggers GPF: Thanks for the report, Dmitry. Patch attached should fix the GPF. The GPF happens because the N_TRACESINK line discipline does not define a receive_buf() method, so the function ptr is NULL. I audited every ldisc method invocation in case there were other similar lurking GPFs, but every other method is first checked for NULL. Thanks again. Regards, Peter Hurley > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > > int main() > { > long r0 = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, > 0x32ul, 0xfffffffffffffffful, 0x0ul); > long r1 = syscall(SYS_pipe2, 0x20000000ul, 0x80000ul, 0, 0, 0, 0); > long r2 = -1; > if (r1 != -1) > r2 = *(uint32_t*)0x20000000; > long r3 = -1; > if (r1 != -1) > r3 = *(uint32_t*)0x20000004; > long r6 = syscall(SYS_open, "/dev/ptmx", 0x1ul, 0x0ul, 0, 0, 0); > long r10 = syscall(SYS_write, r6, 0x20001000ul, 0x1000ul, 0, 0, 0); > *(uint32_t*)0x20003000 = 0x17; > long r12 = syscall(SYS_ioctl, r6, 0x5423ul, 0x20003000ul, 0, 0, 0); > long r18 = syscall(SYS_mmap, 0x20002000ul, 0x1000ul, 0x3ul, > 0x32ul, r2, 0x0ul); > long r20 = syscall(SYS_mmap, 0x20002000ul, 0x1000ul, 0x3ul, > 0x32ul, 0xfffffffffffffffful, 0x0ul); > *(uint64_t*)0x20002000 = 0x2000225e; > *(uint64_t*)0x20002008 = 0x56; > *(uint64_t*)0x20002010 = 0x20002bc6; > *(uint64_t*)0x20002018 = 0xe7; > *(uint64_t*)0x20002020 = 0x20002fd7; > *(uint64_t*)0x20002028 = 0x29; > *(uint64_t*)0x20002030 = 0x20002f39; > *(uint64_t*)0x20002038 = 0xc7; > long r33 = syscall(SYS_writev, r3, 0x20002000ul, 0x4ul, 0, 0, 0); > long r34 = syscall(SYS_dup2, r2, r6, 0, 0, 0, 0); > return 0; > } > > > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [< (null)>] (null) > PGD 3752d067 PUD 37a7b067 PMD 0 > Oops: 0010 [#1] SMP KASAN > Modules linked in: > CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Workqueue: events_unbound flush_to_ldisc > task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000 > RIP: 0010:[<0000000000000000>] [< (null)>] (null) > RSP: 0018:ffff88006db67b50 EFLAGS: 00010246 > RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102 > RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388 > RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0 > R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000 > R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8 > FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b > CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0 > Stack: > ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000 > ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90 > ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078 > Call Trace: > [] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030 > [] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162 > [] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302 > [] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468 > Code: Bad RIP value. > RIP [< (null)>] (null) > RSP > CR2: 0000000000000000 > ---[ end trace a587f8947e54d6ea ]--- > > > strace output: > > execve("./a.out", ["./a.out"], [/* 14 vars */]) = 0 > brk(0) = 0x1590000 > brk(0x15911c0) = 0x15911c0 > arch_prctl(ARCH_SET_FS, 0x1590880) = 0 > readlink("/proc/self/exe", "/root/a.out", 4096) = 11 > brk(0x15b21c0) = 0x15b21c0 > brk(0x15b3000) = 0x15b3000 > access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) > mmap(0x20000000, 65536, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > pipe2([3, 4], O_CLOEXEC) = 0 > open("/dev/ptmx", O_WRONLY) = 5 > write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 4096) = 4096 > ioctl(5, TIOCSETD, [23]) = 0 > mmap(0x20002000, 4096, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, 3, 0) = 0x20002000 > mmap(0x20002000, 4096, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20002000 > writev(4, [{"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 86}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 231}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 41}, {"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 199}], 4) = 557 > dup2(3, 5 > > at this point VM hangs. > > On commit 6ffeba9607343f15303a399bc402a538800d89d9 (Now 24). > --- >% --- Subject: [PATCH] tty: Fix GPF in flush_to_ldisc() A line discipline which does not define a receive_buf() method can can cause a GPF if data is ever received [1]. Oddly, this was known to the author of N_TRACESINK in 2011, but never fixed. [1] GPF report BUG: unable to handle kernel NULL pointer dereference at (null) IP: [< (null)>] (null) PGD 3752d067 PUD 37a7b067 PMD 0 Oops: 0010 [#1] SMP KASAN Modules linked in: CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: events_unbound flush_to_ldisc task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000 RIP: 0010:[<0000000000000000>] [< (null)>] (null) RSP: 0018:ffff88006db67b50 EFLAGS: 00010246 RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102 RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388 RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0 R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8 FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0 Stack: ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000 ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90 ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078 Call Trace: [] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030 [] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162 [] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302 [] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468 Code: Bad RIP value. RIP [< (null)>] (null) RSP CR2: 0000000000000000 ---[ end trace a587f8947e54d6ea ]--- Reported-by: Dmitry Vyukov Signed-off-by: Peter Hurley --- drivers/tty/tty_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c index 9a479e6..3cd31e0 100644 --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -450,7 +450,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count) count = disc->ops->receive_buf2(tty, p, f, count); else { count = min_t(int, count, tty->receive_room); - if (count) + if (count && disc->ops->receive_buf) disc->ops->receive_buf(tty, p, f, count); } return count; -- 2.6.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/