Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2826619imu; Sun, 23 Dec 2018 08:39:21 -0800 (PST) X-Google-Smtp-Source: ALg8bN6hsx9H64YuCiE2SCi9dqGt2AoKo/yh7lin8JB3DfeCd2szq+tEND+ZnMFW/qzFFHo7A/E/ X-Received: by 2002:a5e:940c:: with SMTP id q12mr6210128ioj.228.1545583161236; Sun, 23 Dec 2018 08:39:21 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1545583161; cv=none; d=google.com; s=arc-20160816; b=ETdpCFCslli5r0I7nrelHZ3OhsLtYWUQKrFDucSg4bPxEcVPMTM5/YfEjdEuu2we7B AJYg8Ap4Sp6y24sBZ2cqZIfZmBOVRxl247lMob++OtdjRU7IPZN54gYxqsHjHxHHccb0 czfTJt3HFJC1fAkafw+76NgicUAmmS8nvCOM5PaoNktjaYIGcFzRxHyxWJS5qeLg70zO +LeqkpojRmSVC27wfq90jF37t0yJMRoavHfGPUoYCHz2a1OETzPxC4V6JPslPgy/Acg1 4mXpD5FD7sW7SGBAhmisp7+emO1yVlcBjqXCO4vWtq/puagopxeeJJWE+3V6VYVQY+K3 LCpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=ASctF/x87iqtmWVXp1hBj14o+1eGp8ayOCp7mWfLLPw=; b=O7jBkusCrEwBF6hzOzsH/ffi/pd5wOf/NhWRfPK420V2QBZmKTDpWDjzP5xBZDj8iF KL+hQTS8nwq3Iyxk/OjFvqPot6rtudmQRqlbvLo/P+ZbjOOGYFN5Gl7RqmYBA/XanNNj TknNzY24wG9wMwYbjaLCdau8DciP6roB/9NQwGy42BkOnu1cy0yUCcM+hWX+yUqOxM60 wjmO3iTelc8rMDVFQYhWmerdqsZ1T/3gzS36vfjfO/9NRdFyFXCMZI6ICk346DzeTJkK nl7OtURcY9fbW4+bE90wSLhhIGxyIB+o/nkdxKzQFFWv0+a7FXHx/hwZ6VdUqyYnrE2l 6siQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=vT1z7O3t; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f7si3191207jak.45.2018.12.23.08.39.08; Sun, 23 Dec 2018 08:39:21 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=vT1z7O3t; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726939AbeLWHh7 (ORCPT + 99 others); Sun, 23 Dec 2018 02:37:59 -0500 Received: from mail-it1-f194.google.com ([209.85.166.194]:54656 "EHLO mail-it1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726924AbeLWHh7 (ORCPT ); Sun, 23 Dec 2018 02:37:59 -0500 Received: by mail-it1-f194.google.com with SMTP id i145so12650279ita.4 for ; Sat, 22 Dec 2018 23:37:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ASctF/x87iqtmWVXp1hBj14o+1eGp8ayOCp7mWfLLPw=; b=vT1z7O3tSynCUuKpCJUeU91mkwlf3Of1SRri+zNBmxBd4MVEwT6sTJ3m8fGPTpTzDX UFOmXhiNRubNjUso1OUOeFl2/DJDr2PbNrhgHKbwuPrThkWHPCq7KPmZ3BlaxmGmD5c6 u+WfB2N3KtP/Mgmhtstu9GWk0Saqdsh7PfZNAnwDYyjde0uTHbm2N7bwNUO6FkdBr1Ic l2/77i/2EWyhl9g5IcbMAWMj8dnEOQ1WFqNfbf5DR3jyCyXnEPZvxkpgRXjWu84i2bfL oE2Wn0ohyf4knHEOPjpcnozWWgwsihcJtVxSZIYIIQ47/Ompb3OpMlRFv4GsJhAJvhRZ jj3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ASctF/x87iqtmWVXp1hBj14o+1eGp8ayOCp7mWfLLPw=; b=gM8c1Uw6v5UjhMlN0HMBoyRpH5U0FIJR3V6ARcPLGzUNyruDcnP1YFsm0RbLTXNTBK 2xcRy4StP4DxI2F37bU6iwofZ8mwfcxJwK1IEeWftbXrWoISQDXQwK0cXgZvz7ENqGpa S2oHUv/42f6cB8YbRf82lMmC42KjzPT3OiJkIXgkof35ESf2Q+6+WHJCY2gsbtUZjO18 TCdtPLf3+Z6JNGgpJyMMenZlQvxMr7KfBc4H4O5pl+M5zn6AJTEWtNFqoO9Rulq4GgAX IrG6cnOwBk5mMvmtYO1vU/Zh2hpIVqQjP8lI4aCopUcDU463mY4cmYyArmR0++vZu/61 eK2Q== X-Gm-Message-State: AA+aEWZk0Qx3jIujU5WkWMKqOu16aNCyiYIaAGTSZLQBYACv25yE0fgG VbjeEepk3hHLWuVsooLKIJBdavmbOKELr64Whj190w== X-Received: by 2002:a24:b20e:: with SMTP id u14mr6194433ite.12.1545550677770; Sat, 22 Dec 2018 23:37:57 -0800 (PST) MIME-Version: 1.0 References: <00000000000051ee78057cc4d98f@google.com> <87614226-e895-c3a3-3626-b0fbe7e191be@colorfullife.com> In-Reply-To: <87614226-e895-c3a3-3626-b0fbe7e191be@colorfullife.com> From: Dmitry Vyukov Date: Sun, 23 Dec 2018 08:37:46 +0100 Message-ID: Subject: Re: general protection fault in put_pid To: manfred Cc: syzbot+1145ec2e23165570c3ac@syzkaller.appspotmail.com, Andrew Morton , David Howells , "Eric W. Biederman" , ktsanaktsidis@zendesk.com, LKML , Michal Hocko , Mike Rapoport , Stephen Rothwell , syzkaller-bugs , Matthew Wilcox , Davidlohr Bueso Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Dec 22, 2018 at 8:07 PM Manfred Spraul wrote: > > Hi Dmitry, > > On 12/20/18 4:36 PM, Dmitry Vyukov wrote: > > On Wed, Dec 19, 2018 at 10:04 AM Manfred Spraul > > wrote: > >> Hello Dmitry, > >> > >> On 12/12/18 11:55 AM, Dmitry Vyukov wrote: > >>> On Tue, Dec 11, 2018 at 9:23 PM syzbot > >>> wrote: > >>>> Hello, > >>>> > >>>> syzbot found the following crash on: > >>>> > >>>> HEAD commit: f5d582777bcb Merge branch 'for-linus' of git://git.kernel... > >>>> git tree: upstream > >>>> console output: https://syzkaller.appspot.com/x/log.txt?x=135bc547400000 > >>>> kernel config: https://syzkaller.appspot.com/x/.config?x=c8970c89a0efbb23 > >>>> dashboard link: https://syzkaller.appspot.com/bug?extid=1145ec2e23165570c3ac > >>>> compiler: gcc (GCC) 8.0.1 20180413 (experimental) > >>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16803afb400000 > >>> +Manfred, this looks similar to the other few crashes related to > >>> semget$private(0x0, 0x4000, 0x3f) that you looked at. > >> I found one unexpected (incorrect?) locking, see the attached patch. > >> > >> But I doubt that this is the root cause of the crashes. > > > > But why? These one-off sporadic crashes reported by syzbot looks > > exactly like a subtle race and your patch touches sem_exit_ns involved > > in all reports. > > So if you don't spot anything else, I would say close these 3 reports > > with this patch (I see you already included Reported-by tags which is > > great!) and then wait for syzbot reaction. Since we got 3 of them, if > > it's still not fixed I would expect that syzbot will be able to > > retrigger this later again. > > As I wrote, unless semop() is used, sma->use_global_lock is always 9 and > nothing can happen. > > Every single-operation semop() reduces use_global_lock by one, i.e a > single semop call as done here cannot trigger the bug: > > https://syzkaller.appspot.com/text?tag=ReproSyz&x=16803afb400000 It contains "repeat":true,"procs":6, which means that it run 6 processes running this test in infinite loop. The last mark about number of tests executed was: 2018/12/11 18:38:02 executed programs: 2955 > But, one more finding: > > https://syzkaller.appspot.com/bug?extid=1145ec2e23165570c3ac > > https://syzkaller.appspot.com/text?tag=CrashLog&x=109ecf6e400000 > > The log file contain 1080 lines like these: > > > semget$private(..., 0x4003, ...) > > > > semget$private(..., 0x4006, ...) > > > > semget$private(..., 0x4007, ...) > > It ends up as kmalloc(128*0x400x), i.e. slightly more than 2 MB, an > allocation in the 4 MB kmalloc buffer: > > > [ 1201.210245] kmalloc-4194304 4698112KB 4698112KB > > > i.e.: 1147 4 MB kmalloc blocks --> are we leaking nearly 100% of the > semaphore arrays?? /\/\/\/\/\/\ Ha, this is definitely not healthy. > This one looks similar: > > https://syzkaller.appspot.com/bug?extid=c92d3646e35bc5d1a909 > > except that the array sizes are mixed, and thus there are kmalloc-1M and > kmalloc-2M as well. > > (and I did not count the number of semget calls) > > > The test apps use unshare(CLONE_NEWNS) and unshare(CLONE_NEWIPC), correct? > > I.e. no CLONE_NEWUSER. > > https://github.com/google/syzkaller/blob/master/executor/common_linux.h#L1523 CLONE_NEWUSER is used on some instances as well: https://github.com/google/syzkaller/blob/master/executor/common_linux.h#L1765 This crash happened on 2 different instances and 1 of them uses CLONE_NEWUSER and another does not. If it's important because of CAP_ADMIN in IPC namespace, then all instances should have it (instances that don't use NEWUSER are just root).