Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1576836441-4140-1-git-send-email-yanghui.def@gmail.com>
 <CAHC9VhTup_3LnC+i77_bC93G0GUdh1xY7JM5fbRD5_oPO9=jMA@mail.gmail.com> <CA+wXOo0Hfvmht5he5eMNZFyHsSgVV_uvBYriqMXJzU5g0rkigw@mail.gmail.com>
In-Reply-To: <CA+wXOo0Hfvmht5he5eMNZFyHsSgVV_uvBYriqMXJzU5g0rkigw@mail.gmail.com>
From:   Paul Moore <paul@paul-moore.com>
Date:   Sat, 21 Dec 2019 10:02:38 -0500
Message-ID: <CAHC9VhQ3ybWPQdAebwk=hz=OJwzusYYK_A9eAEnSgUE1uyG3Gg@mail.gmail.com>
Subject: Re: [PATCH] netnode.c : fix sel_netnode_hash be destroyed
To:     hui yang <yanghui.def@gmail.com>
Cc:     Stephen Smalley <sds@tycho.nsa.gov>,
        Eric Paris <eparis@parisplace.org>, selinux@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Dec 20, 2019 at 9:37 PM hui yang <yanghui.def@gmail.com> wrote:
> Dear Paul Moore :
>      When the phone is power on about 30 second. it happened kernel
> panic . The probability of kerner panic is about 4/10000=E3=80=82
>       I used Android Q base kerner-4.9. I can't reproduce it, it
> happened four times on  different phone. all message is Unable to
> handle kernel paging request at virtual address fffffffffffffffc =EF=BC=
=8C x0
> : ffffffffffffffe8
>       In our code ,we  did not change the code in netnode.c.
>       sel_netnode_find code line is 114.
>       list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list)  i=
s 131.
>       if (node->nsec.family =3D=3D family) is 132 .
>       The backtrace is :
> [   31.152983] [<00000000584f97e1>] sel_netnode_find+0x6c/0xf0
> [   31.157670] [<00000000d1009c50>] sel_netnode_sid+0x3c/0x248
> [   31.163225] [<00000000c6ff20a5>] selinux_socket_bind+0x204/0x230
> [   31.168777] [<0000000080a7de33>] security_socket_bind+0x64/0x94
> [   31.180679] [<00000000a01eb02b>] SyS_bind+0x10c/0x164
> [   31.187269] [<00000000c7a460e5>] el0_svc_naked+0x34/0x38
>
> please help to check more . I think there is a bug in netnode.c
> Thank you so much.

Looking at netnode.c again somewhat quickly I don't see anything
obvious, but it sounds like this is an Android kernel, yes?  I don't
have a copy of the Android kernel sources to inspect, but given that
kernel v4.9 is quite old compared to upstream I suspect the Android
kernel has a number of backports, making this difficult to diagnose.

If this is an Android kernel, I would suggest talking with the Android
kernel developers.

> Paul Moore <paul@paul-moore.com> =E4=BA=8E2019=E5=B9=B412=E6=9C=8820=E6=
=97=A5=E5=91=A8=E4=BA=94 =E4=B8=8B=E5=8D=889:48=E5=86=99=E9=81=93=EF=BC=9A
> >
> > On Fri, Dec 20, 2019 at 5:07 AM hui yang <yanghui.def@gmail.com> wrote:
> > > From: YangHui <yanghui.def@gmail.com>
> > >
> > > we often find below error :
> > > [   30.729718] Unable to handle kernel paging request at virtual addr=
ess fffffffffffffffc
> > > [   30.747478] Kernel BUG at sel_netnode_find+0x6c/0xf0 [verbose debu=
g info unavailable]
> > > [   30.818858] PC is at sel_netnode_find+0x6c/0xf0
> > > [   30.824671] LR is at sel_netnode_sid+0x3c/0x248
> > > [   30.829170] pc : [<ffffff8008428094>] lr : [<ffffff8008428154>] ps=
tate: a0400145
> > > [   30.833701] sp : ffffffc026f27c50
> > > [   30.841319] x29: ffffffc026f27c50 x28: ffffffc026f27e40
> > > [   30.849634] x27: ffffff8009132000 x26: 0000000000000000
> > > [   30.854932] x25: ffffffc016f0aa80 x24: 0000000000000000
> > > [   30.860224] x23: ffffffc026f27e38 x22: ffffffc026f27d34
> > > [   30.865520] x21: 000000000000000a x20: ffffffc026f27e40
> > > [   30.870818] x19: 000000000000000a x18: 0000007a13b48000
> > > [   30.876118] x17: 0000007a16ca93c0 x16: ffffff8008e56b2c
> > > [   30.881406] x15: 0000000000000020 x14: 002dc6bffa5d9e00
> > > [   30.886701] x13: 203a644974654e4c x12: 00000000000017c1
> > > [   30.891997] x11: 0000000000000000 x10: 0000000000000001
> > > [   30.897292] x9 : 0000000000000002 x8 : ffffff8009933090
> > > [   30.902588] x7 : ffffffc0725fd090 x6 : 0000000004fd9f2c
> > > [   30.907881] x5 : 0000000000000000 x4 : 0000000000000000
> > > [   30.913176] x3 : 00000001ffffffff x2 : 0000000000000000
> > > [   30.918475] x1 : ffffff800a10ca80 x0 : ffffffffffffffe8
> > > some sel_netnode_hash[idx].list=3D=3DNULL,so happend this.
> > > I add spin_lock_bh on sel_netnode_init.
> > >
> > > Signed-off-by: YangHui <yanghui.def@gmail.com>
> > > ---
> > >  security/selinux/netnode.c | 3 ++-
> > >  1 file changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> > > index 9ab84ef..aa0eeb7 100644
> > > --- a/security/selinux/netnode.c
> > > +++ b/security/selinux/netnode.c
> > > @@ -293,11 +293,12 @@ static __init int sel_netnode_init(void)
> > >
> > >         if (!selinux_enabled)
> > >                 return 0;
> > > -
> > > +       spin_lock_bh(&sel_netnode_lock);
> > >         for (iter =3D 0; iter < SEL_NETNODE_HASH_SIZE; iter++) {
> > >                 INIT_LIST_HEAD(&sel_netnode_hash[iter].list);
> > >                 sel_netnode_hash[iter].size =3D 0;
> > >         }
> > > +       spin_unlock_bh(&sel_netnode_lock);
> > >
> > >         return 0;
> > >  }
> >
> > I'm confused as to why this patch solved your problem.  The
> > sel_netnode_init() function is only run once during early boot and
> > there shouldn't be any other threads trying to access the netnode
> > cache at this point.
> >
> > Can you explain the conditions under which you see this problem?  What
> > kernel are you using (stock distro kernel?  upstream?  Android?)?  Can
> > you reproduce this problem?  Can you provide source code line numbers
> > associated with the func/offset lines in the backtrace above?
> >
> > --
> > paul moore
> > www.paul-moore.com


--=20
paul moore
www.paul-moore.com