[lkml]   [2018]   [Dec]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: general protection fault in put_pid
Hi Dmitry,

On 12/20/18 4:36 PM, Dmitry Vyukov wrote:
> On Wed, Dec 19, 2018 at 10:04 AM Manfred Spraul
> <> wrote:
>> Hello Dmitry,
>> On 12/12/18 11:55 AM, Dmitry Vyukov wrote:
>>> On Tue, Dec 11, 2018 at 9:23 PM syzbot
>>> <> wrote:
>>>> Hello,
>>>> syzbot found the following crash on:
>>>> HEAD commit: f5d582777bcb Merge branch 'for-linus' of git://git.kernel...
>>>> git tree: upstream
>>>> console output:
>>>> kernel config:
>>>> dashboard link:
>>>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>>>> syz repro:
>>> +Manfred, this looks similar to the other few crashes related to
>>> semget$private(0x0, 0x4000, 0x3f) that you looked at.
>> I found one unexpected (incorrect?) locking, see the attached patch.
>> But I doubt that this is the root cause of the crashes.
> But why? These one-off sporadic crashes reported by syzbot looks
> exactly like a subtle race and your patch touches sem_exit_ns involved
> in all reports.
> So if you don't spot anything else, I would say close these 3 reports
> with this patch (I see you already included Reported-by tags which is
> great!) and then wait for syzbot reaction. Since we got 3 of them, if
> it's still not fixed I would expect that syzbot will be able to
> retrigger this later again.

As I wrote, unless semop() is used, sma->use_global_lock is always 9 and
nothing can happen.

Every single-operation semop() reduces use_global_lock by one, i.e a
single semop call as done here cannot trigger the bug:

But, one more finding:

The log file contain 1080 lines like these:

> semget$private(..., 0x4003, ...)
> semget$private(..., 0x4006, ...)
> semget$private(..., 0x4007, ...)

It ends up as kmalloc(128*0x400x), i.e. slightly more than 2 MB, an
allocation in the 4 MB kmalloc buffer:

> [ 1201.210245] kmalloc-4194304 4698112KB 4698112KB
i.e.: 1147 4 MB kmalloc blocks --> are we leaking nearly 100% of the
semaphore arrays??

This one looks similar:

except that the array sizes are mixed, and thus there are kmalloc-1M and
kmalloc-2M as well.

(and I did not count the number of semget calls)

The test apps use unshare(CLONE_NEWNS) and unshare(CLONE_NEWIPC), correct?




 \ /
  Last update: 2018-12-22 20:08    [W:0.090 / U:2.532 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site