From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3301BC433F5 for ; Mon, 20 Dec 2021 06:01:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Subject:MIME-Version:Message-ID: In-Reply-To:Date:References:Cc:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=/vZKsBkgb9rYt1+G8mE9cScIuwxnwmCUoqmmfgymzC4=; b=A6dh6QR1YVuqHI4T91wY/71lQw cjBSTJT+4bs7U9VpDrHitxTI2SXpase1xDGkI5Xfx0z2ixCRHjxdt6ntk5DrwB/zMGcZan6mp6Beq Sev65l1sidIIzlIaVz2pY/a1vIjpLp8ozgci7ZmNEoRM+784VHSJUQjyfVw2ltHtQcQd3Yef6lqpd TPctT1wXK14gcouTVL9JYp62Ltwb8gFyLvTNOpIhP/xkAhlrxuy0wgTGx9DQBLYgCQ7vjVd66sQ1z tydWZ8bSmd4vKloTZTLs9oxJlj2YU1tZLfmtMRuylF1ZCpgl91gB15L/SXJlQ1fkhm5OwEGBEJga9 c0sKepKQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mzBhw-000j0L-FZ; Mon, 20 Dec 2021 05:59:36 +0000 Received: from out03.mta.xmission.com ([166.70.13.233]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mzBhs-000iyH-Bu for linux-arm-kernel@lists.infradead.org; Mon, 20 Dec 2021 05:59:33 +0000 Received: from in02.mta.xmission.com ([166.70.13.52]:34638) by out03.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1mzBhZ-006dMV-FK; Sun, 19 Dec 2021 22:59:13 -0700 Received: from ip68-227-161-49.om.om.cox.net ([68.227.161.49]:60214 helo=email.froward.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1mzBhY-00GgKZ-0F; Sun, 19 Dec 2021 22:59:13 -0700 From: ebiederm@xmission.com (Eric W. Biederman) To: Qian Cai Cc: Alexey Gladkov , Yu Zhao , , Catalin Marinas , Will Deacon , Mark Rutland , References: <875ysptfgi.fsf@email.froward.int.ebiederm.org> <87k0h5rxle.fsf@email.froward.int.ebiederm.org> Date: Sun, 19 Dec 2021 23:58:41 -0600 In-Reply-To: (Qian Cai's message of "Fri, 26 Nov 2021 00:34:04 -0500") Message-ID: <8735mnakby.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1mzBhY-00GgKZ-0F; ; ; mid=<8735mnakby.fsf@email.froward.int.ebiederm.org>; ; ; hst=in02.mta.xmission.com; ; ; ip=68.227.161.49; ; ; frm=ebiederm@xmission.com; ; ; spf=neutral X-XM-AID: U2FsdGVkX1/i5m39/w9z3yfj25x+T+tm7KVnWHxWY00= X-SA-Exim-Connect-IP: 68.227.161.49 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: BUG: KASAN: use-after-free in dec_rlimit_ucounts X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211219_215932_437889_60DDD408 X-CRM114-Status: GOOD ( 21.77 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Qian Cai writes: > On Wed, Nov 24, 2021 at 04:49:19PM -0500, Qian Cai wrote: >> Hmm, I don't know if that or it is just this platfrom is lucky to trigger >> the race condition quickly, but I can't reproduce it on x86 so far. I am >> Cc'ing a few arm64 people to see if they have spot anything I might be >> missing. The original bug report is here: >> >> https://lore.kernel.org/lkml/YZV7Z+yXbsx9p3JN@fixkernel.com/ > > Okay, I am finally able to reproduce this on x86_64 with the latest > mainline as well by setting CONFIG_USER_NS and KASAN on the top of > defconfig (I did not realize it did not select CONFIG_USER_NS in the first > place). Anyway, it still took less than 5-minute by running: > > $ trinity -C 48 It took me a while to get to the point of reproducing this but I can confirm I see this with 2 core VM, running 5.16.0-rc4. Running trinity 2019.06 packaged in debian 11. I didn't watch so I don't know if it was 5 minutes but I do know it took less than an hour. Now I am puzzled why there are not other reports of problems. Now to start drilling down to figure out why the user namespace was freed early. ---- The failure I got looked like: > BUG: KASAN: use-after-free in dec_rlimit_ucounts+0x7b/0xb0 > Read of size 8 at addr ffff88800b7dd018 by task trinity-c3/67982 > > CPU: 1 PID: 67982 Comm: trinity-c3 Tainted: G O 5.16.0-rc4 #1 > Hardware name: Xen HVM domU, BIOS 4.8.5-35.fc25 08/25/2021 > Call Trace: > > dump_stack_lvl+0x48/0x5e > print_address_descrtion.constprop.0+0x1f/0x140 > ? dec_rlimit_ucounts+0x7b/0xb0 > ? dec_rlimit_ucounts+0x7b/0xb0 > kasan_report.cold+0x7f/0xe0 > ? _raw_spin_lock+0x7f/0x11b > ? dec_rlimit_ucounts+0x7b/0xb0 > dec_rlimit_ucounts+0x7b/0xb0 > mqueue_evict_inode+0x417/0x590 > ? perf_trace_global_dirty_state+0x350/0x350 > ? __x64_sys_mq_unlink+0x250/0x250 > ? _raw_spin_lock_bh+0xe0/0xe0 > ? _raw_spin_lock_bh+0xe0/0xe0 > evict+0x155/0x2a0 > __x64_sys_mq_unlink+0x1a7/0x250 > do_syscall_64+0x3b/0x90 > entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x7f0505ebc9b9 > Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 00 0f 1f 44 00 00 48 89 .... > > Allocated by task 67717 > Freed by task 6027 > > The buggy address belongs to the object at ffff88800b7dce38 > which belongs to the cache user_namespace of size 600 > The buggy address is located 480 bytes inside of > 600-byte region [ffff88800b7dce38, ffff88800b7dd090] > The buggy address belongs to the page: > > trinity: Detected kernel tainting. Last seed was 1891442794 Eric _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel