From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: linux-rt-users-owner@vger.kernel.org Received: from mail-oi1-f196.google.com ([209.85.167.196]:32858 "EHLO mail-oi1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726468AbeJJQhO (ORCPT ); Wed, 10 Oct 2018 12:37:14 -0400 Received: by mail-oi1-f196.google.com with SMTP id a203-v6so3533200oib.0 for ; Wed, 10 Oct 2018 02:15:58 -0700 (PDT) MIME-Version: 1.0 From: Philipp K Date: Wed, 10 Oct 2018 11:15:46 +0200 Message-ID: Subject: complete_all() with 5 waiters in swake_up_all_locked Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sender: linux-rt-users-owner@vger.kernel.org List-ID: To: linux-rt-users@vger.kernel.org Cc: tglx@linutronix.de, bigeasy@linutronix.de Hi, I've been fuzzing linux-rt with syzkaller and found a way to trigger $title warning. The reproducer works with a defconfig + CONFIG_NET_KEY=3Dy on 4.18.12-rt6 k= ernel. Philipp PS: Liebe Gr=C3=BC=C3=9Fe von Lukas Bulwahn Syzkaller hit 'WARNING in swake_up_all_locked' bug. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1778 at /kernel-source//kernel/sched/swait.c:48 swake_up_all_locked+0x18d/0x220 kernel/sched/swait.c:48 complete_all() with 5 waiters Kernel panic - not syncing: panic_on_warn set ... CPU: 3 PID: 1778 Comm: cryptomgr_probe Not tainted 4.9.56-rt37-hpad-a1-64-a= bl #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 ffff88006a907ba8 ffffffff8b88c869 ffffffff8ca440a0 ffff88006a907c80 ffffffff8ca58600 ffffffff8b01f84d ffff88006a907c70 ffffffff8b1f8ec9 0000000041b58ab3 ffffffff8ceea20b ffffffff8b1f8d13 ffffffff0000001d Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x6c/0x93 lib/dump_stack.c:51 [] panic+0x1b6/0x397 kernel/panic.c:179 [] __warn+0x1e2/0x200 kernel/panic.c:544 [] warn_slowpath_fmt+0xc7/0x100 kernel/panic.c:567 [] swake_up_all_locked+0x18d/0x220 kernel/sched/swait.c:= 48 [] complete_all+0x4c/0x70 kernel/sched/completion.c:55 [] cryptomgr_probe+0x173/0x240 crypto/algboss.c:89 [] kthread+0x22d/0x2b0 kernel/kthread.c:211 [] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:433 Shutting down cpus with NMI Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: 0xac00000 from 0xffffffff80200000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Syzkaller reproducer: # {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:8 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 EnableTun:false UseTmpDir:false EnableCgroups:false EnableNetdev:false ResetNet:false HandleSegv:false Repro:false Trace:false} r0 =3D socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)=3D{0x0, 0x0, &(0x7f0000000040)=3D{&(0x7f0000000000)=3D{0x2, 0x7, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x10}}, 0x0) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms() { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void setup_common() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid(); struct rlimit rlim; rlim.rlim_cur =3D rlim.rlim_max =3D 160 << 20; setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur =3D rlim.rlim_max =3D 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur =3D rlim.rlim_max =3D 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur =3D rlim.rlim_max =3D 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur =3D rlim.rlim_max =3D 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur =3D rlim.rlim_max =3D 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } } int wait_for_loop(int pid) { if (pid < 0) exit(1); int status =3D 0; while (waitpid(-1, &status, __WALL) !=3D pid) { } return WEXITSTATUS(status); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid =3D fork(); if (pid !=3D 0) return wait_for_loop(pid); setup_common(); sandbox_common(); if (unshare(CLONE_NEWNET)) { } loop(); exit(1); } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); int i; for (i =3D 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) =3D=3D pid) return; usleep(1000); } DIR* dir =3D opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent =3D readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") =3D=3D 0 || strcmp(ent->d_name, ".= .") =3D=3D 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd =3D open(abort, O_WRONLY); if (fd =3D=3D -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) !=3D pid) { } } #define SYZ_HAVE_SETUP_TEST 1 static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); } #define SYZ_HAVE_RESET_TEST 1 static void reset_test() { int fd; for (fd =3D 3; fd < 30; fd++) close(fd); } static void execute_one(); #define WAIT_FLAGS __WALL static void loop() { int iter; for (iter =3D 0;; iter++) { int pid =3D fork(); if (pid < 0) exit(1); if (pid =3D=3D 0) { setup_test(); execute_one(); reset_test(); exit(0); } int status =3D 0; uint64_t start =3D current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) =3D=3D pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] =3D {0xffffffffffffffff}; void execute_one() { long res =3D 0; res =3D syscall(__NR_socket, 0xf, 3, 2); // socket(PF_KEY, SOCK_RAW, AF_INET); if (res !=3D -1) r[0] =3D res; *(uint64_t*)0x20000180 =3D 0; *(uint32_t*)0x20000188 =3D 0; *(uint64_t*)0x20000190 =3D 0x20000040; *(uint64_t*)0x20000040 =3D 0x20000000; *(uint8_t*)0x20000000 =3D 2; *(uint8_t*)0x20000001 =3D 7; *(uint8_t*)0x20000002 =3D 0; *(uint8_t*)0x20000003 =3D 0; *(uint16_t*)0x20000004 =3D 2; *(uint16_t*)0x20000006 =3D 0; *(uint32_t*)0x20000008 =3D 4; *(uint32_t*)0x2000000c =3D 0; *(uint64_t*)0x20000048 =3D 0x10; *(uint64_t*)0x20000198 =3D 1; *(uint64_t*)0x200001a0 =3D 0; *(uint64_t*)0x200001a8 =3D 0; *(uint32_t*)0x200001b0 =3D 0; syscall(__NR_sendmsg, r[0], 0x20000180, 0); } int main() { syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); for (procid =3D 0; procid < 8; procid++) { if (fork() =3D=3D 0) { do_sandbox_none(); } } sleep(1000000); return 0; }