From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0F57C433EF for ; Sun, 10 Oct 2021 11:27:15 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 24B7F60D07 for ; Sun, 10 Oct 2021 11:27:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 24B7F60D07 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 79CA56B006C; Sun, 10 Oct 2021 07:27:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 74BD36B0072; Sun, 10 Oct 2021 07:27:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 63A29900002; Sun, 10 Oct 2021 07:27:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0112.hostedemail.com [216.40.44.112]) by kanga.kvack.org (Postfix) with ESMTP id 54BF86B006C for ; Sun, 10 Oct 2021 07:27:14 -0400 (EDT) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 00B902FE12 for ; Sun, 10 Oct 2021 11:27:13 +0000 (UTC) X-FDA: 78680301588.12.54A4AE9 Received: from mail3-164.sinamail.sina.com.cn (mail3-164.sinamail.sina.com.cn [202.108.3.164]) by imf18.hostedemail.com (Postfix) with SMTP id 6F31640039E6 for ; Sun, 10 Oct 2021 11:27:10 +0000 (UTC) Received: from unknown (HELO localhost.localdomain)([123.115.166.15]) by sina.com (172.16.97.35) with ESMTP id 6162CE090002CCD9; Sun, 10 Oct 2021 19:27:07 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com X-SMAIL-MID: 78798915073522 From: Hillf Danton To: Jordan Glover Cc: Yu Zhao , Alexey Gladkov , ebiederm@xmission.com, LKML , linux-mm@kvack.org, containers@lists.linux-foundation.org Subject: Re: linux 5.14.3: free_user_ns causes NULL pointer dereference Date: Sun, 10 Oct 2021 19:26:57 +0800 Message-Id: <20211010112657.1365-1-hdanton@sina.com> In-Reply-To: References: <1M9_d6wrcu6rdPe1ON0_k0lOxJMyyot3KAb1gdyuwzDPC777XVUWPHoTCEVmcK3fYfgu7sIo3PSaLe9KulUdm4TWVuqlbKyYGxRAjsf_Cpk=@protonmail.ch> <87ee9pa6xw.fsf@disp2133> <878rzw77i3.fsf@disp2133> <20210929173611.fo5traia77o63gpw@example.org> <20210930130640.wudkpmn3cmah2cjz@example.org> <20211006021219.2010-1-hdanton@sina.com> MIME-Version: 1.0 X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 6F31640039E6 X-Stat-Signature: hk94kfrne1w1scg6z4robrof3fzbzaks Authentication-Results: imf18.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf18.hostedemail.com: domain of hdanton@sina.com designates 202.108.3.164 as permitted sender) smtp.mailfrom=hdanton@sina.com X-HE-Tag: 1633865230-340606 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, 07 Oct 2021 13:28:29 +0000 Jordan Glover wrote: > >For me above patch changed slightly the printed output. Now the warning >comes from 'cleanup_net' instead of 'free_user_ns'. My system was also >still responsive after the bug occurred which didn't happen previously. >I can't say if this means anything or if this is result of above patch >or instability of my reproducer. Thanks for your report. It is the same issue as reported before and my patch did not help. Hillf > >------------[ cut here ]------------ >WARNING: CPU: 2 PID: 27643 at kernel/ucount.c:256 dec_ucount+0x43/0x50 >Modules linked in: >CPU: 2 PID: 27643 Comm: kworker/u8:3 Not tainted 5.14.9 #1 0274f3d0712a6= dad=3D >c9a2cf8341ae333de732a31a >Workqueue: netns cleanup_net >RIP: 0010:dec_ucount+0x43/0x50 >Code: 14 01 48 8b 02 48 89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 = 8b =3D >41 10 48 8b 88 e8 01 00 00 48 85 c9 75 d9 e9 fd fc ff ff <0f> 0b eb e7 6= 6 0=3D >f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 f8 48 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000= 000=3D >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 000072a95d359030 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >Call Trace: > cleanup_net+0x2e2/0x370 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 >---[ end trace e5fdc3317f00d0e8 ]--- >BUG: kernel NULL pointer dereference, address: 00000000000001e8 >#PF: supervisor read access in kernel mode >#PF: error_code(0x0000) - not-present page >PGD 0 P4D 0 >Oops: 0000 [#1] SMP PTI >CPU: 2 PID: 27643 Comm: kworker/u8:3 Tainted: G W 5.14.9 = #1 =3D >0274f3d0712a6dadc9a2cf8341ae333de732a31a >Workqueue: netns cleanup_net >RIP: 0010:dec_ucount+0x32/0x50 >Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 = 48 =3D >89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 0= 1 0=3D >0 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000= 000=3D >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >Call Trace: > cleanup_net+0x2e2/0x370 > process_one_work+0x1e1/0x380 > worker_thread+0x50/0x3a0 > ? rescuer_thread+0x360/0x360 > kthread+0x127/0x150 > ? set_kthread_struct+0x40/0x40 > ret_from_fork+0x22/0x30 >Modules linked in: >CR2: 00000000000001e8 >---[ end trace e5fdc3317f00d0e9 ]--- >RIP: 0010:dec_ucount+0x32/0x50 >Code: 74 34 89 f6 48 89 f9 4c 8d 04 f5 20 00 00 00 4a 8d 14 01 48 8b 02 = 48 =3D >89 c6 48 83 ee 01 78 1c f0 48 0f b1 32 75 f0 48 8b 41 10 <48> 8b 88 e8 0= 1 0=3D >0 00 48 85 c9 75 d9 e9 fd fc ff ff 0f 0b eb e7 66 >RSP: 0018:ffffb34fc34cfe30 EFLAGS: 00010297 >RAX: 0000000000000000 RBX: ffffa448eec5f3b0 RCX: ffffa447cfe1f540 >RDX: ffffa447cfe1f580 RSI: ffffffffffffffff RDI: ffffa447c445c780 >RBP: ffffa448eec5f380 R08: 0000000000000040 R09: ffffa44a196ac040 >R10: 00000000001436be R11: 0000000000000259 R12: ffffb34fc34cfe10 >R13: ffffb34fc34cfe40 R14: 00000000ffffffff R15: ffffa448eec5d414 >FS: 0000000000000000(0000) GS:ffffa44a19700000(0000) knlGS:000000000000= 000=3D >0 >CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >CR2: 00000000000001e8 CR3: 000000000b20e005 CR4: 00000000003706e0 >DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > >