From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1C55C4332F for ; Mon, 11 Oct 2021 13:09:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4D3C960F4B for ; Mon, 11 Oct 2021 13:09:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 4D3C960F4B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id B82256B006C; Mon, 11 Oct 2021 09:09:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B32A7900002; Mon, 11 Oct 2021 09:09:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A20DE6B0072; Mon, 11 Oct 2021 09:09:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0129.hostedemail.com [216.40.44.129]) by kanga.kvack.org (Postfix) with ESMTP id 9061E6B006C for ; Mon, 11 Oct 2021 09:09:35 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 50AEA2DD9D for ; Mon, 11 Oct 2021 13:09:35 +0000 (UTC) X-FDA: 78684188310.25.BF29193 Received: from r3-21.sinamail.sina.com.cn (r3-21.sinamail.sina.com.cn [202.108.3.21]) by imf25.hostedemail.com (Postfix) with SMTP id E912EB0022DD for ; Mon, 11 Oct 2021 13:09:33 +0000 (UTC) Received: from unknown (HELO localhost.localdomain)([123.115.166.15]) by sina.com (172.16.97.32) with ESMTP id 6164378800010F2A; Mon, 11 Oct 2021 21:09:31 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com X-SMAIL-MID: 15139628796 From: Hillf Danton To: Rune Kleveland Cc: Yu Zhao , "Eric W. Biederman" , Alexey Gladkov , Jordan Glover , LKML , linux-mm@kvack.org, containers@lists.linux-foundation.org Subject: Re: linux 5.14.3: free_user_ns causes NULL pointer dereference Date: Mon, 11 Oct 2021 21:09:20 +0800 Message-Id: <20211011130920.1480-1-hdanton@sina.com> In-Reply-To: References: <1M9_d6wrcu6rdPe1ON0_k0lOxJMyyot3KAb1gdyuwzDPC777XVUWPHoTCEVmcK3fYfgu7sIo3PSaLe9KulUdm4TWVuqlbKyYGxRAjsf_Cpk=@protonmail.ch> <87ee9pa6xw.fsf@disp2133> <878rzw77i3.fsf@disp2133> <20210929173611.fo5traia77o63gpw@example.org> <20210930130640.wudkpmn3cmah2cjz@example.org> <878rz8wwb6.fsf@disp2133> <87v92cvhbf.fsf@disp2133> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: E912EB0022DD X-Stat-Signature: qeohco93js5388ma81sttwmf95dnmu89 Authentication-Results: imf25.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf25.hostedemail.com: domain of hdanton@sina.com designates 202.108.3.21 as permitted sender) smtp.mailfrom=hdanton@sina.com X-HE-Tag: 1633957773-726985 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, 10 Oct 2021 10:59:10 +0200 Rune Kleveland wrote: > Just wanted to let you know that I still get these on stock Fedora=20 > kernel 5.14.10 on the IBM blades. But it took 10 hours before the first= =20 Thanks for your report. > server crashed. The other 4 still runs fine since 15 hours ago. So for=20 > me it seems more stable now, but that could just be a coincidence. >=20 > Best regards, >=20 > Rune >=20 > ------------[ cut here ]------------ > kernel BUG at mm/slub.c:321! We did not see this before. > invalid opcode: 0000 [#1] SMP PTI > CPU: 22 PID: 1838853 Comm: python3 Not tainted 5.14.10-200.fc34.x86_64 = #1 > Hardware name: IBM BladeCenter HS22 -[7870TKN]-/68Y8161, BIOS=20 > -[P9E164CUS-1.28]- 04/17/2018 > RIP: 0010:__slab_free+0x245/0x4a0 > Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b= =20 > 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49=20 > 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> > RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 > RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 > RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 > RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 > R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 > R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 > FS:=C2=A0 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:000000= 0000000000 > CS:=C2=A0 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 > Call Trace: > =C2=A0? filename_lookup+0x135/0x1b0 > =C2=A0? put_ucounts+0x65/0x70 > =C2=A0kfree+0x369/0x3c0 > =C2=A0put_ucounts+0x65/0x70 > =C2=A0put_cred_rcu+0x70/0xd0 > =C2=A0do_faccessat+0x113/0x240 > =C2=A0do_syscall_64+0x3b/0x90 > =C2=A0entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x7f7a899cc44b > Code: 77 05 c3 0f 1f 40 00 48 8b 15 29 1a 0d 00 f7 d8 64 89 02 48 c7 c0= =20 > ff ff ff ff c3 0f 1f 40 00 f3 0f 1e fa b8 15 00 00 00 0f 05 <48> 3d 00=20 > f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 f9 19 0> > RSP: 002b:00007ffd01fa9ce8 EFLAGS: 00000202 ORIG_RAX: 0000000000000015 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7a899cc44b > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f79a96d6e10 > RBP: 0000000000000001 R08: 0000000000000000 R09: 00007f7a7c1fb930 > R10: 00007f79a96d6000 R11: 0000000000000202 R12: 00007ffd01fa9d00 > R13: 0000000000000001 R14: 0000556841045c90 R15: 00000000ffffff9c > Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs=20 > lockd grace sunrpc fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6= =20 > nft_fib nft_reject_inet nf_reject_ipv4 nf_rejec> > ---[ end trace 0a81b150eacde1d5 ]--- > RIP: 0010:__slab_free+0x245/0x4a0 > Code: 0f b6 5c 24 1b 44 8b 44 24 1c 48 89 44 24 08 48 8b 54 24 20 4c 8b= =20 > 4c 24 28 e9 8a fe ff ff 41 f7 45 08 00 0d 21 00 75 98 eb 8d <0f> 0b 49=20 > 3b 54 24 28 0f 85 53 ff ff ff 49 8b 44 24 08 4> > RSP: 0018:ffffb71dcfd6fda0 EFLAGS: 00010246 > RAX: ffff9c5480d35860 RBX: ffff9c5480d35800 RCX: ffff9c5480d35800 > RDX: 00000000802a0029 RSI: ffffeb41da034d00 RDI: ffff9c4f00042800 > RBP: ffffb71dcfd6fe50 R08: 0000000000000001 R09: ffffffff9210b6a5 > R10: ffff9c548102e000 R11: 0000000062667658 R12: ffffeb41da034d00 > R13: ffff9c4f00042800 R14: ffff9c5480d35800 R15: ffff9c5480d35800 > FS:=C2=A0 00007f7a89765740(0000) GS:ffff9c6c1fc80000(0000) knlGS:000000= 0000000000 > CS:=C2=A0 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f7a7ad7f4b0 CR3: 0000000564af4002 CR4: 00000000000206e0 > ------------[ cut here ]------------ Although the chance for double free is not zero, corruption can not be ruled out today yet because reports [1,2] in this thread caught no count underflow.=20 Want to know what this DF looks like with kasan enabled. Hillf CPU 1 CPU 2 ----- ----- put_ucounts=20 atomic_dec_and_lock_irqsave get_ucounts hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); put_ucounts=20 atomic_dec_and_lock_irqsave hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); kfree(ucounts); kfree(ucounts); [1] https://lore.kernel.org/linux-mm/CAOUHufaaPoTOCML+v8FomeWtN_PncmaHT9d= 6-XJG8RPzTcFZug@mail.gmail.com/ [2] https://lore.kernel.org/linux-mm/BCdQdQjRHZ9CJwIhmvKGfnFtMBJuatrZUX5I= n1gLlPswtrs4HwNONAbJleaeSfOOenMIdc_FPi0wwPIdW5Vodm4Aj-0iCqQY57288M5WFuY=3D= @protonmail.ch/