From: "Michal Koutný" <mkoutny@suse.com>
To: lkp <oliver.sang@intel.com>
Cc: Tejun Heo <tj@kernel.org>, 0day robot <lkp@intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
lkp@lists.01.org, torvalds@linuxfoundation.org,
ebiederm@xmission.com, axboe@kernel.dk, keescook@chromium.org,
oleg@redhat.com, peterz@infradead.org, tglx@linutronix.de,
jnewsome@torproject.org, legion@kernel.org, luto@amacapital.net,
jannh@google.com, security@kernel.org, kernel-team@fb.com
Subject: Re: [cgroup] 27183b4e07: WARNING:at_mm/slab.c:#___cache_free
Date: Thu, 16 Dec 2021 10:43:45 +0100 [thread overview]
Message-ID: <20211216094345.GA58142@blackbody.suse.cz> (raw)
In-Reply-To: <20211216092255.GB10708@xsang-OptiPlex-9020>
On Thu, Dec 16, 2021 at 05:22:55PM +0800, kernel test robot <oliver.sang@intel.com> wrote:
> commit: 27183b4e0735229f7ab300f000f78c9badf2a110 ("[PATCH 2/6] cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv")
> url: https://github.com/0day-ci/linux/commits/Tejun-Heo/cgroup-Use-open-time-credentials-for-process-migraton-perm-checks/20211214-041859
> base: https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git for-next
> patch link: https://lore.kernel.org/lkml/20211213191833.916632-3-tj@kernel.org
TL;DR This is the v2 patch and this situation is fixed in v3 [1].
FWIW, the full log reports a BUG later:
> [ 52.570729][ T1] BUG: unable to handle page fault for address: ffffffffffffffe0
> [ 52.571736][ T1] #PF: supervisor read access in kernel mode
> [ 52.572490][ T1] #PF: error_code(0x0000) - not-present page
> [ 52.573271][ T1] PGD 542b067 P4D 542b067 PUD 542d067 PMD 0
> [ 52.574056][ T1] Oops: 0000 [#1] PTI
> [ 52.574580][ T1] CPU: 0 PID: 1 Comm: systemd Tainted: G W 5.16.0-rc1-00009-g27183b4e0735 #1
> [ 52.575935][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
> [ 52.577101][ T1] RIP: 0010:cgroup_pidlist_find+0x67/0x100
> [ 52.577863][ T1] Code: 03 00 00 48 8d bb c0 03 00 00 48 8d 42 e0 48 39 d7 75 17 eb 37 48 8b 50 20 48 83 05 c2 d5 5a 06 01 48 8d 42 e0 48 39 d7 74 22 <44> 39 20 75 e6 48 83 05 9c d5 5a 06 01 4c 39 68 08 75 d8 5b 48 83
> [ 52.580455][ T1] RSP: 0018:ffff888100363ce0 EFLAGS: 00010286
> [ 52.581260][ T1] RAX: ffffffffffffffe0 RBX: ffff888123128800 RCX: 0000000000000003
> [ 52.582341][ T1] RDX: 0000000000000000 RSI: ffff888123128c38 RDI: ffff888123128bc0
> [ 52.583386][ T1] RBP: ffff888100363cf8 R08: 0000000000000000 R09: 0000000000000003
> [ 52.584416][ T1] R10: ffff888100363cf8 R11: ffff888123128c38 R12: 0000000000000000
> [ 52.585452][ T1] R13: ffffffff8554a980 R14: ffff888123128800 R15: ffff888123090800
> [ 52.586479][ T1] FS: 0000000000000000(0000) GS:ffffffff854fa000(0063) knlGS:00000000f784b6c0
> [ 52.587696][ T1] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
> [ 52.588521][ T1] CR2: ffffffffffffffe0 CR3: 0000000129f42000 CR4: 00000000000406b0
> [ 52.589543][ T1] Call Trace:
> [ 52.589972][ T1] <TASK>
> [ 52.590357][ T1] cgroup_pidlist_start+0x85/0x180
> [ 52.591035][ T1] cgroup_seqfile_start+0x29/0x40
> [ 52.591706][ T1] kernfs_seq_start+0x6e/0x100
> [ 52.592355][ T1] ? kvmalloc_node+0xd6/0x140
> [ 52.593068][ T1] seq_read_iter+0x13b/0x680
> [ 52.593627][ T1] ? up_read+0x36/0x50
> [ 52.594124][ T1] kernfs_fop_read_iter+0x4f/0x60
> [ 52.594783][ T1] new_sync_read+0x14e/0x240
> [ 52.595373][ T1] vfs_read+0x190/0x2c0
> [ 52.595925][ T1] ksys_read+0x70/0x150
> [ 52.596463][ T1] __ia32_sys_read+0x1b/0x30
> [ 52.597057][ T1] __do_fast_syscall_32+0x77/0x100
> [ 52.597711][ T1] do_fast_syscall_32+0x33/0x80
> [ 52.598310][ T1] do_SYSENTER_32+0x1f/0x30
> [ 52.598890][ T1] entry_SYSENTER_compat_after_hwframe+0x4d/0x5f
> [ 52.599777][ T1] RIP: 0023:0xf7fb7549
> [ 52.600308][ T1] Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
> [ 52.602731][ T1] RSP: 002b:00000000fff99188 EFLAGS: 00000206 ORIG_RAX: 0000000000000003
> [ 52.603796][ T1] RAX: ffffffffffffffda RBX: 0000000000000024 RCX: 00000000583ac988
> [ 52.604817][ T1] RDX: 0000000000001000 RSI: 00000000583f6e10 RDI: 00000000f7c48960
> [ 52.605833][ T1] RBP: 00000000fff991d8 R08: 0000000000000000 R09: 0000000000000000
> [ 52.606825][ T1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [ 52.607838][ T1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> [ 52.608839][ T1] </TASK>
> [ 52.609226][ T1] Modules linked in:
> [ 52.609731][ T1] CR2: ffffffffffffffe0
> [ 52.610242][ T1] ---[ end trace 08fad742e8d71fbb ]---
This looks very much like UAF via cgrp->pidlists which was the fixed.
Michal
[1] https://lore.kernel.org/r/Ybj0GqMfY4n2TSSn@slm.duckdns.org/
next prev parent reply other threads:[~2021-12-16 9:43 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-13 19:18 [PATCHSET v2 cgroup/for-5.16-fixes] cgroup: Use open-time creds and namespace for migration perm checks Tejun Heo
2021-12-13 19:18 ` [PATCH 1/6] cgroup: Use open-time credentials for process migraton " Tejun Heo
2021-12-14 17:03 ` Michal Koutný
2021-12-13 19:18 ` [PATCH 2/6] cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv Tejun Heo
2021-12-13 19:29 ` Linus Torvalds
2021-12-13 19:56 ` Tejun Heo
2021-12-14 17:03 ` Michal Koutný
2021-12-14 19:44 ` [PATCH v3 " Tejun Heo
2021-12-15 7:37 ` Michal Koutný
2021-12-16 9:22 ` [cgroup] 27183b4e07: WARNING:at_mm/slab.c:#___cache_free kernel test robot
2021-12-16 9:43 ` Michal Koutný [this message]
2021-12-13 19:18 ` [PATCH 3/6] cgroup: Use open-time cgroup namespace for process migration perm checks Tejun Heo
2021-12-14 17:04 ` Michal Koutný
2021-12-13 19:18 ` [PATCH 4/6] selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 Tejun Heo
2021-12-14 17:04 ` Michal Koutný
2021-12-13 19:18 ` [PATCH 5/6] selftests: cgroup: Test open-time credential usage for migration checks Tejun Heo
2021-12-14 17:04 ` Michal Koutný
2021-12-13 19:18 ` [PATCH 6/6] selftests: cgroup: Test open-time cgroup namespace " Tejun Heo
2021-12-14 17:04 ` Michal Koutný
2022-01-06 21:05 ` [PATCHSET v2 cgroup/for-5.16-fixes] cgroup: Use open-time creds and namespace for migration perm checks Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211216094345.GA58142@blackbody.suse.cz \
--to=mkoutny@suse.com \
--cc=axboe@kernel.dk \
--cc=ebiederm@xmission.com \
--cc=jannh@google.com \
--cc=jnewsome@torproject.org \
--cc=keescook@chromium.org \
--cc=kernel-team@fb.com \
--cc=legion@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=lkp@lists.01.org \
--cc=luto@amacapital.net \
--cc=oleg@redhat.com \
--cc=oliver.sang@intel.com \
--cc=peterz@infradead.org \
--cc=security@kernel.org \
--cc=tglx@linutronix.de \
--cc=tj@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=torvalds@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®