* [syzbot] WARNING: refcount bug in sys_memfd_secret
@ 2021-10-22 15:02 syzbot
2021-10-22 15:07 ` Dmitry Vyukov
` (3 more replies)
0 siblings, 4 replies; 15+ messages in thread
From: syzbot @ 2021-10-22 15:02 UTC (permalink / raw)
To: akpm, linux-kernel, linux-mm, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 2 PID: 32193 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Modules linked in:
CPU: 2 PID: 32193 Comm: syz-executor.0 Not tainted 5.15.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Code: 09 31 ff 89 de e8 f7 b9 9b fd 84 db 0f 85 36 ff ff ff e8 3a b2 9b fd 48 c7 c7 c0 65 e3 89 c6 05 6f 6c 7f 09 01 e8 7e 4a 19 05 <0f> 0b e9 17 ff ff ff e8 1b b2 9b fd 0f b6 1d 54 6c 7f 09 31 ff 89
RSP: 0018:ffffc90009f9ff10 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815dbf58 RDI: fffff520013f3fd4
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff815d5cce R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f476a1e7700(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32c24000 CR3: 00000000494c4000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
__do_sys_memfd_secret mm/secretmem.c:221 [inline]
__se_sys_memfd_secret mm/secretmem.c:194 [inline]
__x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f476cc71a39
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f476a1e7188 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
RAX: ffffffffffffffda RBX: 00007f476cd74f60 RCX: 00007f476cc71a39
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f476cccbe8f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc5b5eb85f R14: 00007f476a1e7300 R15: 0000000000022000
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:02 [syzbot] WARNING: refcount bug in sys_memfd_secret syzbot
@ 2021-10-22 15:07 ` Dmitry Vyukov
2021-10-22 16:25 ` Jordy Zomer
2021-10-23 15:27 ` Mike Rapoport
2021-10-23 12:02 ` syzbot
` (2 subsequent siblings)
3 siblings, 2 replies; 15+ messages in thread
From: Dmitry Vyukov @ 2021-10-22 15:07 UTC (permalink / raw)
To: syzbot, Jordy Zomer, Mike Rapoport
Cc: akpm, linux-kernel, linux-mm, syzkaller-bugs
On Fri, 22 Oct 2021 at 17:02, syzbot
<syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
> dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
+Mike, Jordy for secretmem.c
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 2 PID: 32193 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> Modules linked in:
> CPU: 2 PID: 32193 Comm: syz-executor.0 Not tainted 5.15.0-rc6-syzkaller #0
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
> RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> Code: 09 31 ff 89 de e8 f7 b9 9b fd 84 db 0f 85 36 ff ff ff e8 3a b2 9b fd 48 c7 c7 c0 65 e3 89 c6 05 6f 6c 7f 09 01 e8 7e 4a 19 05 <0f> 0b e9 17 ff ff ff e8 1b b2 9b fd 0f b6 1d 54 6c 7f 09 31 ff 89
> RSP: 0018:ffffc90009f9ff10 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 0000000000040000 RSI: ffffffff815dbf58 RDI: fffff520013f3fd4
> RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
> R10: ffffffff815d5cce R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS: 00007f476a1e7700(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001b32c24000 CR3: 00000000494c4000 CR4: 0000000000150ee0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> __refcount_add include/linux/refcount.h:199 [inline]
> __refcount_inc include/linux/refcount.h:250 [inline]
> refcount_inc include/linux/refcount.h:267 [inline]
> __do_sys_memfd_secret mm/secretmem.c:221 [inline]
> __se_sys_memfd_secret mm/secretmem.c:194 [inline]
> __x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f476cc71a39
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f476a1e7188 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
> RAX: ffffffffffffffda RBX: 00007f476cd74f60 RCX: 00007f476cc71a39
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 00007f476cccbe8f R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffc5b5eb85f R14: 00007f476a1e7300 R15: 0000000000022000
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000062d0fc05cef24c57%40google.com.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:07 ` Dmitry Vyukov
@ 2021-10-22 16:25 ` Jordy Zomer
2021-10-22 16:29 ` Dmitry Vyukov
2021-10-23 15:27 ` Mike Rapoport
1 sibling, 1 reply; 15+ messages in thread
From: Jordy Zomer @ 2021-10-22 16:25 UTC (permalink / raw)
To: Dmitry Vyukov, syzbot, Mike Rapoport
Cc: akpm, linux-kernel, linux-mm, syzkaller-bugs
After a quick scan, it appears to be a false-positive.
This because nothing appears to be being freed.
In any case, you probably don't want warnings everywhere.
I believe we should probably do something along the lines of:
if (refcount_read(&secretmem_users) == 0) {
refcount_set(&secretmem_users, 1);
} else {
refcount_inc(&secretmem_users);
}
Does this appear to be a feasible patch? :)
Best Regards,
Jordy
> On 10/22/2021 11:07 AM Dmitry Vyukov <dvyukov@google.com> wrote:
>
>
> On Fri, 22 Oct 2021 at 17:02, syzbot
> <syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
>
> +Mike, Jordy for secretmem.c
>
> > ------------[ cut here ]------------
> > refcount_t: addition on 0; use-after-free.
> > WARNING: CPU: 2 PID: 32193 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > Modules linked in:
> > CPU: 2 PID: 32193 Comm: syz-executor.0 Not tainted 5.15.0-rc6-syzkaller #0
> > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
> > RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > Code: 09 31 ff 89 de e8 f7 b9 9b fd 84 db 0f 85 36 ff ff ff e8 3a b2 9b fd 48 c7 c7 c0 65 e3 89 c6 05 6f 6c 7f 09 01 e8 7e 4a 19 05 <0f> 0b e9 17 ff ff ff e8 1b b2 9b fd 0f b6 1d 54 6c 7f 09 31 ff 89
> > RSP: 0018:ffffc90009f9ff10 EFLAGS: 00010286
> > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> > RDX: 0000000000040000 RSI: ffffffff815dbf58 RDI: fffff520013f3fd4
> > RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
> > R10: ffffffff815d5cce R11: 0000000000000000 R12: 0000000000000000
> > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> > FS: 00007f476a1e7700(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000001b32c24000 CR3: 00000000494c4000 CR4: 0000000000150ee0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> > __refcount_add include/linux/refcount.h:199 [inline]
> > __refcount_inc include/linux/refcount.h:250 [inline]
> > refcount_inc include/linux/refcount.h:267 [inline]
> > __do_sys_memfd_secret mm/secretmem.c:221 [inline]
> > __se_sys_memfd_secret mm/secretmem.c:194 [inline]
> > __x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
> > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> > entry_SYSCALL_64_after_hwframe+0x44/0xae
> > RIP: 0033:0x7f476cc71a39
> > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007f476a1e7188 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
> > RAX: ffffffffffffffda RBX: 00007f476cd74f60 RCX: 00007f476cc71a39
> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> > RBP: 00007f476cccbe8f R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > R13: 00007ffc5b5eb85f R14: 00007f476a1e7300 R15: 0000000000022000
> >
> >
> > ---
> > This report is generated by a bot. It may contain errors.
> > See https://goo.gl/tpsmEJ for more information about syzbot.
> > syzbot engineers can be reached at syzkaller@googlegroups.com.
> >
> > syzbot will keep track of this issue. See:
> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> >
> > --
> > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000062d0fc05cef24c57%40google.com.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 16:25 ` Jordy Zomer
@ 2021-10-22 16:29 ` Dmitry Vyukov
2021-10-22 16:39 ` Jordy Zomer
0 siblings, 1 reply; 15+ messages in thread
From: Dmitry Vyukov @ 2021-10-22 16:29 UTC (permalink / raw)
To: Jordy Zomer
Cc: syzbot, Mike Rapoport, akpm, linux-kernel, linux-mm, syzkaller-bugs
On Fri, 22 Oct 2021 at 18:25, Jordy Zomer <jordy@pwning.systems> wrote:
>
> After a quick scan, it appears to be a false-positive.
>
> This because nothing appears to be being freed.
>
> In any case, you probably don't want warnings everywhere.
>
> I believe we should probably do something along the lines of:
>
> if (refcount_read(&secretmem_users) == 0) {
> refcount_set(&secretmem_users, 1);
> } else {
> refcount_inc(&secretmem_users);
> }
>
> Does this appear to be a feasible patch? :)
I don't think multithreading work this way :)
Imagine 2 threads reading refcount_read(&secretmem_users) == 0 and
then both doing refcount_set(&secretmem_users, 1).
> Best Regards,
>
> Jordy
>
> > On 10/22/2021 11:07 AM Dmitry Vyukov <dvyukov@google.com> wrote:
> >
> >
> > On Fri, 22 Oct 2021 at 17:02, syzbot
> > <syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
> > >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
> > > git tree: upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
> > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > >
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
> >
> > +Mike, Jordy for secretmem.c
> >
> > > ------------[ cut here ]------------
> > > refcount_t: addition on 0; use-after-free.
> > > WARNING: CPU: 2 PID: 32193 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > > Modules linked in:
> > > CPU: 2 PID: 32193 Comm: syz-executor.0 Not tainted 5.15.0-rc6-syzkaller #0
> > > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
> > > RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > > Code: 09 31 ff 89 de e8 f7 b9 9b fd 84 db 0f 85 36 ff ff ff e8 3a b2 9b fd 48 c7 c7 c0 65 e3 89 c6 05 6f 6c 7f 09 01 e8 7e 4a 19 05 <0f> 0b e9 17 ff ff ff e8 1b b2 9b fd 0f b6 1d 54 6c 7f 09 31 ff 89
> > > RSP: 0018:ffffc90009f9ff10 EFLAGS: 00010286
> > > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> > > RDX: 0000000000040000 RSI: ffffffff815dbf58 RDI: fffff520013f3fd4
> > > RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
> > > R10: ffffffff815d5cce R11: 0000000000000000 R12: 0000000000000000
> > > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> > > FS: 00007f476a1e7700(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
> > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > CR2: 0000001b32c24000 CR3: 00000000494c4000 CR4: 0000000000150ee0
> > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > > Call Trace:
> > > __refcount_add include/linux/refcount.h:199 [inline]
> > > __refcount_inc include/linux/refcount.h:250 [inline]
> > > refcount_inc include/linux/refcount.h:267 [inline]
> > > __do_sys_memfd_secret mm/secretmem.c:221 [inline]
> > > __se_sys_memfd_secret mm/secretmem.c:194 [inline]
> > > __x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
> > > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> > > entry_SYSCALL_64_after_hwframe+0x44/0xae
> > > RIP: 0033:0x7f476cc71a39
> > > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> > > RSP: 002b:00007f476a1e7188 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
> > > RAX: ffffffffffffffda RBX: 00007f476cd74f60 RCX: 00007f476cc71a39
> > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> > > RBP: 00007f476cccbe8f R08: 0000000000000000 R09: 0000000000000000
> > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > R13: 00007ffc5b5eb85f R14: 00007f476a1e7300 R15: 0000000000022000
> > >
> > >
> > > ---
> > > This report is generated by a bot. It may contain errors.
> > > See https://goo.gl/tpsmEJ for more information about syzbot.
> > > syzbot engineers can be reached at syzkaller@googlegroups.com.
> > >
> > > syzbot will keep track of this issue. See:
> > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000062d0fc05cef24c57%40google.com.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 16:29 ` Dmitry Vyukov
@ 2021-10-22 16:39 ` Jordy Zomer
0 siblings, 0 replies; 15+ messages in thread
From: Jordy Zomer @ 2021-10-22 16:39 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, Mike Rapoport, akpm, linux-kernel, linux-mm, syzkaller-bugs
Good point, it appears that we'll have to implement some locking at this stage as well.
Best Regards,
Jordy
> On 10/22/2021 12:29 PM Dmitry Vyukov <dvyukov@google.com> wrote:
>
>
> On Fri, 22 Oct 2021 at 18:25, Jordy Zomer <jordy@pwning.systems> wrote:
> >
> > After a quick scan, it appears to be a false-positive.
> >
> > This because nothing appears to be being freed.
> >
> > In any case, you probably don't want warnings everywhere.
> >
> > I believe we should probably do something along the lines of:
> >
> > if (refcount_read(&secretmem_users) == 0) {
> > refcount_set(&secretmem_users, 1);
> > } else {
> > refcount_inc(&secretmem_users);
> > }
> >
> > Does this appear to be a feasible patch? :)
>
> I don't think multithreading work this way :)
> Imagine 2 threads reading refcount_read(&secretmem_users) == 0 and
> then both doing refcount_set(&secretmem_users, 1).
>
> > Best Regards,
> >
> > Jordy
> >
> > > On 10/22/2021 11:07 AM Dmitry Vyukov <dvyukov@google.com> wrote:
> > >
> > >
> > > On Fri, 22 Oct 2021 at 17:02, syzbot
> > > <syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
> > > >
> > > > Hello,
> > > >
> > > > syzbot found the following issue on:
> > > >
> > > > HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
> > > > git tree: upstream
> > > > console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
> > > > kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
> > > > dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
> > > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > > >
> > > > Unfortunately, I don't have any reproducer for this issue yet.
> > > >
> > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
> > >
> > > +Mike, Jordy for secretmem.c
> > >
> > > > ------------[ cut here ]------------
> > > > refcount_t: addition on 0; use-after-free.
> > > > WARNING: CPU: 2 PID: 32193 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > > > Modules linked in:
> > > > CPU: 2 PID: 32193 Comm: syz-executor.0 Not tainted 5.15.0-rc6-syzkaller #0
> > > > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
> > > > RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
> > > > Code: 09 31 ff 89 de e8 f7 b9 9b fd 84 db 0f 85 36 ff ff ff e8 3a b2 9b fd 48 c7 c7 c0 65 e3 89 c6 05 6f 6c 7f 09 01 e8 7e 4a 19 05 <0f> 0b e9 17 ff ff ff e8 1b b2 9b fd 0f b6 1d 54 6c 7f 09 31 ff 89
> > > > RSP: 0018:ffffc90009f9ff10 EFLAGS: 00010286
> > > > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> > > > RDX: 0000000000040000 RSI: ffffffff815dbf58 RDI: fffff520013f3fd4
> > > > RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000001
> > > > R10: ffffffff815d5cce R11: 0000000000000000 R12: 0000000000000000
> > > > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> > > > FS: 00007f476a1e7700(0000) GS:ffff88802cd00000(0000) knlGS:0000000000000000
> > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > CR2: 0000001b32c24000 CR3: 00000000494c4000 CR4: 0000000000150ee0
> > > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > > > Call Trace:
> > > > __refcount_add include/linux/refcount.h:199 [inline]
> > > > __refcount_inc include/linux/refcount.h:250 [inline]
> > > > refcount_inc include/linux/refcount.h:267 [inline]
> > > > __do_sys_memfd_secret mm/secretmem.c:221 [inline]
> > > > __se_sys_memfd_secret mm/secretmem.c:194 [inline]
> > > > __x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
> > > > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > > > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> > > > entry_SYSCALL_64_after_hwframe+0x44/0xae
> > > > RIP: 0033:0x7f476cc71a39
> > > > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> > > > RSP: 002b:00007f476a1e7188 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
> > > > RAX: ffffffffffffffda RBX: 00007f476cd74f60 RCX: 00007f476cc71a39
> > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> > > > RBP: 00007f476cccbe8f R08: 0000000000000000 R09: 0000000000000000
> > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > > R13: 00007ffc5b5eb85f R14: 00007f476a1e7300 R15: 0000000000022000
> > > >
> > > >
> > > > ---
> > > > This report is generated by a bot. It may contain errors.
> > > > See https://goo.gl/tpsmEJ for more information about syzbot.
> > > > syzbot engineers can be reached at syzkaller@googlegroups.com.
> > > >
> > > > syzbot will keep track of this issue. See:
> > > > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > > > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000062d0fc05cef24c57%40google.com.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:02 [syzbot] WARNING: refcount bug in sys_memfd_secret syzbot
2021-10-22 15:07 ` Dmitry Vyukov
@ 2021-10-23 12:02 ` syzbot
2021-10-23 22:31 ` syzbot
2021-11-24 13:47 ` syzbot
3 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2021-10-23 12:02 UTC (permalink / raw)
To: akpm, dvyukov, jordy, linux-kernel, linux-mm, rppt, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: cf6c9d12750c Add linux-next specific files for 20211022
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10bdd272b00000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd1cd3d631599df5
dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12790a72b00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13eb76dcb00000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 6528 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Modules linked in:
CPU: 1 PID: 6528 Comm: syz-executor149 Not tainted 5.15.0-rc6-next-20211022-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Code: 09 31 ff 89 de e8 27 1f 9f fd 84 db 0f 85 36 ff ff ff e8 3a 1b 9f fd 48 c7 c7 00 2e 04 8a c6 05 c7 25 a3 09 01 e8 92 ce 31 05 <0f> 0b e9 17 ff ff ff e8 1b 1b 9f fd 0f b6 1d ac 25 a3 09 31 ff 89
RSP: 0018:ffffc90001a4ff10 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801d369d40 RSI: ffffffff815f06f8 RDI: fffff52000349fd4
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815ea4ce R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00005555565e9300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f842b6f56c0 CR3: 000000001bc33000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
__do_sys_memfd_secret mm/secretmem.c:221 [inline]
__se_sys_memfd_secret mm/secretmem.c:194 [inline]
__x64_sys_memfd_secret+0x182/0x1e0 mm/secretmem.c:194
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbeb6a4cf89
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffde5076be8 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbeb6a4cf89
RDX: 00007fbeb6a0fe93 RSI: 0000000000000012 RDI: 0000000000080000
RBP: 00007fbeb6a10f70 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fbeb6a11000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:07 ` Dmitry Vyukov
2021-10-22 16:25 ` Jordy Zomer
@ 2021-10-23 15:27 ` Mike Rapoport
2021-10-23 17:03 ` Kees Cook
1 sibling, 1 reply; 15+ messages in thread
From: Mike Rapoport @ 2021-10-23 15:27 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: syzbot, Jordy Zomer, akpm, linux-kernel, linux-mm,
syzkaller-bugs, Kees Cook
On Fri, Oct 22, 2021 at 05:07:40PM +0200, Dmitry Vyukov wrote:
> On Fri, 22 Oct 2021 at 17:02, syzbot
> <syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
>
> +Mike, Jordy for secretmem.c
I was actually the first to report it ;-)
https://lore.kernel.org/all/YXJjuWyY0h+Qaj5U@kernel.org/
and my first reaction was to send a revert the untested commit 110860541f44
("mm/secretmem: use refcount_t instead of atomic_t").
Anyway, this should fix it:
From c22a588fab3a0762f0a8c0dbab99343c48b3e27b Mon Sep 17 00:00:00 2001
From: Mike Rapoport <rppt@linux.ibm.com>
Date: Sat, 23 Oct 2021 18:13:16 +0300
Subject: [PATCH] secretmem: bump initial refcount to fix refcount woes
Commit 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t")
replaced atomic_t with refcount_t but it dind't take into account that
unlike atomic_inc(), refcount_inc() presumes that "the caller already has a
reference on the object". With that, using 0 as initial count caused
warnings in the refcount code:
[ 20.957833] ------------[ cut here ]------------
[ 20.957844] refcount_t: addition on 0; use-after-free.
[ 20.957897] WARNING: CPU: 3 PID: 598 at /home/rppt/git/linux/lib/refcount.c:25 refcount_warn_saturate+0xcf/0xf0
[ 20.957919] Modules linked in:
[ 20.957930] CPU: 3 PID: 598 Comm: secretmemfd Not tainted 5.15.0-rc6+ #432
[ 20.957944] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 20.957948] RIP: 0010:refcount_warn_saturate+0xcf/0xf0
[ 20.957957] Code: 01 01 e8 d4 db c3 ff 0f 0b c3 80 3d 39 32 43 01 00 0f 85 6b ff ff ff 48 c7 c7 00 bc c5 af c6 05 25 32 43 01 01 e8 b1 db c3 ff <0f> 0b c3 48 c7 c7 b0 bb c5 af c6 05 10 32 43 01 01 e8 9b db c3 ff
[ 20.957962] RSP: 0018:ffffb188c0583f20 EFLAGS: 00010282
[ 20.957967] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000027
[ 20.957971] RDX: 0000000000000000 RSI: ffff8bfefbb975b0 RDI: ffff8bfefbb975b8
[ 20.957974] RBP: ffffb188c0583f48 R08: 0000000000000000 R09: 0000000000000001
[ 20.957977] R10: 0000000000000003 R11: ffffb188c0583d38 R12: 0000000000000000
[ 20.957980] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 20.957983] FS: 00007f9467b9c740(0000) GS:ffff8bfefbb80000(0000) knlGS:0000000000000000
[ 20.957993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 20.957997] CR2: 00007ffe83be8084 CR3: 00000001100cc003 CR4: 0000000000060ee0
[ 20.958001] Call Trace:
[ 20.959285] __x64_sys_memfd_secret+0xa9/0xc0
[ 20.959308] do_syscall_64+0x3a/0x80
[ 20.959331] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 20.959352] RIP: 0033:0x7f9467cba89d
[ 20.959358] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48
[ 20.959362] RSP: 002b:00007ffe83bb8148 EFLAGS: 00000206 ORIG_RAX: 00000000000001bf
[ 20.959368] RAX: ffffffffffffffda RBX: 0000561f62400d50 RCX: 00007f9467cba89d
[ 20.959372] RDX: 0000000000000e11 RSI: 0000000000008000 RDI: 0000000000000000
[ 20.959375] RBP: 00007ffe83bb8160 R08: 000000002c06910a R09: 0000000000000000
[ 20.959378] R10: 00007f9467d8a1c4 R11: 0000000000000206 R12: 0000561f624008d0
[ 20.959381] R13: 00007ffe83bb82b0 R14: 0000000000000000 R15: 0000000000000000
[ 20.959386] ---[ end trace 9368244c7159e4de ]---
[ 20.960666] ------------[ cut here ]------------
[ 20.960675] refcount_t: decrement hit 0; leaking memory.
[ 20.960717] WARNING: CPU: 1 PID: 598 at /home/rppt/git/linux/lib/refcount.c:31 refcount_warn_saturate+0x4f/0xf0
[ 20.960737] Modules linked in:
[ 20.960742] CPU: 1 PID: 598 Comm: secretmemfd Tainted: G W 5.15.0-rc6+ #432
[ 20.960748] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 20.960751] RIP: 0010:refcount_warn_saturate+0x4f/0xf0
[ 20.960759] Code: 00 00 f3 c3 83 fe 03 74 43 83 fe 04 75 1f 80 3d b3 32 43 01 00 75 eb 48 c7 c7 58 bc c5 af c6 05 a3 32 43 01 01 e8 31 dc c3 ff <0f> 0b c3 80 3d 93 32 43 01 00 75 cc 48 c7 c7 88 bc c5 af c6 05 83
[ 20.960764] RSP: 0018:ffffb188c0583e40 EFLAGS: 00010286
[ 20.960769] RAX: 0000000000000000 RBX: ffff8bfec1f51900 RCX: 0000000000000027
[ 20.960772] RDX: 0000000000000000 RSI: ffff8bfefba975b0 RDI: ffff8bfefba975b8
[ 20.960775] RBP: 0000000000080003 R08: 0000000000000000 R09: 0000000000000001
[ 20.960778] R10: ffff8bfec439da80 R11: ffffb188c0583c58 R12: ffff8bfec4e576a0
[ 20.960781] R13: ffff8bfec01a8ca0 R14: ffff8bfecd314300 R15: 0000000000000000
[ 20.960784] FS: 0000000000000000(0000) GS:ffff8bfefba80000(0000) knlGS:0000000000000000
[ 20.960835] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 20.960840] CR2: 00007f9467c85290 CR3: 0000000080a0c004 CR4: 0000000000060ee0
[ 20.960843] Call Trace:
[ 20.960849] secretmem_release+0x26/0x30
[ 20.960862] __fput+0x85/0x240
[ 20.960868] task_work_run+0x67/0xa0
[ 20.960890] do_exit+0x363/0xbb0
[ 20.960902] do_group_exit+0x35/0x90
[ 20.960908] __x64_sys_exit_group+0xf/0x10
[ 20.960913] do_syscall_64+0x3a/0x80
[ 20.960922] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 20.960928] RIP: 0033:0x7f9467c852c6
[ 20.960933] Code: Unable to access opcode bytes at RIP 0x7f9467c8529c.
[ 20.960936] RSP: 002b:00007ffe83bb8168 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 20.960941] RAX: ffffffffffffffda RBX: 00007f9467d8c610 RCX: 00007f9467c852c6
[ 20.960944] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 20.960947] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80
[ 20.960950] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f9467d8c610
[ 20.960953] R13: 0000000000000001 R14: 00007f9467d8ffc8 R15: 0000000000000000
[ 20.960957] ---[ end trace 9368244c7159e4df ]---
Bump the initial reference count value to 1 to fix this.
Fixes: 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t")
Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
---
mm/secretmem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/secretmem.c b/mm/secretmem.c
index 1fea68b8d5a6..06fd6407ed03 100644
--- a/mm/secretmem.c
+++ b/mm/secretmem.c
@@ -41,11 +41,11 @@ module_param_named(enable, secretmem_enable, bool, 0400);
MODULE_PARM_DESC(secretmem_enable,
"Enable secretmem and memfd_secret(2) system call");
-static refcount_t secretmem_users;
+static refcount_t secretmem_users = REFCOUNT_INIT(1);
bool secretmem_active(void)
{
- return !!refcount_read(&secretmem_users);
+ return refcount_read(&secretmem_users) > 1;
}
static vm_fault_t secretmem_fault(struct vm_fault *vmf)
--
2.28.0
--
Sincerely yours,
Mike.
^ permalink raw reply related [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-23 15:27 ` Mike Rapoport
@ 2021-10-23 17:03 ` Kees Cook
2021-10-23 22:46 ` Matthew Wilcox
0 siblings, 1 reply; 15+ messages in thread
From: Kees Cook @ 2021-10-23 17:03 UTC (permalink / raw)
To: Mike Rapoport, Dmitry Vyukov
Cc: syzbot, Jordy Zomer, akpm, linux-kernel, linux-mm, syzkaller-bugs
On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
>On Fri, Oct 22, 2021 at 05:07:40PM +0200, Dmitry Vyukov wrote:
>> On Fri, 22 Oct 2021 at 17:02, syzbot
>> <syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com> wrote:
>> >
>> > Hello,
>> >
>> > syzbot found the following issue on:
>> >
>> > HEAD commit: 64222515138e Merge tag 'drm-fixes-2021-10-22' of git://ano..
>> > git tree: upstream
>> > console output: https://syzkaller.appspot.com/x/log.txt?x=178e86c4b00000
>> > kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
>> > dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
>> > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> >
>> > Unfortunately, I don't have any reproducer for this issue yet.
>> >
>> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> > Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
>>
>> +Mike, Jordy for secretmem.c
>
>I was actually the first to report it ;-)
>
>https://lore.kernel.org/all/YXJjuWyY0h+Qaj5U@kernel.org/
>
>and my first reaction was to send a revert the untested commit 110860541f44
>("mm/secretmem: use refcount_t instead of atomic_t").
>
>Anyway, this should fix it:
>
>From c22a588fab3a0762f0a8c0dbab99343c48b3e27b Mon Sep 17 00:00:00 2001
>From: Mike Rapoport <rppt@linux.ibm.com>
>Date: Sat, 23 Oct 2021 18:13:16 +0300
>Subject: [PATCH] secretmem: bump initial refcount to fix refcount woes
>
>Commit 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t")
>replaced atomic_t with refcount_t but it dind't take into account that
>unlike atomic_inc(), refcount_inc() presumes that "the caller already has a
>reference on the object". With that, using 0 as initial count caused
>warnings in the refcount code:
>
>[ 20.957833] ------------[ cut here ]------------
>[ 20.957844] refcount_t: addition on 0; use-after-free.
>[ 20.957897] WARNING: CPU: 3 PID: 598 at /home/rppt/git/linux/lib/refcount.c:25 refcount_warn_saturate+0xcf/0xf0
>[ 20.957919] Modules linked in:
>[ 20.957930] CPU: 3 PID: 598 Comm: secretmemfd Not tainted 5.15.0-rc6+ #432
>[ 20.957944] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
>[ 20.957948] RIP: 0010:refcount_warn_saturate+0xcf/0xf0
>[ 20.957957] Code: 01 01 e8 d4 db c3 ff 0f 0b c3 80 3d 39 32 43 01 00 0f 85 6b ff ff ff 48 c7 c7 00 bc c5 af c6 05 25 32 43 01 01 e8 b1 db c3 ff <0f> 0b c3 48 c7 c7 b0 bb c5 af c6 05 10 32 43 01 01 e8 9b db c3 ff
>[ 20.957962] RSP: 0018:ffffb188c0583f20 EFLAGS: 00010282
>[ 20.957967] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000027
>[ 20.957971] RDX: 0000000000000000 RSI: ffff8bfefbb975b0 RDI: ffff8bfefbb975b8
>[ 20.957974] RBP: ffffb188c0583f48 R08: 0000000000000000 R09: 0000000000000001
>[ 20.957977] R10: 0000000000000003 R11: ffffb188c0583d38 R12: 0000000000000000
>[ 20.957980] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
>[ 20.957983] FS: 00007f9467b9c740(0000) GS:ffff8bfefbb80000(0000) knlGS:0000000000000000
>[ 20.957993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[ 20.957997] CR2: 00007ffe83be8084 CR3: 00000001100cc003 CR4: 0000000000060ee0
>[ 20.958001] Call Trace:
>[ 20.959285] __x64_sys_memfd_secret+0xa9/0xc0
>[ 20.959308] do_syscall_64+0x3a/0x80
>[ 20.959331] entry_SYSCALL_64_after_hwframe+0x44/0xae
>[ 20.959352] RIP: 0033:0x7f9467cba89d
>[ 20.959358] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48
>[ 20.959362] RSP: 002b:00007ffe83bb8148 EFLAGS: 00000206 ORIG_RAX: 00000000000001bf
>[ 20.959368] RAX: ffffffffffffffda RBX: 0000561f62400d50 RCX: 00007f9467cba89d
>[ 20.959372] RDX: 0000000000000e11 RSI: 0000000000008000 RDI: 0000000000000000
>[ 20.959375] RBP: 00007ffe83bb8160 R08: 000000002c06910a R09: 0000000000000000
>[ 20.959378] R10: 00007f9467d8a1c4 R11: 0000000000000206 R12: 0000561f624008d0
>[ 20.959381] R13: 00007ffe83bb82b0 R14: 0000000000000000 R15: 0000000000000000
>[ 20.959386] ---[ end trace 9368244c7159e4de ]---
>[ 20.960666] ------------[ cut here ]------------
>[ 20.960675] refcount_t: decrement hit 0; leaking memory.
>[ 20.960717] WARNING: CPU: 1 PID: 598 at /home/rppt/git/linux/lib/refcount.c:31 refcount_warn_saturate+0x4f/0xf0
>[ 20.960737] Modules linked in:
>[ 20.960742] CPU: 1 PID: 598 Comm: secretmemfd Tainted: G W 5.15.0-rc6+ #432
>[ 20.960748] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
>[ 20.960751] RIP: 0010:refcount_warn_saturate+0x4f/0xf0
>[ 20.960759] Code: 00 00 f3 c3 83 fe 03 74 43 83 fe 04 75 1f 80 3d b3 32 43 01 00 75 eb 48 c7 c7 58 bc c5 af c6 05 a3 32 43 01 01 e8 31 dc c3 ff <0f> 0b c3 80 3d 93 32 43 01 00 75 cc 48 c7 c7 88 bc c5 af c6 05 83
>[ 20.960764] RSP: 0018:ffffb188c0583e40 EFLAGS: 00010286
>[ 20.960769] RAX: 0000000000000000 RBX: ffff8bfec1f51900 RCX: 0000000000000027
>[ 20.960772] RDX: 0000000000000000 RSI: ffff8bfefba975b0 RDI: ffff8bfefba975b8
>[ 20.960775] RBP: 0000000000080003 R08: 0000000000000000 R09: 0000000000000001
>[ 20.960778] R10: ffff8bfec439da80 R11: ffffb188c0583c58 R12: ffff8bfec4e576a0
>[ 20.960781] R13: ffff8bfec01a8ca0 R14: ffff8bfecd314300 R15: 0000000000000000
>[ 20.960784] FS: 0000000000000000(0000) GS:ffff8bfefba80000(0000) knlGS:0000000000000000
>[ 20.960835] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[ 20.960840] CR2: 00007f9467c85290 CR3: 0000000080a0c004 CR4: 0000000000060ee0
>[ 20.960843] Call Trace:
>[ 20.960849] secretmem_release+0x26/0x30
>[ 20.960862] __fput+0x85/0x240
>[ 20.960868] task_work_run+0x67/0xa0
>[ 20.960890] do_exit+0x363/0xbb0
>[ 20.960902] do_group_exit+0x35/0x90
>[ 20.960908] __x64_sys_exit_group+0xf/0x10
>[ 20.960913] do_syscall_64+0x3a/0x80
>[ 20.960922] entry_SYSCALL_64_after_hwframe+0x44/0xae
>[ 20.960928] RIP: 0033:0x7f9467c852c6
>[ 20.960933] Code: Unable to access opcode bytes at RIP 0x7f9467c8529c.
>[ 20.960936] RSP: 002b:00007ffe83bb8168 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
>[ 20.960941] RAX: ffffffffffffffda RBX: 00007f9467d8c610 RCX: 00007f9467c852c6
>[ 20.960944] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
>[ 20.960947] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80
>[ 20.960950] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f9467d8c610
>[ 20.960953] R13: 0000000000000001 R14: 00007f9467d8ffc8 R15: 0000000000000000
>[ 20.960957] ---[ end trace 9368244c7159e4df ]---
>
>Bump the initial reference count value to 1 to fix this.
>
>Fixes: 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t")
>Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
>Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Excellent, thanks!
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
>---
> mm/secretmem.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/mm/secretmem.c b/mm/secretmem.c
>index 1fea68b8d5a6..06fd6407ed03 100644
>--- a/mm/secretmem.c
>+++ b/mm/secretmem.c
>@@ -41,11 +41,11 @@ module_param_named(enable, secretmem_enable, bool, 0400);
> MODULE_PARM_DESC(secretmem_enable,
> "Enable secretmem and memfd_secret(2) system call");
>
>-static refcount_t secretmem_users;
>+static refcount_t secretmem_users = REFCOUNT_INIT(1);
>
> bool secretmem_active(void)
> {
>- return !!refcount_read(&secretmem_users);
>+ return refcount_read(&secretmem_users) > 1;
> }
>
> static vm_fault_t secretmem_fault(struct vm_fault *vmf)
--
Kees Cook
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:02 [syzbot] WARNING: refcount bug in sys_memfd_secret syzbot
2021-10-22 15:07 ` Dmitry Vyukov
2021-10-23 12:02 ` syzbot
@ 2021-10-23 22:31 ` syzbot
2021-11-24 13:47 ` syzbot
3 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2021-10-23 22:31 UTC (permalink / raw)
To: akpm, dvyukov, fmdefrancesco, jordy, jordy, keescook,
linux-kernel, linux-mm, rppt, syzkaller-bugs, torvalds
syzbot has bisected this issue to:
commit 110860541f443f950c1274f217a1a3e298670a33
Author: Jordy Zomer <jordy@jordyzomer.github.io>
Date: Wed Sep 8 02:56:18 2021 +0000
mm/secretmem: use refcount_t instead of atomic_t
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=141a071cb00000
start commit: 9c0c4d24ac00 Merge tag 'block-5.15-2021-10-22' of git://gi..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=161a071cb00000
console output: https://syzkaller.appspot.com/x/log.txt?x=121a071cb00000
kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=130cabdcb00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=175b91acb00000
Reported-by: syzbot+b904a1de3ec43711eba5@syzkaller.appspotmail.com
Fixes: 110860541f44 ("mm/secretmem: use refcount_t instead of atomic_t")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-23 17:03 ` Kees Cook
@ 2021-10-23 22:46 ` Matthew Wilcox
2021-10-24 5:37 ` Mike Rapoport
0 siblings, 1 reply; 15+ messages in thread
From: Matthew Wilcox @ 2021-10-23 22:46 UTC (permalink / raw)
To: Kees Cook
Cc: Mike Rapoport, Dmitry Vyukov, syzbot, Jordy Zomer, akpm,
linux-kernel, linux-mm, syzkaller-bugs
On Sat, Oct 23, 2021 at 10:03:11AM -0700, Kees Cook wrote:
> On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
> >and my first reaction was to send a revert the untested commit 110860541f44
> >("mm/secretmem: use refcount_t instead of atomic_t").
I think you should. This isn't a real problem. And it abuses the
refcount_t interface. Your hack is clever, but it's fundamentally
wrong.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-23 22:46 ` Matthew Wilcox
@ 2021-10-24 5:37 ` Mike Rapoport
2021-10-24 7:07 ` Dmitry Vyukov
2021-10-24 10:57 ` Matthew Wilcox
0 siblings, 2 replies; 15+ messages in thread
From: Mike Rapoport @ 2021-10-24 5:37 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Kees Cook, Dmitry Vyukov, syzbot, Jordy Zomer, akpm,
linux-kernel, linux-mm, syzkaller-bugs
On Sat, Oct 23, 2021 at 11:46:18PM +0100, Matthew Wilcox wrote:
> On Sat, Oct 23, 2021 at 10:03:11AM -0700, Kees Cook wrote:
> > On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
> > >and my first reaction was to send a revert the untested commit 110860541f44
> > >("mm/secretmem: use refcount_t instead of atomic_t").
>
> I think you should. This isn't a real problem.
Do you mean that creation of 4 billion of file descriptors is not feasible?
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-24 5:37 ` Mike Rapoport
@ 2021-10-24 7:07 ` Dmitry Vyukov
2021-10-24 10:57 ` Matthew Wilcox
1 sibling, 0 replies; 15+ messages in thread
From: Dmitry Vyukov @ 2021-10-24 7:07 UTC (permalink / raw)
To: Mike Rapoport
Cc: Matthew Wilcox, Kees Cook, syzbot, Jordy Zomer, akpm,
linux-kernel, linux-mm, syzkaller-bugs
On Sun, 24 Oct 2021 at 07:38, Mike Rapoport <rppt@kernel.org> wrote:
>
> On Sat, Oct 23, 2021 at 11:46:18PM +0100, Matthew Wilcox wrote:
> > On Sat, Oct 23, 2021 at 10:03:11AM -0700, Kees Cook wrote:
> > > On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
> > > >and my first reaction was to send a revert the untested commit 110860541f44
> > > >("mm/secretmem: use refcount_t instead of atomic_t").
> >
> > I think you should. This isn't a real problem.
>
> Do you mean that creation of 4 billion of file descriptors is not feasible?
FWIW I think refcount is at least capable of catching the issue I
described with the counter temporarily going below its true value.
With refcount it can be caught during fuzzing as refcount reaching 0
and then being incremented again. Basically this warning, but a true
positive.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-24 5:37 ` Mike Rapoport
2021-10-24 7:07 ` Dmitry Vyukov
@ 2021-10-24 10:57 ` Matthew Wilcox
2021-10-24 15:31 ` Mike Rapoport
1 sibling, 1 reply; 15+ messages in thread
From: Matthew Wilcox @ 2021-10-24 10:57 UTC (permalink / raw)
To: Mike Rapoport
Cc: Kees Cook, Dmitry Vyukov, syzbot, Jordy Zomer, akpm,
linux-kernel, linux-mm, syzkaller-bugs
On Sun, Oct 24, 2021 at 08:37:59AM +0300, Mike Rapoport wrote:
> On Sat, Oct 23, 2021 at 11:46:18PM +0100, Matthew Wilcox wrote:
> > On Sat, Oct 23, 2021 at 10:03:11AM -0700, Kees Cook wrote:
> > > On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
> > > >and my first reaction was to send a revert the untested commit 110860541f44
> > > >("mm/secretmem: use refcount_t instead of atomic_t").
> >
> > I think you should. This isn't a real problem.
>
> Do you mean that creation of 4 billion of file descriptors is not feasible?
On a sufficiently large machine, it is. But then we have the same
problem with other atomic_t. If you really care, just check whether
secretmem_users has gone negative, and return -ENFILE. It doesn't
even have to be all that exact; you've got 2 billion values of slop
to use before you hit the wrap from negative to 0 which is the actual
problem.
ie this:
+++ b/mm/secretmem.c
@@ -203,6 +203,8 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC))
return -EINVAL;
+ if (atomic_read(&secretmem_users) < 0)
+ return -ENFILE;
fd = get_unused_fd_flags(flags & O_CLOEXEC);
if (fd < 0)
Also, why does secretmem depend on !EMBEDDED?
config EMBEDDED
bool "Embedded system"
select EXPERT
help
This option should be enabled if compiling the kernel for
an embedded system so certain expert options are available
for configuration.
This is the only Kconfig option that depends on !EMBEDDED. It's usually
used to avoid showing questions. It means that my allmodconfig build
*doesn't* build secretmem, which is surely not what you wanted.
+++ b/mm/Kconfig
@@ -892,7 +892,7 @@ config IO_MAPPING
bool
config SECRETMEM
- def_bool ARCH_HAS_SET_DIRECT_MAP && !EMBEDDED
+ def_bool ARCH_HAS_SET_DIRECT_MAP
source "mm/damon/Kconfig"
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-24 10:57 ` Matthew Wilcox
@ 2021-10-24 15:31 ` Mike Rapoport
0 siblings, 0 replies; 15+ messages in thread
From: Mike Rapoport @ 2021-10-24 15:31 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Kees Cook, Dmitry Vyukov, syzbot, Jordy Zomer, akpm,
linux-kernel, linux-mm, syzkaller-bugs
On Sun, Oct 24, 2021 at 11:57:02AM +0100, Matthew Wilcox wrote:
> On Sun, Oct 24, 2021 at 08:37:59AM +0300, Mike Rapoport wrote:
> > On Sat, Oct 23, 2021 at 11:46:18PM +0100, Matthew Wilcox wrote:
> > > On Sat, Oct 23, 2021 at 10:03:11AM -0700, Kees Cook wrote:
> > > > On October 23, 2021 8:27:28 AM PDT, Mike Rapoport <rppt@kernel.org> wrote:
> > > > >and my first reaction was to send a revert the untested commit 110860541f44
> > > > >("mm/secretmem: use refcount_t instead of atomic_t").
> > >
> > > I think you should. This isn't a real problem.
> >
> > Do you mean that creation of 4 billion of file descriptors is not feasible?
>
> On a sufficiently large machine, it is. But then we have the same
> problem with other atomic_t. If you really care, just check whether
> secretmem_users has gone negative, and return -ENFILE. It doesn't
> even have to be all that exact; you've got 2 billion values of slop
> to use before you hit the wrap from negative to 0 which is the actual
> problem.
>
> ie this:
>
> +++ b/mm/secretmem.c
> @@ -203,6 +203,8 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
>
> if (flags & ~(SECRETMEM_FLAGS_MASK | O_CLOEXEC))
> return -EINVAL;
> + if (atomic_read(&secretmem_users) < 0)
> + return -ENFILE;
So you suggest to prevent creation of the file descriptor to ensure there
is no overflow of secretmem_users. I don't feel it's a clean and elegant
solution.
>
> fd = get_unused_fd_flags(flags & O_CLOEXEC);
> if (fd < 0)
>
>
> Also, why does secretmem depend on !EMBEDDED?
There was a request from tiny-config maintainers to keep this code outside
tiny-config and the best option I could find to make secretmem depend on
!EMBEDDED.
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [syzbot] WARNING: refcount bug in sys_memfd_secret
2021-10-22 15:02 [syzbot] WARNING: refcount bug in sys_memfd_secret syzbot
` (2 preceding siblings ...)
2021-10-23 22:31 ` syzbot
@ 2021-11-24 13:47 ` syzbot
3 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2021-11-24 13:47 UTC (permalink / raw)
To: akpm, dvyukov, fgheet255t, fmdefrancesco, jordy, jordy, keescook,
linux-kernel, linux-mm, rppt, syzkaller-bugs, torvalds, willy
syzbot suspects this issue was fixed by commit:
commit 87066fdd2e30fe9dd531125d95257c118a74617e
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun Oct 24 19:48:33 2021 +0000
Revert "mm/secretmem: use refcount_t instead of atomic_t"
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11cccf06b00000
start commit: 9c0c4d24ac00 Merge tag 'block-5.15-2021-10-22' of git://gi..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=be398dd7862f4b36
dashboard link: https://syzkaller.appspot.com/bug?extid=b904a1de3ec43711eba5
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=130cabdcb00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=175b91acb00000
If the result looks correct, please mark the issue as fixed by replying with:
#syz fix: Revert "mm/secretmem: use refcount_t instead of atomic_t"
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 15+ messages in thread
end of thread, other threads:[~2021-11-24 13:51 UTC | newest]
Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-22 15:02 [syzbot] WARNING: refcount bug in sys_memfd_secret syzbot
2021-10-22 15:07 ` Dmitry Vyukov
2021-10-22 16:25 ` Jordy Zomer
2021-10-22 16:29 ` Dmitry Vyukov
2021-10-22 16:39 ` Jordy Zomer
2021-10-23 15:27 ` Mike Rapoport
2021-10-23 17:03 ` Kees Cook
2021-10-23 22:46 ` Matthew Wilcox
2021-10-24 5:37 ` Mike Rapoport
2021-10-24 7:07 ` Dmitry Vyukov
2021-10-24 10:57 ` Matthew Wilcox
2021-10-24 15:31 ` Mike Rapoport
2021-10-23 12:02 ` syzbot
2021-10-23 22:31 ` syzbot
2021-11-24 13:47 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).