syzbot


INFO: task hung in aead_recvmsg

Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+56c7151cad94eec37c521f0e47d2eee53f9361c4@syzkaller.appspotmail.com
Fix commit: bbefa1dd6a6d crypto: pcrypt - Avoid deadlock by using per-instance padata queues
First crash: 1835d, last: 1052d

Cause bisection: introduced by (bisect log) :
commit 0c1e16cd1ec41987cc6671a2bff46ac958c41eb5
Author: Stephan Mueller <smueller@chronox.de>
Date: Mon Dec 5 14:26:19 2016 +0000

  crypto: algif_aead - fix AEAD tag memory handling

Crash: KASAN: slab-out-of-bounds Read in aead_recvmsg (log)
Repro: C syz .config
duplicates (6):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
INFO: task hung in lock_sock_nested C 2593 1026d 1825d 0/24 closed as dup on 2017/12/23 20:15
INFO: task hung in tls_sw_free_resources_tx C done 109 1235d 1467d 0/24 closed as dup on 2019/08/19 21:16
INFO: task hung in cancel_delayed_work_sync C done 166 1147d 1180d 0/24 closed as dup on 2019/09/19 05:15
INFO: task hung in tls_sw_sendmsg 18 1182d 1370d 0/24 closed as dup on 2019/08/19 21:10
INFO: task hung in tls_sw_release_resources_tx C done 20 1052d 1212d 0/24 closed as dup on 2019/08/17 05:47
INFO: task hung in exit_aio C 17519 1210d 1825d 0/24 closed as dup on 2018/04/08 22:50
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in aead_recvmsg C error 9 73d 1326d 0/1 upstream: reported C repro on 2019/04/23 11:09
linux-4.14 INFO: task hung in aead_recvmsg C inconclusive 3 608d 1328d 0/1 upstream: reported C repro on 2019/04/21 21:05

Sample crash report:
INFO: task syz-executor370:7818 blocked for more than 143 seconds.
      Not tainted 5.1.0-rc5+ #70
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor370 D28120  7818   7794 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2877 [inline]
 __schedule+0x813/0x1cc0 kernel/sched/core.c:3518
 schedule+0x92/0x180 kernel/sched/core.c:3562
 schedule_timeout+0x8ca/0xfd0 kernel/time/timer.c:1779
 do_wait_for_common kernel/sched/completion.c:83 [inline]
 __wait_for_common kernel/sched/completion.c:104 [inline]
 wait_for_common kernel/sched/completion.c:115 [inline]
 wait_for_completion+0x29c/0x440 kernel/sched/completion.c:136
 crypto_wait_req include/linux/crypto.h:680 [inline]
 _aead_recvmsg crypto/algif_aead.c:313 [inline]
 aead_recvmsg+0x1492/0x1ab0 crypto/algif_aead.c:334
 sock_recvmsg_nosec net/socket.c:881 [inline]
 sock_recvmsg net/socket.c:888 [inline]
 sock_recvmsg+0xd0/0x110 net/socket.c:884
 sock_read_iter+0x299/0x3b0 net/socket.c:966
 call_read_iter include/linux/fs.h:1860 [inline]
 do_iter_readv_writev+0x700/0x8e0 fs/read_write.c:679
 do_iter_read+0x27c/0x660 fs/read_write.c:920
 vfs_readv+0xf0/0x160 fs/read_write.c:984
 do_readv+0x15e/0x370 fs/read_write.c:1017
 __do_sys_readv fs/read_write.c:1104 [inline]
 __se_sys_readv fs/read_write.c:1101 [inline]
 __x64_sys_readv+0x75/0xb0 fs/read_write.c:1101
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441349
Code: Bad RIP value.
RSP: 002b:00007ffd03d84728 EFLAGS: 00000246 ORIG_RAX: 0000000000000013
RAX: ffffffffffffffda RBX: 00000000004a23d8 RCX: 0000000000441349
RDX: 0000000000000001 RSI: 00000000200007c0 RDI: 0000000000000004
RBP: 0000000000052e64 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000402170
R13: 0000000000402200 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
1 lock held by khungtaskd/1043:
 #0: 00000000e2e42ae5 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5056
1 lock held by rsyslogd/7678:
 #0: 0000000033d8ba67 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801
2 locks held by getty/7768:
 #0: 00000000695c8b33 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000b0b463f2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7769:
 #0: 000000006818530d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000ed610f73 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7770:
 #0: 00000000fbcde1ed (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000817f6048 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7771:
 #0: 000000001606e8d4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000005557a95 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7772:
 #0: 00000000f6ef863e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 00000000c55157f8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7773:
 #0: 000000004cd964f4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000091a9b2ef (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
2 locks held by getty/7774:
 #0: 00000000e33d0631 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341
 #1: 0000000001081adc (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156
1 lock held by syz-executor370/7818:
 #0: 000000009baf1423 (sk_lock-AF_ALG){+.+.}, at: lock_sock include/net/sock.h:1513 [inline]
 #0: 000000009baf1423 (sk_lock-AF_ALG){+.+.}, at: af_alg_wait_for_data+0x215/0x540 crypto/af_alg.c:764

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1043 Comm: khungtaskd Not tainted 5.1.0-rc5+ #70
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0x9b7/0xec0 kernel/hung_task.c:288
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2019/12/11 10:23 upstream 6794862a16ef 505ab413 .config log report syz C
* Struck through repros no longer work on HEAD.
Crashes (11991):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2019/04/16 14:28 upstream 618d919cae2f 505ab413 .config log report syz C
ci-upstream-kasan-gce 2018/07/21 14:42 upstream 48e5aee81f32 8cc079c3 .config log report syz C
ci-upstream-net-this-kasan-gce 2019/04/16 18:47 net 614c70f35cd7 505ab413 .config log report syz C
ci-upstream-net-this-kasan-gce 2018/07/21 14:31 net fcf4793e278e 8cc079c3 .config log report syz C
ci-upstream-net-kasan-gce 2019/04/16 10:14 net-next 47a1a225ab35 505ab413 .config log report syz C
ci-upstream-net-kasan-gce 2018/07/21 12:36 net-next 99d20a461c43 8cc079c3 .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2019/04/16 12:49 linux-next de3c659c83ce 505ab413 .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2018/07/22 11:32 linux-next 89cf55353308 8cc079c3 .config log report syz C
ci-upstream-kasan-gce 2020/01/23 05:35 upstream dbab40bdb42c 3334d684 .config log report
ci-upstream-kasan-gce 2019/09/07 23:45 upstream 1e3778cb223e a60cb4cd .config log report
ci-upstream-kasan-gce 2019/08/30 19:52 upstream 6525771f58cb fd37b39e .config log report
ci-upstream-kasan-gce-smack-root 2019/02/27 08:53 upstream 7d762d69145a f2468c12 .config log report
ci-upstream-kasan-gce-386 2018/09/05 09:16 upstream 28619527b8a7 a4718693 .config log report
ci-upstream-net-this-kasan-gce 2019/09/04 11:27 net e33b4325e60e 12381952 .config log report
ci-upstream-net-this-kasan-gce 2019/09/03 03:57 net e1e54ec7fb55 14544a56 .config log report
ci-upstream-net-this-kasan-gce 2019/08/30 22:36 net 9e8312f5e160 fd37b39e .config log report
ci-upstream-net-this-kasan-gce 2019/08/29 06:33 net 9e8312f5e160 fd37b39e .config log report
ci-upstream-net-this-kasan-gce 2019/08/28 08:59 net 9e8312f5e160 fd37b39e .config log report
ci-upstream-net-this-kasan-gce 2019/08/27 14:24 net f53a7ad18959 d21c5d9d .config log report
ci-upstream-net-this-kasan-gce 2019/08/26 15:09 net f53a7ad18959 d21c5d9d .config log report
ci-upstream-net-this-kasan-gce 2019/08/16 10:18 net 2aafdf5a5786 8fd428a1 .config log report
ci-upstream-net-this-kasan-gce 2019/08/13 23:31 net bb0ce4c1517d ef801a3e .config log report
ci-upstream-net-this-kasan-gce 2019/08/12 19:36 net 125b7e0949d4 acb51638 .config log report
ci-upstream-net-this-kasan-gce 2019/08/06 02:22 net 107e47cc80ec 6affd8e8 .config log report
ci-upstream-net-this-kasan-gce 2019/08/02 19:54 net 107e47cc80ec 835dffe7 .config log report
ci-upstream-net-this-kasan-gce 2019/07/24 06:06 net 107e47cc80ec de453f34 .config log report
ci-upstream-net-this-kasan-gce 2019/07/23 08:26 net 107e47cc80ec 55e0c077 .config log report
ci-upstream-net-kasan-gce 2019/09/20 18:33 net-next b41dae061bbd d96e88f3 .config log report
ci-upstream-net-kasan-gce 2019/08/22 10:14 net-next 4f830a5af7b5 984250d5 .config log report
ci-upstream-net-kasan-gce 2019/08/17 20:33 net-next a4d2113e46c1 55bf8926 .config log report
ci-upstream-net-kasan-gce 2019/08/17 11:06 net-next 13b18f1d281b 8fd428a1 .config log report
ci-upstream-net-kasan-gce 2019/08/16 08:13 net-next 459c5fb44379 8fd428a1 .config log report
ci-upstream-net-kasan-gce 2019/08/15 14:52 net-next ecb9f80db23a 0d298d6b .config log report
ci-upstream-net-kasan-gce 2019/08/13 11:33 net-next 53f6f391786e 8620c2c2 .config log report
ci-upstream-net-kasan-gce 2019/08/13 06:11 net-next 53f6f391786e 8620c2c2 .config log report
ci-upstream-net-kasan-gce 2019/08/12 08:42 net-next 6e5ee483397a acb51638 .config log report
ci-upstream-net-kasan-gce 2019/08/12 01:22 net-next 2cc2743d8fee acb51638 .config log report
ci-upstream-net-kasan-gce 2019/08/07 15:32 net-next 13dfb3fa4943 cdde7486 .config log report
ci-upstream-net-kasan-gce 2019/08/05 17:11 net-next 31cc088a4f5d 6affd8e8 .config log report
ci-upstream-net-kasan-gce 2019/08/04 07:49 net-next 31cc088a4f5d 6affd8e8 .config log report
ci-upstream-net-kasan-gce 2019/08/03 17:48 net-next 31cc088a4f5d 6affd8e8 .config log report
ci-upstream-net-kasan-gce 2019/08/03 05:58 net-next 31cc088a4f5d 6affd8e8 .config log report
ci-upstream-net-kasan-gce 2019/08/02 17:12 net-next 31cc088a4f5d 835dffe7 .config log report
ci-upstream-net-kasan-gce 2019/08/02 14:52 net-next 31cc088a4f5d 835dffe7 .config log report
ci-upstream-net-kasan-gce 2019/07/30 20:59 net-next 31cc088a4f5d f28bf2a5 .config log report
ci-upstream-net-kasan-gce 2019/07/29 05:05 net-next 31cc088a4f5d c85e1c5b .config log report
ci-upstream-net-kasan-gce 2019/07/28 18:38 net-next 31cc088a4f5d c85e1c5b .config log report
ci-upstream-net-kasan-gce 2019/07/25 16:29 net-next 31cc088a4f5d 32329ceb .config log report
ci-upstream-net-kasan-gce 2019/07/24 02:07 net-next 31cc088a4f5d de453f34 .config log report
ci-upstream-net-kasan-gce 2019/07/21 01:19 net-next 31cc088a4f5d 1656845f .config log report
ci-upstream-net-kasan-gce 2019/06/30 17:03 net-next f072218cca5b 7509bf36 .config log report
ci-upstream-net-kasan-gce 2019/06/30 10:24 net-next f072218cca5b 7509bf36 .config log report
ci-upstream-net-kasan-gce 2019/06/29 09:41 net-next ee7dd7733b20 7509bf36 .config log report
* Struck through repros no longer work on HEAD.