mirror of
https://github.com/FEX-Emu/linux.git
synced 2025-01-08 02:21:18 +00:00
cfc2c74053
We had one report from syzkaller [1]
First issue is that INIT_WORK() should be done before mod_timer()
or we risk timer being fired too soon, even with a 1 second timer.
Second issue is that we need to reject too big info->timeout
to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or
risk looping, if result after overflow is 0.
[1]
WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
RSP: 0018:ffff8801db507538 EFLAGS: 00010006
RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404
RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082
RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c
R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6
R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000
queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488
queue_work include/linux/workqueue.h:488 [inline]
schedule_work include/linux/workqueue.h:546 [inline]
idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116
call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:541 [inline]
smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184
RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006
RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282
RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8
R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278
__debug_object_init+0x235/0x1040 lib/debugobjects.c:378
debug_object_init+0x17/0x20 lib/debugobjects.c:391
__init_work+0x2b/0x60 kernel/workqueue.c:506
idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]
idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213
xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850
check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]
find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575
translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744
do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]
do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686
nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927
udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976
SYSC_setsockopt net/socket.c:1850 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1829
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
Fixes:
|
||
---|---|---|
.. | ||
ipset | ||
ipvs | ||
core.c | ||
Kconfig | ||
Makefile | ||
nf_conncount.c | ||
nf_conntrack_acct.c | ||
nf_conntrack_amanda.c | ||
nf_conntrack_broadcast.c | ||
nf_conntrack_core.c | ||
nf_conntrack_ecache.c | ||
nf_conntrack_expect.c | ||
nf_conntrack_extend.c | ||
nf_conntrack_ftp.c | ||
nf_conntrack_h323_asn1.c | ||
nf_conntrack_h323_main.c | ||
nf_conntrack_h323_types.c | ||
nf_conntrack_helper.c | ||
nf_conntrack_irc.c | ||
nf_conntrack_l3proto_generic.c | ||
nf_conntrack_labels.c | ||
nf_conntrack_netbios_ns.c | ||
nf_conntrack_netlink.c | ||
nf_conntrack_pptp.c | ||
nf_conntrack_proto_dccp.c | ||
nf_conntrack_proto_generic.c | ||
nf_conntrack_proto_gre.c | ||
nf_conntrack_proto_sctp.c | ||
nf_conntrack_proto_tcp.c | ||
nf_conntrack_proto_udp.c | ||
nf_conntrack_proto.c | ||
nf_conntrack_sane.c | ||
nf_conntrack_seqadj.c | ||
nf_conntrack_sip.c | ||
nf_conntrack_snmp.c | ||
nf_conntrack_standalone.c | ||
nf_conntrack_tftp.c | ||
nf_conntrack_timeout.c | ||
nf_conntrack_timestamp.c | ||
nf_dup_netdev.c | ||
nf_flow_table_inet.c | ||
nf_flow_table.c | ||
nf_internals.h | ||
nf_log_common.c | ||
nf_log_netdev.c | ||
nf_log.c | ||
nf_nat_amanda.c | ||
nf_nat_core.c | ||
nf_nat_ftp.c | ||
nf_nat_helper.c | ||
nf_nat_irc.c | ||
nf_nat_proto_common.c | ||
nf_nat_proto_dccp.c | ||
nf_nat_proto_sctp.c | ||
nf_nat_proto_tcp.c | ||
nf_nat_proto_udp.c | ||
nf_nat_proto_unknown.c | ||
nf_nat_redirect.c | ||
nf_nat_sip.c | ||
nf_nat_tftp.c | ||
nf_queue.c | ||
nf_sockopt.c | ||
nf_synproxy_core.c | ||
nf_tables_api.c | ||
nf_tables_core.c | ||
nf_tables_inet.c | ||
nf_tables_netdev.c | ||
nf_tables_trace.c | ||
nfnetlink_acct.c | ||
nfnetlink_cthelper.c | ||
nfnetlink_cttimeout.c | ||
nfnetlink_log.c | ||
nfnetlink_queue.c | ||
nfnetlink.c | ||
nft_bitwise.c | ||
nft_byteorder.c | ||
nft_cmp.c | ||
nft_compat.c | ||
nft_counter.c | ||
nft_ct.c | ||
nft_dup_netdev.c | ||
nft_dynset.c | ||
nft_exthdr.c | ||
nft_fib_inet.c | ||
nft_fib_netdev.c | ||
nft_fib.c | ||
nft_flow_offload.c | ||
nft_fwd_netdev.c | ||
nft_hash.c | ||
nft_immediate.c | ||
nft_limit.c | ||
nft_log.c | ||
nft_lookup.c | ||
nft_masq.c | ||
nft_meta.c | ||
nft_nat.c | ||
nft_numgen.c | ||
nft_objref.c | ||
nft_payload.c | ||
nft_queue.c | ||
nft_quota.c | ||
nft_range.c | ||
nft_redir.c | ||
nft_reject_inet.c | ||
nft_reject.c | ||
nft_rt.c | ||
nft_set_bitmap.c | ||
nft_set_hash.c | ||
nft_set_rbtree.c | ||
utils.c | ||
x_tables.c | ||
xt_addrtype.c | ||
xt_AUDIT.c | ||
xt_bpf.c | ||
xt_cgroup.c | ||
xt_CHECKSUM.c | ||
xt_CLASSIFY.c | ||
xt_cluster.c | ||
xt_comment.c | ||
xt_connbytes.c | ||
xt_connlabel.c | ||
xt_connlimit.c | ||
xt_connmark.c | ||
xt_CONNSECMARK.c | ||
xt_conntrack.c | ||
xt_cpu.c | ||
xt_CT.c | ||
xt_dccp.c | ||
xt_devgroup.c | ||
xt_dscp.c | ||
xt_DSCP.c | ||
xt_ecn.c | ||
xt_esp.c | ||
xt_hashlimit.c | ||
xt_helper.c | ||
xt_hl.c | ||
xt_HL.c | ||
xt_HMARK.c | ||
xt_IDLETIMER.c | ||
xt_ipcomp.c | ||
xt_iprange.c | ||
xt_ipvs.c | ||
xt_l2tp.c | ||
xt_LED.c | ||
xt_length.c | ||
xt_limit.c | ||
xt_LOG.c | ||
xt_mac.c | ||
xt_mark.c | ||
xt_multiport.c | ||
xt_nat.c | ||
xt_NETMAP.c | ||
xt_nfacct.c | ||
xt_NFLOG.c | ||
xt_NFQUEUE.c | ||
xt_osf.c | ||
xt_owner.c | ||
xt_physdev.c | ||
xt_pkttype.c | ||
xt_policy.c | ||
xt_quota.c | ||
xt_rateest.c | ||
xt_RATEEST.c | ||
xt_realm.c | ||
xt_recent.c | ||
xt_REDIRECT.c | ||
xt_repldata.h | ||
xt_sctp.c | ||
xt_SECMARK.c | ||
xt_set.c | ||
xt_socket.c | ||
xt_state.c | ||
xt_statistic.c | ||
xt_string.c | ||
xt_tcpmss.c | ||
xt_TCPMSS.c | ||
xt_TCPOPTSTRIP.c | ||
xt_tcpudp.c | ||
xt_TEE.c | ||
xt_time.c | ||
xt_TPROXY.c | ||
xt_TRACE.c | ||
xt_u32.c |