mirror of https://github.com/torvalds/linux.git
cfc2c74053
We had one report from syzkaller [1]
First issue is that INIT_WORK() should be done before mod_timer()
or we risk timer being fired too soon, even with a 1 second timer.
Second issue is that we need to reject too big info->timeout
to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or
risk looping, if result after overflow is 0.
[1]
WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444
RSP: 0018:ffff8801db507538 EFLAGS: 00010006
RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404
RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082
RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c
R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6
R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000
queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488
queue_work include/linux/workqueue.h:488 [inline]
schedule_work include/linux/workqueue.h:546 [inline]
idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116
call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:541 [inline]
smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829
</IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184
RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006
RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282
RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8
R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278
__debug_object_init+0x235/0x1040 lib/debugobjects.c:378
debug_object_init+0x17/0x20 lib/debugobjects.c:391
__init_work+0x2b/0x60 kernel/workqueue.c:506
idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]
idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213
xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850
check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]
find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575
translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744
do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]
do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686
nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115
ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927
udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422
sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976
SYSC_setsockopt net/socket.c:1850 [inline]
SyS_setsockopt+0x189/0x360 net/socket.c:1829
do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
Fixes:
|
||
|---|---|---|
| .. | ||
| ipset | ||
| ipvs | ||
| Kconfig | ||
| Makefile | ||
| core.c | ||
| nf_conncount.c | ||
| nf_conntrack_acct.c | ||
| nf_conntrack_amanda.c | ||
| nf_conntrack_broadcast.c | ||
| nf_conntrack_core.c | ||
| nf_conntrack_ecache.c | ||
| nf_conntrack_expect.c | ||
| nf_conntrack_extend.c | ||
| nf_conntrack_ftp.c | ||
| nf_conntrack_h323_asn1.c | ||
| nf_conntrack_h323_main.c | ||
| nf_conntrack_h323_types.c | ||
| nf_conntrack_helper.c | ||
| nf_conntrack_irc.c | ||
| nf_conntrack_l3proto_generic.c | ||
| nf_conntrack_labels.c | ||
| nf_conntrack_netbios_ns.c | ||
| nf_conntrack_netlink.c | ||
| nf_conntrack_pptp.c | ||
| nf_conntrack_proto.c | ||
| nf_conntrack_proto_dccp.c | ||
| nf_conntrack_proto_generic.c | ||
| nf_conntrack_proto_gre.c | ||
| nf_conntrack_proto_sctp.c | ||
| nf_conntrack_proto_tcp.c | ||
| nf_conntrack_proto_udp.c | ||
| nf_conntrack_sane.c | ||
| nf_conntrack_seqadj.c | ||
| nf_conntrack_sip.c | ||
| nf_conntrack_snmp.c | ||
| nf_conntrack_standalone.c | ||
| nf_conntrack_tftp.c | ||
| nf_conntrack_timeout.c | ||
| nf_conntrack_timestamp.c | ||
| nf_dup_netdev.c | ||
| nf_flow_table.c | ||
| nf_flow_table_inet.c | ||
| nf_internals.h | ||
| nf_log.c | ||
| nf_log_common.c | ||
| nf_log_netdev.c | ||
| nf_nat_amanda.c | ||
| nf_nat_core.c | ||
| nf_nat_ftp.c | ||
| nf_nat_helper.c | ||
| nf_nat_irc.c | ||
| nf_nat_proto_common.c | ||
| nf_nat_proto_dccp.c | ||
| nf_nat_proto_sctp.c | ||
| nf_nat_proto_tcp.c | ||
| nf_nat_proto_udp.c | ||
| nf_nat_proto_unknown.c | ||
| nf_nat_redirect.c | ||
| nf_nat_sip.c | ||
| nf_nat_tftp.c | ||
| nf_queue.c | ||
| nf_sockopt.c | ||
| nf_synproxy_core.c | ||
| nf_tables_api.c | ||
| nf_tables_core.c | ||
| nf_tables_inet.c | ||
| nf_tables_netdev.c | ||
| nf_tables_trace.c | ||
| nfnetlink.c | ||
| nfnetlink_acct.c | ||
| nfnetlink_cthelper.c | ||
| nfnetlink_cttimeout.c | ||
| nfnetlink_log.c | ||
| nfnetlink_queue.c | ||
| nft_bitwise.c | ||
| nft_byteorder.c | ||
| nft_cmp.c | ||
| nft_compat.c | ||
| nft_counter.c | ||
| nft_ct.c | ||
| nft_dup_netdev.c | ||
| nft_dynset.c | ||
| nft_exthdr.c | ||
| nft_fib.c | ||
| nft_fib_inet.c | ||
| nft_fib_netdev.c | ||
| nft_flow_offload.c | ||
| nft_fwd_netdev.c | ||
| nft_hash.c | ||
| nft_immediate.c | ||
| nft_limit.c | ||
| nft_log.c | ||
| nft_lookup.c | ||
| nft_masq.c | ||
| nft_meta.c | ||
| nft_nat.c | ||
| nft_numgen.c | ||
| nft_objref.c | ||
| nft_payload.c | ||
| nft_queue.c | ||
| nft_quota.c | ||
| nft_range.c | ||
| nft_redir.c | ||
| nft_reject.c | ||
| nft_reject_inet.c | ||
| nft_rt.c | ||
| nft_set_bitmap.c | ||
| nft_set_hash.c | ||
| nft_set_rbtree.c | ||
| utils.c | ||
| x_tables.c | ||
| xt_AUDIT.c | ||
| xt_CHECKSUM.c | ||
| xt_CLASSIFY.c | ||
| xt_CONNSECMARK.c | ||
| xt_CT.c | ||
| xt_DSCP.c | ||
| xt_HL.c | ||
| xt_HMARK.c | ||
| xt_IDLETIMER.c | ||
| xt_LED.c | ||
| xt_LOG.c | ||
| xt_NETMAP.c | ||
| xt_NFLOG.c | ||
| xt_NFQUEUE.c | ||
| xt_RATEEST.c | ||
| xt_REDIRECT.c | ||
| xt_SECMARK.c | ||
| xt_TCPMSS.c | ||
| xt_TCPOPTSTRIP.c | ||
| xt_TEE.c | ||
| xt_TPROXY.c | ||
| xt_TRACE.c | ||
| xt_addrtype.c | ||
| xt_bpf.c | ||
| xt_cgroup.c | ||
| xt_cluster.c | ||
| xt_comment.c | ||
| xt_connbytes.c | ||
| xt_connlabel.c | ||
| xt_connlimit.c | ||
| xt_connmark.c | ||
| xt_conntrack.c | ||
| xt_cpu.c | ||
| xt_dccp.c | ||
| xt_devgroup.c | ||
| xt_dscp.c | ||
| xt_ecn.c | ||
| xt_esp.c | ||
| xt_hashlimit.c | ||
| xt_helper.c | ||
| xt_hl.c | ||
| xt_ipcomp.c | ||
| xt_iprange.c | ||
| xt_ipvs.c | ||
| xt_l2tp.c | ||
| xt_length.c | ||
| xt_limit.c | ||
| xt_mac.c | ||
| xt_mark.c | ||
| xt_multiport.c | ||
| xt_nat.c | ||
| xt_nfacct.c | ||
| xt_osf.c | ||
| xt_owner.c | ||
| xt_physdev.c | ||
| xt_pkttype.c | ||
| xt_policy.c | ||
| xt_quota.c | ||
| xt_rateest.c | ||
| xt_realm.c | ||
| xt_recent.c | ||
| xt_repldata.h | ||
| xt_sctp.c | ||
| xt_set.c | ||
| xt_socket.c | ||
| xt_state.c | ||
| xt_statistic.c | ||
| xt_string.c | ||
| xt_tcpmss.c | ||
| xt_tcpudp.c | ||
| xt_time.c | ||
| xt_u32.c | ||