** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-hwe-5.13 in Ubuntu. https://bugs.launchpad.net/bugs/1983436
Title: BUG:soft lockup - CPU#0 stuck for 36s! rcu_core_si kernel/rcu/tree.c:2807 Status in linux-hwe-5.13 package in Ubuntu: New Bug description: We would like to report the following bug which has been found by our modified version of syzkaller. rcu_core_si in kernel/rcu/tree.c:2807 in the Linux kernel through 5.13 allows attackers to cause a denial of service (soft lockup) via a large number of different function calls. description: BUG: soft lockup in rcu_core_si affected file: kernel/rcu/tree.c kernel version: 5.13 kernel config, syzkaller reproducer and raw console output are all in the attachments. ====================================================== Crash log: ====================================================== watchdog: BUG: soft lockup - CPU#0 stuck for 36s! [syz-executor.6:14479] Modules linked in: CPU: 0 PID: 14479 Comm: syz-executor.6 Not tainted 5.13.19+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:cred_label security/apparmor/include/cred.h:27 [inline] RIP: 0010:apparmor_cred_free+0x5f/0x1a0 security/apparmor/lsm.c:69 Code: 01 00 00 48 63 1d a1 fd 4d 02 49 03 5c 24 78 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 08 01 00 00 <4c> 8b 2b 4d 85 ed 74 68 e8 74 53 4b ff be 04 00 00 00 4c 89 ef bb RSP: 0018:ffff888056609dc8 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff888005c8fc80 RCX: ffffffff967eb4fd RDX: 1ffff11000b91f90 RSI: 0000000000000100 RDI: ffff888005821000 RBP: ffff888056609de8 R08: 0000000000000001 R09: ffffed1000b04201 R10: ffff888005821003 R11: ffffed1000b04200 R12: ffff888005821000 R13: ffff888005821000 R14: ffff888005821078 R15: ffff888007ba8000 FS: 00007f5f81a40700(0000) GS:ffff888056600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe8252bb80 CR3: 0000000003cf6006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> security_cred_free+0x83/0x130 security/security.c:1881 put_cred_rcu+0x71/0x360 kernel/cred.c:115 rcu_do_batch kernel/rcu/tree.c:2559 [inline] rcu_core+0x536/0x12f0 kernel/rcu/tree.c:2794 rcu_core_si+0xe/0x10 kernel/rcu/tree.c:2807 __do_softirq+0x187/0x576 kernel/softirq.c:559 invoke_softirq kernel/softirq.c:433 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0x120/0x150 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x79/0x90 arch/x86/kernel/apic/apic.c:1100 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:0xffffffffc01e0801 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 <55> 48 89 e5 53 41 55 31 c0 45 31 ed 48 89 fb b8 ff ff ff 7f 41 5d RSP: 0018:ffff888006ec7d58 EFLAGS: 00000246 RAX: ffffffffc01e07fc RBX: 000000007fff0000 RCX: ffffffff95ccef6a RDX: ffff888007ba8000 RSI: ffffc90000763048 RDI: ffff888006ec7e10 RBP: ffff888006ec7eb8 R08: 0000000000000001 R09: ffffed1005374c87 R10: ffff888029ba6437 R11: ffffed1005374c86 R12: ffff888006ec7e10 R13: ffff888029ba6400 R14: ffffc90000763000 R15: dffffc0000000000 </TASK> Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.13.19+ #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:check_hung_uninterruptible_tasks kernel/hung_task.c:190 [inline] RIP: 0010:watchdog+0x1e1/0xa60 kernel/hung_task.c:294 Code: 45 a8 e8 e2 74 fd ff 49 8d 87 40 03 00 00 48 b9 00 00 00 00 00 fc ff df 48 89 45 c0 48 c1 e8 03 80 3c 08 00 0f 85 dd 07 00 00 <49> 8b 9f 40 03 00 00 48 be 00 00 00 00 00 fc ff df 4c 8d 63 10 4c RSP: 0000:ffff888001d77ea0 EFLAGS: 00010246 RAX: 1ffff11000dea98b RBX: ffff88800669b630 RCX: dffffc0000000000 RDX: ffff888001d6a080 RSI: 0000000000000000 RDI: ffff888005e4c918 RBP: ffff888001d77f00 R08: 0000000000000001 R09: fffffbfff34354d9 R10: ffffffff9a1aa6c7 R11: fffffbfff34354d8 R12: ffff88800669c010 R13: 00000000003fff85 R14: 0000000100021a4b R15: ffff888006f54918 FS: 0000000000000000(0000) GS:ffff888056700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcc3c83ce8 CR3: 0000000004310004 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> kthread+0x352/0x430 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 </TASK> ---------------- Code disassembly (best guess): 0: 01 00 add %eax,(%rax) 2: 00 48 63 add %cl,0x63(%rax) 5: 1d a1 fd 4d 02 sbb $0x24dfda1,%eax a: 49 03 5c 24 78 add 0x78(%r12),%rbx f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 48 89 da mov %rbx,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 08 01 00 00 jne 0x132 * 2a: 4c 8b 2b mov (%rbx),%r13 <-- trapping instruction 2d: 4d 85 ed test %r13,%r13 30: 74 68 je 0x9a 32: e8 74 53 4b ff callq 0xff4b53ab 37: be 04 00 00 00 mov $0x4,%esi 3c: 4c 89 ef mov %r13,%rdi 3f: bb .byte 0xbb -- To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-hwe-5.13/+bug/1983436/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp