lkml.org 
[lkml]   [2018]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: WARNING in bpf_check (2)
From
Date
On 15/11/18 07:49, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    ccda4af0f4b9 Linux 4.20-rc2
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=129edfbd400000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
> dashboard link: https://syzkaller.appspot.com/bug?extid=4fc427c7af994b0948be
> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=172b626d400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=148dcb0b400000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com
I'm investigating this.  So far I have disassembled the prog and reproduced
 the failure by adding the following to test_verifier.c:
    {
        "syz found: explosion",
        .insns = {
            BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
            BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
            BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
            BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
            BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
            BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
            BPF_EXIT_INSN(),
            BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
            BPF_MOV64_IMM(BPF_REG_0, 0),
            BPF_EXIT_INSN(),
        },
        .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
        .result = ACCEPT,
    },
A subprog _does_ start at insn 7, and the verifier was happy with it until
 jit_subprogs, suggesting that something has mangled env->subprog_info[].start
 or else insns have been inserted but the call insns not adjusted.
The obvious suspect would be adjust_subprog_starts() and/or
 bpf_patch_insn_data().

-Ed

\
 
 \ /
  Last update: 2018-11-15 20:51    [W:0.047 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site