Messages in this thread | | | Subject | Re: WARNING in bpf_check (2) | From | Edward Cree <> | Date | Thu, 15 Nov 2018 19:50:17 +0000 |
| |
On 15/11/18 07:49, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: ccda4af0f4b9 Linux 4.20-rc2 > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=129edfbd400000 > kernel config: https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5 > dashboard link: https://syzkaller.appspot.com/bug?extid=4fc427c7af994b0948be > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172b626d400000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=148dcb0b400000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com I'm investigating this. So far I have disassembled the prog and reproduced the failure by adding the following to test_verifier.c: { "syz found: explosion", .insns = { BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5), BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0), BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2), BPF_MOV64_REG(BPF_REG_1, BPF_REG_0), BPF_EXIT_INSN(), BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, .result = ACCEPT, }, A subprog _does_ start at insn 7, and the verifier was happy with it until jit_subprogs, suggesting that something has mangled env->subprog_info[].start or else insns have been inserted but the call insns not adjusted. The obvious suspect would be adjust_subprog_starts() and/or bpf_patch_insn_data().
-Ed
| |