lkml.org 
[lkml]   [2018]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: KASAN: stack-out-of-bounds Read in locks_remove_posix
    On Sat, Jul 21, 2018 at 8:29 PM, syzbot
    <syzbot+5855b4355079756bf451@syzkaller.appspotmail.com> wrote:
    > Hello,
    >
    > syzbot found the following crash on:
    >
    > HEAD commit: 8ae71e76cf1f Merge branch 'bpf-offload-sharing'
    > git tree: bpf-next
    > console output: https://syzkaller.appspot.com/x/log.txt?x=17724d1c400000
    > kernel config: https://syzkaller.appspot.com/x/.config?x=89129667b46496c3
    > dashboard link: https://syzkaller.appspot.com/bug?extid=5855b4355079756bf451
    > compiler: gcc (GCC) 8.0.1 20180413 (experimental)
    > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1193eee0400000
    > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c5c9dc400000
    >
    > IMPORTANT: if you fix the bug, please add the following tag to the commit:
    > Reported-by: syzbot+5855b4355079756bf451@syzkaller.appspotmail.com

    Looks like the same bpf map bug:

    #syz fix: bpf: sockhash, disallow bpf_tcp_close and update in parallel

    > ==================================================================
    > kasan: CONFIG_KASAN_INLINE enabled
    > BUG: KASAN: stack-out-of-bounds in locks_inode include/linux/fs.h:1061
    > [inline]
    > BUG: KASAN: stack-out-of-bounds in locks_remove_posix+0x787/0x890
    > fs/locks.c:2468
    > kasan: GPF could be caused by NULL-ptr deref or user memory access
    > Read of size 8 at addr ffff8801b7644e18 by task syz-executor473/4469
    >
    > general protection fault: 0000 [#1] SMP KASAN
    > CPU: 1 PID: 4469 Comm: syz-executor473 Not tainted 4.18.0-rc3+ #58
    > CPU: 0 PID: 17562 Comm: syz-executor473 Not tainted 4.18.0-rc3+ #58
    > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
    > Google 01/01/2011
    > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
    > Google 01/01/2011
    > RIP: 0010:__read_seqcount_begin include/linux/seqlock.h:113 [inline]
    > RIP: 0010:raw_read_seqcount_begin include/linux/seqlock.h:148 [inline]
    > RIP: 0010:hrtimer_active+0x1fb/0x440 kernel/time/hrtimer.c:1327
    > Call Trace:
    > Code:
    > __dump_stack lib/dump_stack.c:77 [inline]
    > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
    > ff
    > 80
    > 38
    > 00
    > 0f
    > print_address_description+0x6c/0x20b mm/kasan/report.c:256
    > 85
    > f3
    > kasan_report_error mm/kasan/report.c:354 [inline]
    > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
    > 01
    > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
    > 00
    > locks_inode include/linux/fs.h:1061 [inline]
    > locks_remove_posix+0x787/0x890 fs/locks.c:2468
    > 00 48
    > 8b
    > 85
    > f0 fe
    > ff
    > ff 4c
    > 8d
    > 6b
    > 10
    > 48
    > 89
    > 9d
    > 58
    > ff
    > ff
    > ff
    > c6
    > filp_close+0x1bb/0x250 fs/open.c:1182
    > 00
    > f8
    > 4c
    > 89
    > close_files fs/file.c:388 [inline]
    > put_files_struct+0x26f/0x3a0 fs/file.c:416
    > e8
    > 48
    > c1
    > e8
    > exit_files+0x83/0xb0 fs/file.c:445
    > 03
    > do_exit+0xf61/0x2750 kernel/exit.c:860
    > 41
    > c6
    > 06
    > 04
    > <42>
    > 0f
    > b6
    > 14
    > 38
    > 4c
    > 89
    > e8
    > 83
    > e0
    > 07
    > 83
    > c0
    > 03
    > 38
    > d0
    > 7c
    > 08
    > 84
    > d2
    > 0f
    > 85
    > RSP: 0018:ffff8801dae07850 EFLAGS: 00010002
    > RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffffffff8158c5a9
    > RDX: 0000000000010000 RSI: ffffffff816a4140 RDI: ffff8801b688e3d0
    > RBP: ffff8801dae07990 R08: ffff8801dae07968 R09: fffffbfff02be35c
    > R10: fffffbfff02be35d R11: ffffffff815f1aeb R12: ffff8801b688d730
    > R13: 0000000000000010 R14: ffffed003b5c0f15 R15: dffffc0000000000
    > FS: 00000000024e2880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    > CR2: 00007f8e1116ce78 CR3: 00000001c4e12000 CR4: 00000000001406f0
    > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    > Call Trace:
    > <IRQ>
    > do_group_exit+0x177/0x440 kernel/exit.c:968
    > entity_tick kernel/sched/fair.c:4520 [inline]
    > task_tick_fair+0x60/0x320 kernel/sched/fair.c:9934
    > get_signal+0x88e/0x1970 kernel/signal.c:2468
    > scheduler_tick+0x18b/0x430 kernel/sched/core.c:3087
    > do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
    > update_process_times+0x51/0x70 kernel/time/timer.c:1641
    > tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
    > tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
    > __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
    > __hrtimer_run_queues+0x3eb/0x10c0 kernel/time/hrtimer.c:1460
    > exit_to_usermode_loop+0x2e0/0x370 arch/x86/entry/common.c:162
    > prepare_exit_to_usermode+0x342/0x3b0 arch/x86/entry/common.c:197
    > hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
    > local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
    > smp_apic_timer_interrupt+0x165/0x730 arch/x86/kernel/apic/apic.c:1050
    > retint_user+0x8/0x18
    > RIP: 0033:lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924
    > Code:
    > 10
    > 49
    > c1
    > e9
    > apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
    > 09
    > </IRQ>
    > 41
    > Modules linked in:
    > 57
    > 49 83 f1
    > Dumping ftrace buffer:
    > 01
    > (ftrace buffer empty)
    > 48
    > ---[ end trace e84c0149ab776256 ]---
    > 8b
    > RIP: 0010:__read_seqcount_begin include/linux/seqlock.h:113 [inline]
    > RIP: 0010:raw_read_seqcount_begin include/linux/seqlock.h:148 [inline]
    > RIP: 0010:hrtimer_active+0x1fb/0x440 kernel/time/hrtimer.c:1327
    > bd
    > Code:
    > 30 ff
    > ff
    > ff
    > 80
    > ff
    > 38
    > 8b
    > 00
    > b5
    > 0f
    > 2c
    > 85
    > ff
    > f3
    > ff
    > 01
    > ff
    > 00
    > 41
    > 00
    > 83
    > 48
    > e1
    > 8b
    > 01
    > 85
    > 65
    > f0 fe
    > 4c
    > ff
    > 8b
    > ff
    > 24
    > 4c
    > 25
    > 8d
    > 40
    > 6b
    > ee
    > 10
    > 01
    > 48
    > 00
    > 89
    > e8
    > 9d
    > dc
    > 58
    > 8e
    > ff
    > ff
    > ff
    > ff
    > ff
    > <49>
    > c6
    > 8d
    > 00
    > bc
    > f8
    > 24
    > 4c
    > 34
    > 89
    > 08
    > e8
    > 00
    > 48
    > 00
    > c1 e8
    > 48
    > 03
    > b8
    > 41
    > 00
    > c6
    > 00
    > 06
    > 00 00
    > 04
    > 00
    > <42>
    > fc
    > 0f
    > ff
    > b6
    > df 48
    > 14
    > 89
    > 38
    > fa
    > 4c 89
    > 48
    > e8
    > 83
    > RSP: 002b:00007ffe727cd790 EFLAGS: 00010217
    > e0
    > 07
    > RAX: 0000000000000000 RBX: 00007ffe727cd8c0 RCX: 0000000000473990
    > 83
    > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffe727cd790
    > c0
    > RBP: 0000000000001eb0 R08: 0000000000000001 R09: 00000000024e2880
    > 03
    > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001eb0
    > 38 d0
    > R13: 00000000000233be R14: 00007ffe727cd8e8 R15: 0000000000000003
    > 7c
    >
    > 08
    > Allocated by task 4466:
    > 84
    > save_stack+0x43/0xd0 mm/kasan/kasan.c:448
    > d2
    > set_track mm/kasan/kasan.c:460 [inline]
    > kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
    > 0f
    > kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
    > 85
    > kmem_cache_alloc+0x12e/0x760 mm/slab.c:3554
    > __d_alloc+0xc8/0xd50 fs/dcache.c:1616
    > RSP: 0018:ffff8801dae07850 EFLAGS: 00010002
    > d_alloc_pseudo+0x1d/0x30 fs/dcache.c:1744
    > create_pipe_files+0x42c/0x950 fs/pipe.c:753
    > RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffffffff8158c5a9
    > __do_pipe_flags+0x45/0x250 fs/pipe.c:802
    > RDX: 0000000000010000 RSI: ffffffff816a4140 RDI: ffff8801b688e3d0
    > do_pipe2+0x9d/0x310 fs/pipe.c:850
    > RBP: ffff8801dae07990 R08: ffff8801dae07968 R09: fffffbfff02be35c
    > __do_sys_pipe fs/pipe.c:873 [inline]
    > __se_sys_pipe fs/pipe.c:871 [inline]
    > __x64_sys_pipe+0x33/0x40 fs/pipe.c:871
    > R10: fffffbfff02be35d R11: ffffffff815f1aeb R12: ffff8801b688d730
    > do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
    > R13: 0000000000000010 R14: ffffed003b5c0f15 R15: dffffc0000000000
    > entry_SYSCALL_64_after_hwframe+0x49/0xbe
    > FS: 00000000024e2880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
    >
    > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    > CR2: 00007f8e1116ce78 CR3: 00000001c4e12000 CR4: 00000000001406f0
    > Freed by task 0:
    > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    > (stack is not available)
    > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    >
    >
    >
    > ---
    > This bug is generated by a bot. It may contain errors.
    > See https://goo.gl/tpsmEJ for more information about syzbot.
    > syzbot engineers can be reached at syzkaller@googlegroups.com.
    >
    > syzbot will keep track of this bug report. See:
    > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
    > syzbot.
    > syzbot can test patches for this bug, for details see:
    > https://goo.gl/tpsmEJ#testing-patches
    >
    > --
    > You received this message because you are subscribed to the Google Groups
    > "syzkaller-bugs" group.
    > To unsubscribe from this group and stop receiving emails from it, send an
    > email to syzkaller-bugs+unsubscribe@googlegroups.com.
    > To view this discussion on the web visit
    > https://groups.google.com/d/msgid/syzkaller-bugs/00000000000037578b057186966f%40google.com.
    > For more options, visit https://groups.google.com/d/optout.

    \
     
     \ /
      Last update: 2018-07-23 08:00    [W:3.740 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site