Messages in this thread | | | Date | Thu, 21 Mar 2024 07:39:01 -0700 | Subject | Re: [syzbot] [bpf?] UBSAN: array-index-out-of-bounds in check_stack_range_initialized | From | syzbot <> |
| |
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
ocol family [ 11.721719][ T1] NET: Registered PF_ROSE protocol family [ 11.729719][ T1] NET: Registered PF_AX25 protocol family [ 11.735660][ T1] can: controller area network core [ 11.742759][ T1] NET: Registered PF_CAN protocol family [ 11.748916][ T1] can: raw protocol [ 11.752863][ T1] can: broadcast manager protocol [ 11.757998][ T1] can: netlink gateway - max_hops=1 [ 11.763319][ T1] can: SAE J1939 [ 11.766850][ T1] can: isotp protocol (max_pdu_size 8300) [ 11.773552][ T1] Bluetooth: RFCOMM TTY layer initialized [ 11.779399][ T1] Bluetooth: RFCOMM socket layer initialized [ 11.785432][ T1] Bluetooth: RFCOMM ver 1.11 [ 11.790172][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 11.796312][ T1] Bluetooth: BNEP filters: protocol multicast [ 11.802789][ T1] Bluetooth: BNEP socket layer initialized [ 11.809184][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0 [ 11.815016][ T1] Bluetooth: CMTP socket layer initialized [ 11.820951][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2 [ 11.827828][ T1] Bluetooth: HIDP socket layer initialized [ 11.837659][ T1] NET: Registered PF_RXRPC protocol family [ 11.843508][ T1] Key type rxrpc registered [ 11.848040][ T1] Key type rxrpc_s registered [ 11.853631][ T1] NET: Registered PF_KCM protocol family [ 11.860130][ T1] lec:lane_module_init: lec.c: initialized [ 11.865944][ T1] mpoa:atm_mpoa_init: mpc.c: initialized [ 11.872062][ T1] l2tp_core: L2TP core driver, V2.0 [ 11.877329][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0 [ 11.882971][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3) [ 11.889548][ T1] l2tp_netlink: L2TP netlink interface [ 11.895277][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3) [ 11.902381][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3) [ 11.910064][ T1] NET: Registered PF_PHONET protocol family [ 11.916248][ T1] 8021q: 802.1Q VLAN Support v1.8 [ 11.934795][ T1] DCCP: Activated CCID 2 (TCP-like) [ 11.940297][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control) [ 11.947385][ T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 11.958542][ T1] sctp: Hash tables configured (bind 32/56) [ 11.966039][ T1] NET: Registered PF_RDS protocol family [ 11.972547][ T1] Registered RDS/infiniband transport [ 11.979222][ T1] Registered RDS/tcp transport [ 11.984224][ T1] tipc: Activated (version 2.0.0) [ 11.990037][ T1] NET: Registered PF_TIPC protocol family [ 11.996601][ T1] tipc: Started in single node mode [ 12.002800][ T1] NET: Registered PF_SMC protocol family [ 12.009698][ T1] 9pnet: Installing 9P2000 support [ 12.015903][ T1] NET: Registered PF_CAIF protocol family [ 12.026175][ T1] NET: Registered PF_IEEE802154 protocol family [ 12.032826][ T1] Key type dns_resolver registered [ 12.038192][ T1] Key type ceph registered [ 12.043168][ T1] libceph: loaded (mon/osd proto 15/24) [ 12.050090][ T1] batman_adv: B.A.T.M.A.N. advanced 2024.1 (compatibility version 15) loaded [ 12.060608][ T1] openvswitch: Open vSwitch switching datapath [ 12.070242][ T1] NET: Registered PF_VSOCK protocol family [ 12.076372][ T1] mpls_gso: MPLS GSO support [ 12.097330][ T1] IPI shorthand broadcast: enabled [ 12.102869][ T1] AVX2 version of gcm_enc/dec engaged. [ 12.108892][ T1] AES CTR mode by8 optimization enabled [ 13.500244][ T1] sched_clock: Marking stable (13460031426, 37162474)->(13499967596, -2773696) [ 13.516849][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level [ 13.528203][ T1] registered taskstats version 1 [ 13.534887][ T1] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI [ 13.547040][ T1] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 13.555448][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-syzkaller-05231-ga51cd6bf8e10-dirty #0 [ 13.565246][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 13.575304][ T1] RIP: 0010:check_helper_call+0x113d/0x76b0 [ 13.581246][ T1] Code: 48 8d bc 24 70 01 00 00 e8 a0 fb 4c 00 4c 8b b4 24 70 01 00 00 49 8d 7e 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 33 59 00 00 45 8b 66 1c 49 8d 7e 20 48 89 [ 13.601839][ T1] RSP: 0000:ffffc90000066000 EFLAGS: 00010207 [ 13.607897][ T1] RAX: 0000000000000003 RBX: 0000000000000000 RCX: dffffc0000000000 [ 13.615863][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001c [ 13.623838][ T1] RBP: ffffc90000066250 R08: ffffffff81ab3c9e R09: ffffffff81ab66aa [ 13.631800][ T1] R10: 0000000000000002 R11: ffff8880162d0000 R12: ffffffff8baff368 [ 13.639935][ T1] R13: 1ffff9200000cc28 R14: 0000000000000000 R15: dffffc0000000000 [ 13.648268][ T1] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 [ 13.660039][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.666609][ T1] CR2: ffff88823ffff000 CR3: 000000000df32000 CR4: 00000000003506f0 [ 13.674655][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 13.682811][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 13.690867][ T1] Call Trace: [ 13.694157][ T1] <TASK> [ 13.697082][ T1] ? __die_body+0x88/0xe0 [ 13.701706][ T1] ? die_addr+0x108/0x140 [ 13.706041][ T1] ? exc_general_protection+0x3dd/0x5d0 [ 13.711612][ T1] ? asm_exc_general_protection+0x26/0x30 [ 13.717553][ T1] ? check_helper_call+0x36ba/0x76b0 [ 13.723267][ T1] ? check_helper_call+0xcae/0x76b0 [ 13.728546][ T1] ? check_helper_call+0x113d/0x76b0 [ 13.733831][ T1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 13.739891][ T1] ? __pfx_check_helper_call+0x10/0x10 [ 13.751844][ T1] ? reg_bounds_sanity_check+0x7b2/0xa20 [ 13.757490][ T1] ? tnum_const+0xd/0x20 [ 13.761901][ T1] do_check+0x9e29/0x10530 [ 13.766314][ T1] ? kmalloc_trace+0x1d9/0x360 [ 13.771068][ T1] ? do_check_common+0x190/0x1dd0 [ 13.776172][ T1] ? bpf_check+0x136ab/0x19010 [ 13.780919][ T1] ? kernel_init+0x1d/0x2a0 [ 13.785402][ T1] ? ret_from_fork+0x4b/0x80 [ 13.789980][ T1] ? __pfx_do_check+0x10/0x10 [ 13.794877][ T1] ? mark_reg_not_init+0xd4/0x4b0 [ 13.799933][ T1] ? __asan_memcpy+0x40/0x70 [ 13.804688][ T1] ? mark_reg_not_init+0xd4/0x4b0 [ 13.809695][ T1] do_check_common+0x14bd/0x1dd0 [ 13.814643][ T1] bpf_check+0x136ab/0x19010 [ 13.819224][ T1] ? __pfx_validate_chain+0x10/0x10 [ 13.824407][ T1] ? validate_chain+0x11b/0x58e0 [ 13.829323][ T1] ? validate_chain+0x11b/0x58e0 [ 13.834278][ T1] ? validate_chain+0x11b/0x58e0 [ 13.839287][ T1] ? validate_chain+0x11b/0x58e0 [ 13.844302][ T1] ? __pfx_bpf_check+0x10/0x10 [ 13.849168][ T1] ? __pfx_validate_chain+0x10/0x10 [ 13.854372][ T1] ? mark_lock+0x9a/0x350 [ 13.858697][ T1] ? mark_lock+0x9a/0x350 [ 13.863019][ T1] ? __lock_acquire+0x1346/0x1fd0 [ 13.868213][ T1] ? mark_lock+0x9a/0x350 [ 13.872597][ T1] ? __lock_acquire+0x1346/0x1fd0 [ 13.877768][ T1] ? mark_lock+0x9a/0x350 [ 13.882276][ T1] ? __lock_acquire+0x1346/0x1fd0 [ 13.887379][ T1] ? __pfx_lock_acquire+0x10/0x10 [ 13.892384][ T1] ? ktime_get_with_offset+0x105/0x330 [ 13.897995][ T1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 13.904156][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 13.910768][ T1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 13.917288][ T1] ? ktime_get_with_offset+0x105/0x330 [ 13.922910][ T1] ? seqcount_lockdep_reader_access+0x157/0x220 [ 13.929217][ T1] ? lockdep_hardirqs_on+0x99/0x150 [ 13.934406][ T1] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 13.940657][ T1] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10 [ 13.947674][ T1] ? pcpu_alloc+0xf1a/0x1670 [ 13.952256][ T1] ? bpf_obj_name_cpy+0x18a/0x1d0 [ 13.957261][ T1] ? bpf_lsm_bpf_prog_load+0x9/0x10 [ 13.962451][ T1] ? security_bpf_prog_load+0x87/0xb0 [ 13.967821][ T1] bpf_prog_load+0x1667/0x20f0 [ 13.972819][ T1] ? __pfx_bpf_prog_load+0x10/0x10 [ 13.978234][ T1] ? kasan_quarantine_put+0xdc/0x230 [ 13.983684][ T1] ? map_update_elem+0x363/0x6f0 [ 13.988601][ T1] ? copy_from_kernel_nofault_allowed+0xa9/0x130 [ 13.994944][ T1] ? bpf_lsm_bpf+0x9/0x10 [ 13.999430][ T1] ? security_bpf+0x87/0xb0 [ 14.003930][ T1] __sys_bpf+0x4ee/0x810 [ 14.008173][ T1] ? __pfx___sys_bpf+0x10/0x10 [ 14.012929][ T1] kern_sys_bpf+0x185/0x6b0 [ 14.017420][ T1] ? __pfx_kern_sys_bpf+0x10/0x10 [ 14.022429][ T1] ? load+0xf4/0xfd0 [ 14.026397][ T1] ? kmalloc_trace+0x1d9/0x360 [ 14.031153][ T1] ? load+0x40e/0xfd0 [ 14.035426][ T1] load+0x550/0xfd0 [ 14.039405][ T1] ? __pfx_load+0x10/0x10 [ 14.043720][ T1] ? kasan_save_track+0x51/0x80 [ 14.048558][ T1] ? kasan_save_track+0x3f/0x80 [ 14.053476][ T1] ? __kasan_kmalloc+0x98/0xb0 [ 14.058229][ T1] ? __kmalloc_node+0x251/0x4e0 [ 14.063154][ T1] ? alloc_bulk+0x472/0x6f0 [ 14.067634][ T1] ? bpf_mem_alloc_init+0x47d/0xc50 [ 14.073107][ T1] ? cpumask_kfunc_init+0x98/0x150 [ 14.078385][ T1] ? do_one_initcall+0x238/0x830 [ 14.083663][ T1] ? do_initcall_level+0x157/0x210 [ 14.088981][ T1] ? do_initcalls+0x3f/0x80 [ 14.093672][ T1] ? kernel_init_freeable+0x435/0x5d0 [ 14.099031][ T1] ? kernel_init+0x1d/0x2a0 [ 14.103530][ T1] ? ret_from_fork+0x4b/0x80 [ 14.108136][ T1] ? ret_from_fork_asm+0x1a/0x30 [ 14.113154][ T1] ? mark_lock+0x9a/0x350 [ 14.117670][ T1] ? __lock_acquire+0x1346/0x1fd0 [ 14.122697][ T1] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 14.128591][ T1] ? lockdep_hardirqs_on+0x99/0x150 [ 14.133952][ T1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 14.139832][ T1] ? __pfx_add_device_randomness+0x10/0x10 [ 14.145719][ T1] ? __pfx_load+0x10/0x10 [ 14.150121][ T1] do_one_initcall+0x238/0x830 [ 14.154863][ T1] ? __pfx_load+0x10/0x10 [ 14.159166][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 14.166079][ T1] ? __pfx_do_one_initcall+0x10/0x10 [ 14.171368][ T1] ? __pfx_parse_args+0x10/0x10 [ 14.176223][ T1] ? do_initcalls+0x1c/0x80 [ 14.181017][ T1] ? rcu_is_watching+0x15/0xb0 [ 14.185910][ T1] do_initcall_level+0x157/0x210 [ 14.190924][ T1] do_initcalls+0x3f/0x80 [ 14.195251][ T1] kernel_init_freeable+0x435/0x5d0 [ 14.200463][ T1] ? __pfx_kernel_init_freeable+0x10/0x10 [ 14.206174][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 14.212486][ T1] ? __pfx_kernel_init+0x10/0x10 [ 14.217521][ T1] ? __pfx_kernel_init+0x10/0x10 [ 14.222482][ T1] ? __pfx_kernel_init+0x10/0x10 [ 14.227773][ T1] kernel_init+0x1d/0x2a0 [ 14.232101][ T1] ret_from_fork+0x4b/0x80 [ 14.236503][ T1] ? __pfx_kernel_init+0x10/0x10 [ 14.241421][ T1] ret_from_fork_asm+0x1a/0x30 [ 14.246167][ T1] </TASK> [ 14.249165][ T1] Modules linked in: [ 14.253332][ T1] ---[ end trace 0000000000000000 ]--- [ 14.259150][ T1] RIP: 0010:check_helper_call+0x113d/0x76b0 [ 14.265131][ T1] Code: 48 8d bc 24 70 01 00 00 e8 a0 fb 4c 00 4c 8b b4 24 70 01 00 00 49 8d 7e 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 33 59 00 00 45 8b 66 1c 49 8d 7e 20 48 89 [ 14.285348][ T1] RSP: 0000:ffffc90000066000 EFLAGS: 00010207 [ 14.291474][ T1] RAX: 0000000000000003 RBX: 0000000000000000 RCX: dffffc0000000000 [ 14.299537][ T1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001c [ 14.307519][ T1] RBP: ffffc90000066250 R08: ffffffff81ab3c9e R09: ffffffff81ab66aa [ 14.315662][ T1] R10: 0000000000000002 R11: ffff8880162d0000 R12: ffffffff8baff368 [ 14.323705][ T1] R13: 1ffff9200000cc28 R14: 0000000000000000 R15: dffffc0000000000 [ 14.331703][ T1] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 [ 14.340738][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 14.347336][ T1] CR2: 0000000000000000 CR3: 000000000df32000 CR4: 00000000003506f0 [ 14.355310][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 14.363321][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 14.371501][ T1] Kernel panic - not syncing: Fatal exception [ 14.378082][ T1] Kernel Offset: disabled [ 14.382392][ T1] Rebooting in 86400 seconds..
syzkaller build log: go env (err=<nil>) GO111MODULE='auto' GOARCH='amd64' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFLAGS='' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs-2/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.21.4' GCCGO='gccgo' GOAMD64='v1' AR='ar' CC='gcc' CXX='g++' CGO_ENABLED='1' GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod' GOWORK='' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' PKG_CONFIG='pkg-config' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build516019239=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>) HEAD detached at baa80228d nothing to commit, working tree clean
tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen touch .descriptions GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress mkdir -p ./bin/linux_amd64 gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"baa80228d652d8b1341ecf7f1411c4e4caf75bd5\"
Error text is too large and was truncated, full error text is at: https://syzkaller.appspot.com/x/error.txt?x=15ca4c81180000
Tested on:
commit: a51cd6bf arm64: bpf: fix 32bit unconditional bswap git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 dashboard link: https://syzkaller.appspot.com/bug?extid=33f4297b5f927648741a compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=134ceaa5180000
| |