Re: KASAN: stack-out-of-bounds Read in vma_interval_tree_insert (2)
On Tue, Jul 24, 2018 at 9:28 AM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:8ae71e76cf1f Merge branch 'bpf-offload-sharing' > git tree: bpf-next > console output: https://syzkaller.appspot.com/x/log.txt?x=17fca5d040 > kernel config: https://syzkaller.appspot.com/x/.config?x=89129667b46496c3 > dashboard link: https://syzkaller.appspot.com/bug?extid=e64265a0e24946cf1c0d > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+e64265a0e24946cf1...@syzkaller.appspotmail.com #syz fix: bpf: sockhash, disallow bpf_tcp_close and update in parallel > skbuff: bad partial csum: csum=256/65280 len=851 > == > BUG: KASAN: stack-out-of-bounds in vma_interval_tree_insert+0x23e/0x2a0 > mm/interval_tree.c:24 > [ cut here ] > Read of size 8 at addr 8801cf1778d8 by task blkid/6772 > do_IRQ(): syz-executor2 has overflown the kernel stack > (cur:8801cf19,sp:8801ce38e2d8,irq stk > top-bottom:8801daf00080-8801daf08000,exception stk > top-bottom:fe038080-fe042000,ip:__x86_indirect_thunk_rax+0x10/0x20) > > WARNING: CPU: 1 PID: 6760 at arch/x86/kernel/irq_64.c:63 > stack_overflow_check arch/x86/kernel/irq_64.c:60 [inline] > WARNING: CPU: 1 PID: 6760 at arch/x86/kernel/irq_64.c:63 > handle_irq+0x1fb/0x2e7 arch/x86/kernel/irq_64.c:72 > CPU: 0 PID: 6772 Comm: blkid Not tainted 4.18.0-rc3+ #58 > Kernel panic - not syncing: panic_on_warn set ... > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 > vma_interval_tree_insert+0x23e/0x2a0 mm/interval_tree.c:24 > __vma_link_file+0xe4/0x1b0 mm/mmap.c:599 > vma_link+0xcd/0x170 mm/mmap.c:625 > mmap_region+0xe69/0x1890 mm/mmap.c:1785 > do_mmap+0xa06/0x1320 mm/mmap.c:1535 > do_mmap_pgoff include/linux/mm.h:2287 [inline] > vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357 > ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585 > __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] > __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] > __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 > do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x7f5b200f43ea > Code: > blkid: Corrupted page table at address 7f5b200f43c0 > PGD 1cf3f8067 P4D 1cf3f8067 PUD 1ce8fb067 PMD 41b58ab3 > Bad pagetable: 0009 [#1] SMP KASAN > CPU: 0 PID: 6772 Comm: blkid Not tainted 4.18.0-rc3+ #58 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 > arch/x86/lib/copy_user_64.S:180 > Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f > 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f > 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 > RSP: 0018:8801a92af4f0 EFLAGS: 00010046 > RAX: RBX: 8801a92af530 RCX: 0040 > RDX: 0040 RSI: 7f5b200f43c0 RDI: 8801a92af530 > RBP: 8801a92af520 R08: 8801cae44480 R09: ed0035255ea6 > R10: ed0035255ead R11: 8801a92af56f R12: 0040 > R13: 7000 R14: 7f5b200f43c0 R15: 8801cae44480 > FS: () GS:8801dae0() knlGS: > CS: 0010 DS: ES: CR0: 80050033 > CR2: 7f5b200f43c0 CR3: 0001caa5c000 CR4: 001406f0 > DR0: DR1: DR2: > DR3: DR6: fffe0ff0 DR7: 0400 > Call Trace: > show_opcodes+0x44/0xbe arch/x86/kernel/dumpstack.c:104 > show_ip+0x35/0x3a arch/x86/kernel/dumpstack.c:125 > show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:130 > __show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:72 > show_regs_if_on_stack.constprop.10+0x36/0x39 > arch/x86/kernel/dumpstack.c:148 > show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:273 > show_stack+0x38/0x3a arch/x86/kernel/dumpstack.c:292 > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 > vma_interval_tree_insert+0x23e/0x2a0 mm/interval_tree.c:24 > __vma_link_file+0xe4/0x1b0 mm/mmap.c:599 >
Re: KASAN: stack-out-of-bounds Read in vma_interval_tree_insert (2)
On Tue, Jul 24, 2018 at 9:28 AM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:8ae71e76cf1f Merge branch 'bpf-offload-sharing' > git tree: bpf-next > console output: https://syzkaller.appspot.com/x/log.txt?x=17fca5d040 > kernel config: https://syzkaller.appspot.com/x/.config?x=89129667b46496c3 > dashboard link: https://syzkaller.appspot.com/bug?extid=e64265a0e24946cf1c0d > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+e64265a0e24946cf1...@syzkaller.appspotmail.com #syz fix: bpf: sockhash, disallow bpf_tcp_close and update in parallel > skbuff: bad partial csum: csum=256/65280 len=851 > == > BUG: KASAN: stack-out-of-bounds in vma_interval_tree_insert+0x23e/0x2a0 > mm/interval_tree.c:24 > [ cut here ] > Read of size 8 at addr 8801cf1778d8 by task blkid/6772 > do_IRQ(): syz-executor2 has overflown the kernel stack > (cur:8801cf19,sp:8801ce38e2d8,irq stk > top-bottom:8801daf00080-8801daf08000,exception stk > top-bottom:fe038080-fe042000,ip:__x86_indirect_thunk_rax+0x10/0x20) > > WARNING: CPU: 1 PID: 6760 at arch/x86/kernel/irq_64.c:63 > stack_overflow_check arch/x86/kernel/irq_64.c:60 [inline] > WARNING: CPU: 1 PID: 6760 at arch/x86/kernel/irq_64.c:63 > handle_irq+0x1fb/0x2e7 arch/x86/kernel/irq_64.c:72 > CPU: 0 PID: 6772 Comm: blkid Not tainted 4.18.0-rc3+ #58 > Kernel panic - not syncing: panic_on_warn set ... > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 > vma_interval_tree_insert+0x23e/0x2a0 mm/interval_tree.c:24 > __vma_link_file+0xe4/0x1b0 mm/mmap.c:599 > vma_link+0xcd/0x170 mm/mmap.c:625 > mmap_region+0xe69/0x1890 mm/mmap.c:1785 > do_mmap+0xa06/0x1320 mm/mmap.c:1535 > do_mmap_pgoff include/linux/mm.h:2287 [inline] > vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357 > ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585 > __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] > __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline] > __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91 > do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x7f5b200f43ea > Code: > blkid: Corrupted page table at address 7f5b200f43c0 > PGD 1cf3f8067 P4D 1cf3f8067 PUD 1ce8fb067 PMD 41b58ab3 > Bad pagetable: 0009 [#1] SMP KASAN > CPU: 0 PID: 6772 Comm: blkid Not tainted 4.18.0-rc3+ #58 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 > arch/x86/lib/copy_user_64.S:180 > Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f > 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f > 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 > RSP: 0018:8801a92af4f0 EFLAGS: 00010046 > RAX: RBX: 8801a92af530 RCX: 0040 > RDX: 0040 RSI: 7f5b200f43c0 RDI: 8801a92af530 > RBP: 8801a92af520 R08: 8801cae44480 R09: ed0035255ea6 > R10: ed0035255ead R11: 8801a92af56f R12: 0040 > R13: 7000 R14: 7f5b200f43c0 R15: 8801cae44480 > FS: () GS:8801dae0() knlGS: > CS: 0010 DS: ES: CR0: 80050033 > CR2: 7f5b200f43c0 CR3: 0001caa5c000 CR4: 001406f0 > DR0: DR1: DR2: > DR3: DR6: fffe0ff0 DR7: 0400 > Call Trace: > show_opcodes+0x44/0xbe arch/x86/kernel/dumpstack.c:104 > show_ip+0x35/0x3a arch/x86/kernel/dumpstack.c:125 > show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:130 > __show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:72 > show_regs_if_on_stack.constprop.10+0x36/0x39 > arch/x86/kernel/dumpstack.c:148 > show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:273 > show_stack+0x38/0x3a arch/x86/kernel/dumpstack.c:292 > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 > vma_interval_tree_insert+0x23e/0x2a0 mm/interval_tree.c:24 > __vma_link_file+0xe4/0x1b0 mm/mmap.c:599 >
