From: Yonghong Song <yhs@fb.com>
To: syzbot <syzbot+fad5d91c7158ce568634@syzkaller.appspotmail.com>,
<andrii@kernel.org>, <andriin@fb.com>, <ast@kernel.org>,
<bpf@vger.kernel.org>, <daniel@iogearbox.net>,
<davem@davemloft.net>, <hawk@kernel.org>,
<jakub.kicinski@netronome.com>, <john.fastabend@gmail.com>,
<kafai@fb.com>, <kpsingh@kernel.org>, <kuba@kernel.org>,
<linux-kernel@vger.kernel.org>, <mingo@redhat.com>,
<netdev@vger.kernel.org>, <rostedt@goodmis.org>,
<songliubraving@fb.com>, <syzkaller-bugs@googlegroups.com>,
<xdp-newbies@vger.kernel.org>
Subject: Re: KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
Date: Sat, 23 Jan 2021 11:35:53 -0800 [thread overview]
Message-ID: <d967ff2d-e272-b966-407c-82dca9a08e04@fb.com> (raw)
In-Reply-To: <000000000000891f4605b963d113@google.com>
I can reproduce the issue with C reproducer. This is an old known issue
though and the failure is due to memory allocation failure in
tracepoint_probe_unregister().
[ 40.807849][ T8287] Call Trace:
[ 40.808201][ T8287] dump_stack+0x77/0x97
[ 40.808695][ T8287] should_fail.cold.6+0x32/0x4c
[ 40.809238][ T8287] should_failslab+0x5/0x10
[ 40.809709][ T8287] slab_pre_alloc_hook.constprop.97+0xa0/0xd0
[ 40.810365][ T8287] ? tracepoint_probe_unregister+0xc7/0x2b0
[ 40.810998][ T8287] __kmalloc+0x64/0x210
[ 40.811442][ T8287] ? trace_raw_output_percpu_destroy_chunk+0x40/0x40
[ 40.812158][ T8287] tracepoint_probe_unregister+0xc7/0x2b0
[ 40.812766][ T8287] bpf_raw_tp_link_release+0x11/0x20
[ 40.813328][ T8287] bpf_link_free+0x20/0x40
[ 40.813802][ T8287] bpf_link_release+0xc/0x10
[ 40.814242][ T8287] __fput+0xa1/0x250
[ 40.814606][ T8287] task_work_run+0x68/0xb0
[ 40.815030][ T8287] exit_to_user_mode_prepare+0x22c/0x250
Steven Rostedt has the following pending patch
https://lore.kernel.org/bpf/20201118093405.7a6d2290@gandalf.local.home/
trying to solve this exact problem.
On 1/20/21 11:14 PM, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit 8b401f9ed2441ad9e219953927a842d24ed051fc
> Author: Yonghong Song <yhs@fb.com>
> Date: Thu May 23 21:47:45 2019 +0000
>
> bpf: implement bpf_send_signal() helper
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=123408e7500000
> start commit: 7d68e382 bpf: Permit size-0 datasec
> git tree: bpf-next
> final oops: https://syzkaller.appspot.com/x/report.txt?x=113408e7500000
> console output: https://syzkaller.appspot.com/x/log.txt?x=163408e7500000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e0c7843b8af99dff
> dashboard link: https://syzkaller.appspot.com/bug?extid=fad5d91c7158ce568634
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1224daa4d00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13dfabd0d00000
>
> Reported-by: syzbot+fad5d91c7158ce568634@syzkaller.appspotmail.com
> Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
prev parent reply other threads:[~2021-01-23 19:37 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-05 15:25 KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7 syzbot
2021-01-20 23:09 ` syzbot
2021-01-21 7:14 ` syzbot
2021-01-23 19:35 ` Yonghong Song [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d967ff2d-e272-b966-407c-82dca9a08e04@fb.com \
--to=yhs@fb.com \
--cc=andrii@kernel.org \
--cc=andriin@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hawk@kernel.org \
--cc=jakub.kicinski@netronome.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=songliubraving@fb.com \
--cc=syzbot+fad5d91c7158ce568634@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=xdp-newbies@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).