From: Song Liu <song@kernel.org>
To: Aleksandr Nogikh <nogikh@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>,
syzbot <syzbot+2f649ec6d2eea1495a8f@syzkaller.appspotmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Alexei Starovoitov <ast@kernel.org>, bpf <bpf@vger.kernel.org>,
"David S . Miller" <davem@davemloft.net>,
Jesper Dangaard Brouer <hawk@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Martin KaFai Lau <kafai@fb.com>, KP Singh <kpsingh@kernel.org>,
Jakub Kicinski <kuba@kernel.org>,
open list <linux-kernel@vger.kernel.org>,
Networking <netdev@vger.kernel.org>,
Song Liu <songliubraving@fb.com>,
syzkaller-bugs@googlegroups.com, Yonghong Song <yhs@fb.com>
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit_free
Date: Wed, 16 Feb 2022 08:27:26 -0800 [thread overview]
Message-ID: <CAPhsuW6YOv_xjvknt_FPGwDhuCuG5s=7Xt1t-xL2+F6UKsJf-w@mail.gmail.com> (raw)
In-Reply-To: <CANp29Y64wUeARFUn8Z0fjk7duxaZ3bJM2uGuVug_0ZmhGG_UTA@mail.gmail.com>
Hi Aleksandr,
Thanks for your kind reply!
On Wed, Feb 16, 2022 at 1:38 AM Aleksandr Nogikh <nogikh@google.com> wrote:
>
> Hi Song,
>
> Is syzkaller not doing something you expect it to do with this config?
I fixed sshkey in the config, and added a suppression for hsr_node_get_first.
However, I haven't got a repro overnight.
>
> On Wed, Feb 16, 2022 at 2:38 AM Song Liu <song@kernel.org> wrote:
> >
> > On Mon, Feb 14, 2022 at 10:41 PM Song Liu <song@kernel.org> wrote:
> > >
> > > On Mon, Feb 14, 2022 at 3:52 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
> > > >
> > > > Song, ptal.
> > > >
> > > > On 2/14/22 7:45 PM, syzbot wrote:
> > > > > Hello,
> > > > >
> > > > > syzbot found the following issue on:
> > > > >
> > > > > HEAD commit: e5313968c41b Merge branch 'Split bpf_sk_lookup remote_port..
> > > > > git tree: bpf-next
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=10baced8700000
> > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=c40b67275bfe2a58
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f
> >
> > How do I run the exact same syzkaller? I am doing something like
> >
> > ./bin/syz-manager -config qemu.cfg
> >
> > with the cfg file like:
> >
> > {
> > "target": "linux/amd64",
> > "http": ":56741",
> > "workdir": "workdir",
> > "kernel_obj": "linux",
> > "image": "./pkg/mgrconfig/testdata/stretch.img",
>
> This image location looks suspicious - we store some dummy data for
> tests in that folder.
> Instances now run on buildroot-based images, generated with
> https://github.com/google/syzkaller/blob/master/tools/create-buildroot-image.sh
Thanks for the information. I will give it a try.
>
> > "syzkaller": ".",
> > "disable_syscalls": ["keyctl", "add_key", "request_key"],
>
> For our bpf instances, instead of disable_syscalls we use enable_syscalls:
>
> "enable_syscalls": [
> "bpf", "mkdir", "mount$bpf", "unlink", "close",
> "perf_event_open*", "ioctl$PERF*", "getpid", "gettid",
> "socketpair", "sendmsg", "recvmsg", "setsockopt$sock_attach_bpf",
> "socket$kcm", "ioctl$sock_kcm*", "syz_clone",
> "mkdirat$cgroup*", "openat$cgroup*", "write$cgroup*",
> "openat$tun", "write$tun", "ioctl$TUN*", "ioctl$SIOCSIFHWADDR",
> "openat$ppp", "syz_open_procfs$namespace"
> ]
I will try with the same list. Thanks!
Song
>
> > "suppressions": ["some known bug"],
> > "procs": 8,
>
> We usually run with "procs": 6, but it's not that important.
>
> > "type": "qemu",
> > "vm": {
> > "count": 16,
> > "cpu": 2,
> > "mem": 2048,
> > "kernel": "linux/arch/x86/boot/bzImage"
> > }
> > }
>
> Otherwise I don't see any really significant differences.
>
> --
> Best Regards
> Aleksandr
>
> >
> > Is this correct? I am using stretch.img from syzkaller site, and the
> > .config from
> > the link above.
> >
> > Thanks,
> > Song
> >
next prev parent reply other threads:[~2022-02-16 16:27 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-14 18:45 [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit_free syzbot
2022-02-14 23:52 ` Daniel Borkmann
2022-02-15 6:41 ` Song Liu
2022-02-16 1:37 ` Song Liu
2022-02-16 9:38 ` Aleksandr Nogikh
2022-02-16 16:27 ` Song Liu [this message]
2022-02-17 18:32 ` Aleksandr Nogikh
2022-02-17 20:05 ` Song Liu
2022-02-18 20:12 ` Aleksandr Nogikh
2022-07-03 7:57 ` syzbot
2022-07-04 9:04 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPhsuW6YOv_xjvknt_FPGwDhuCuG5s=7Xt1t-xL2+F6UKsJf-w@mail.gmail.com' \
--to=song@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nogikh@google.com \
--cc=songliubraving@fb.com \
--cc=syzbot+2f649ec6d2eea1495a8f@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).