All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com>
To: sdf@google.com
Cc: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
	 daniel@iogearbox.net, davem@davemloft.net, haoluo@google.com,
	hawk@kernel.org,  john.fastabend@gmail.com, jolsa@kernel.org,
	kpsingh@kernel.org,  kuba@kernel.org,
	linux-kernel@vger.kernel.org, llvm@lists.linux.dev,
	 martin.lau@linux.dev, nathan@kernel.org,
	ndesaulniers@google.com,  netdev@vger.kernel.org, sdf@google.com,
	song@kernel.org,  syzkaller-bugs@googlegroups.com,
	trix@redhat.com, yhs@fb.com
Subject: Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_array
Date: Tue, 20 Dec 2022 11:53:00 -0800	[thread overview]
Message-ID: <0000000000007c858705f047c8ae@google.com> (raw)
In-Reply-To: <Y6ISmUxKqXP6VpLS@google.com>

> On 11/28, syzbot wrote:
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    c35bd4e42885 Add linux-next specific files for 20221124
>> git tree:       linux-next
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13369dc5880000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=11e19c740a0b2926
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b1e1f7feb407b56d0355
>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1345a205880000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=124c644b880000
>> 
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/968fee464d14/disk-c35bd4e4.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/4f46fe801b5b/vmlinux-c35bd4e4.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/c2cdf8fb264e/bzImage-c35bd4e4.xz
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com
>> 
>> ==================================================================
>> BUG: KASAN: slab-out-of-bounds in copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
>> Write of size 232 at addr ffff88801ed62600 by task syz-executor990/5290
>> 
>> CPU: 0 PID: 5290 Comm: syz-executor990 Not tainted 6.1.0-rc6-next-20221124-syzkaller #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
>> Call Trace:
>>  <TASK>
>>  __dump_stack lib/dump_stack.c:88 [inline]
>>  dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
>>  print_address_description mm/kasan/report.c:253 [inline]
>>  print_report+0x15e/0x45d mm/kasan/report.c:364
>>  kasan_report+0xbf/0x1f0 mm/kasan/report.c:464
>>  check_region_inline mm/kasan/generic.c:183 [inline]
>>  kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
>>  memcpy+0x3d/0x60 mm/kasan/shadow.c:66
>>  copy_array+0x96/0x100 kernel/bpf/verifier.c:1032
>>  copy_verifier_state+0xa9/0xbe0 kernel/bpf/verifier.c:1210
>>  pop_stack+0x8c/0x2f0 kernel/bpf/verifier.c:1273
>>  do_check kernel/bpf/verifier.c:13733 [inline]
>>  do_check_common+0x372b/0xc5e0 kernel/bpf/verifier.c:15991
>>  do_check_main kernel/bpf/verifier.c:16054 [inline]
>>  bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
>>  bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
>>  __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
>>  __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
>>  __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
>>  __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
>>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>  do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> RIP: 0033:0x7fc18e7bbc29
>> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007ffd8f27a968 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc18e7bbc29
>> RDX: 0000000000000048 RSI: 0000000020000200 RDI: 0000000000000005
>> RBP: 00007fc18e77fdd0 R08: 0000000000000000 R09: 0000000000000000
>> R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fc18e77fe60
>> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
>>  </TASK>
>> 
>> Allocated by task 5290:
>>  kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
>>  kasan_set_track+0x25/0x30 mm/kasan/common.c:52
>>  ____kasan_kmalloc mm/kasan/common.c:376 [inline]
>>  ____kasan_kmalloc mm/kasan/common.c:335 [inline]
>>  __kasan_krealloc+0x145/0x180 mm/kasan/common.c:444
>>  kasan_krealloc include/linux/kasan.h:232 [inline]
>>  __do_krealloc mm/slab_common.c:1348 [inline]
>>  krealloc+0xa8/0x100 mm/slab_common.c:1385
>>  push_jmp_history+0x89/0x260 kernel/bpf/verifier.c:2528
>>  is_state_visited kernel/bpf/verifier.c:13269 [inline]
>>  do_check kernel/bpf/verifier.c:13466 [inline]
>>  do_check_common+0x4b47/0xc5e0 kernel/bpf/verifier.c:15991
>>  do_check_main kernel/bpf/verifier.c:16054 [inline]
>>  bpf_check+0x7371/0xad00 kernel/bpf/verifier.c:16624
>>  bpf_prog_load+0x1543/0x2230 kernel/bpf/syscall.c:2619
>>  __sys_bpf+0x1436/0x4ff0 kernel/bpf/syscall.c:4979
>>  __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
>>  __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
>>  __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5081
>>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>  do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
>>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> 
>> The buggy address belongs to the object at ffff88801ed62600
>>  which belongs to the cache kmalloc-256 of size 256
>> The buggy address is located 0 bytes inside of
>>  256-byte region [ffff88801ed62600, ffff88801ed62700)
>> 
>> The buggy address belongs to the physical page:
>> page:ffffea00007b5880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ed62
>> head:ffffea00007b5880 order:1 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
>> flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
>> raw: 00fff00000010200 ffff888012441b40 ffffea0000809f80 dead000000000002
>> raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
>> page dumped because: kasan: bad access detected
>> page_owner tracks the page as allocated
>> page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 56, tgid 56 (kworker/u4:4), ts 7761288109, free_ts 0
>>  prep_new_page mm/page_alloc.c:2541 [inline]
>>  get_page_from_freelist+0x119c/0x2cd0 mm/page_alloc.c:4293
>>  __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5551
>>  alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
>>  alloc_slab_page mm/slub.c:1833 [inline]
>>  allocate_slab+0x25e/0x350 mm/slub.c:1980
>>  new_slab mm/slub.c:2033 [inline]
>>  ___slab_alloc+0xa91/0x1400 mm/slub.c:3211
>>  __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3310
>>  slab_alloc_node mm/slub.c:3395 [inline]
>>  __kmem_cache_alloc_node+0x1a9/0x430 mm/slub.c:3472
>>  kmalloc_trace+0x26/0x60 mm/slab_common.c:1049
>>  kmalloc include/linux/slab.h:571 [inline]
>>  scsi_probe_and_add_lun+0x3ae/0x34d0 drivers/scsi/scsi_scan.c:1186
>>  __scsi_scan_target+0x21f/0xda0 drivers/scsi/scsi_scan.c:1664
>>  scsi_scan_channel drivers/scsi/scsi_scan.c:1752 [inline]
>>  scsi_scan_channel+0x148/0x1e0 drivers/scsi/scsi_scan.c:1728
>>  scsi_scan_host_selected+0x2e3/0x3b0 drivers/scsi/scsi_scan.c:1781
>>  do_scsi_scan_host+0x1e8/0x260 drivers/scsi/scsi_scan.c:1920
>>  do_scan_async+0x42/0x500 drivers/scsi/scsi_scan.c:1930
>>  async_run_entry_fn+0x9c/0x530 kernel/async.c:127
>>  process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
>> page_owner free stack trace missing
>> 
>> Memory state around the buggy address:
>>  ffff88801ed62500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>  ffff88801ed62580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> >ffff88801ed62600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
>>                                ^
>>  ffff88801ed62680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>  ffff88801ed62700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ==================================================================
>> 
>> 
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>> 
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>> syzbot can test patches for this issue, for details see:
>> https://goo.gl/tpsmEJ#testing-patches
>
> #syz test

want 2 args (repo, branch), got 1


  reply	other threads:[~2022-12-20 19:53 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-28 13:31 [syzbot] KASAN: slab-out-of-bounds Write in copy_array syzbot
2022-12-20 19:52 ` sdf
2022-12-20 19:53   ` syzbot [this message]
2022-12-20 19:56 ` sdf
2022-12-20 20:11   ` syzbot
2022-12-20 21:01 ` sdf
2022-12-20 21:25   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000007c858705f047c8ae@google.com \
    --to=syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=haoluo@google.com \
    --cc=hawk@kernel.org \
    --cc=john.fastabend@gmail.com \
    --cc=jolsa@kernel.org \
    --cc=kpsingh@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=martin.lau@linux.dev \
    --cc=nathan@kernel.org \
    --cc=ndesaulniers@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=sdf@google.com \
    --cc=song@kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=trix@redhat.com \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.