From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751923AbdJTOkr (ORCPT ); Fri, 20 Oct 2017 10:40:47 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:48980 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750954AbdJTOkp (ORCPT ); Fri, 20 Oct 2017 10:40:45 -0400 X-Google-Smtp-Source: ABhQp+Qp8cQgAj/QI7BoRpSWCVgEWvNSfHzikUZIF1GEdk4UNnF8Z0vt4OM27QZUQiQNsAKIN0693g== Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Subject: Re: v4.14-rc3/arm64 DABT exception in atomic_inc() / __skb_clone() From: Wei Wei In-Reply-To: <20171020111408.edj24tztxdptte5r@lakrids.cambridge.arm.com> Date: Fri, 20 Oct 2017 10:40:38 -0400 Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, edumazet@google.com, davem@davemloft.net, willemb@google.com, syzkaller@googlegroups.com Message-Id: <960D71EC-C1E9-4898-ACBE-543FC09483FF@gmail.com> References: <20171020111408.edj24tztxdptte5r@lakrids.cambridge.arm.com> To: Mark Rutland X-Mailer: Apple Mail (2.3273) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9KEesBO012426 Sadly, the syzkaller characterized it as a non-reproducible bug and there were empty repro files. But if manually executing in VM like this “./syz-execprog -executor= ./syz-executor -repeat=0 -procs=16 -cover=0 crash-log”, it crashed when executing exactly program 1056 using log0 provided. I failed to generate the C reproducer with syz-repro as it said “no target compiler” in the final step. I would appreciate if you could give some hints. Thanks, Wei > On 20 Oct 2017, at 7:14 AM, Mark Rutland wrote: > > On Thu, Oct 19, 2017 at 10:16:08PM -0400, Wei Wei wrote: >> Hi all, > > Hi, > >> I have fuzzed v4.14-rc3 using syzkaller and found a bug similar to that one [1]. >> But the call trace isn’t the same. The atomic_inc() might handle a corrupted >> skb_buff. >> >> The logs and config have been uploaded to my github repo [2]. >> >> [1] https://lkml.org/lkml/2017/10/2/216 >> [2] https://github.com/dotweiba/skb_clone_atomic_inc_bug > > These do look very similar to what I was hitting; all appear to be > misaligned atomics in the same path. > > I see that you have some empty repro files in [2]. If you have any > reproducers, would you mind sharing them? > > If any of those are smaller or more reliable than the one I was able to > generate [3], it might make it more obvious what's going on, and/or make > it simpler to come up with a plain C reproducer. > > Thanks, > Mark. > > [3] https://www.kernel.org/pub/linux/kernel/people/mark/bugs/20171002-skb_clone-misaligned-atomic/syzkaller.repro From mboxrd@z Thu Jan 1 00:00:00 1970 From: dotweiba@gmail.com (Wei Wei) Date: Fri, 20 Oct 2017 10:40:38 -0400 Subject: v4.14-rc3/arm64 DABT exception in atomic_inc() / __skb_clone() In-Reply-To: <20171020111408.edj24tztxdptte5r@lakrids.cambridge.arm.com> References: <20171020111408.edj24tztxdptte5r@lakrids.cambridge.arm.com> Message-ID: <960D71EC-C1E9-4898-ACBE-543FC09483FF@gmail.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org Sadly, the syzkaller characterized it as a non-reproducible bug and there were empty repro files. But if manually executing in VM like this ?./syz-execprog -executor= ./syz-executor -repeat=0 -procs=16 -cover=0 crash-log?, it crashed when executing exactly program 1056 using log0 provided. I failed to generate the C reproducer with syz-repro as it said ?no target compiler? in the final step. I would appreciate if you could give some hints. Thanks, Wei > On 20 Oct 2017, at 7:14 AM, Mark Rutland wrote: > > On Thu, Oct 19, 2017 at 10:16:08PM -0400, Wei Wei wrote: >> Hi all, > > Hi, > >> I have fuzzed v4.14-rc3 using syzkaller and found a bug similar to that one [1]. >> But the call trace isn?t the same. The atomic_inc() might handle a corrupted >> skb_buff. >> >> The logs and config have been uploaded to my github repo [2]. >> >> [1] https://lkml.org/lkml/2017/10/2/216 >> [2] https://github.com/dotweiba/skb_clone_atomic_inc_bug > > These do look very similar to what I was hitting; all appear to be > misaligned atomics in the same path. > > I see that you have some empty repro files in [2]. If you have any > reproducers, would you mind sharing them? > > If any of those are smaller or more reliable than the one I was able to > generate [3], it might make it more obvious what's going on, and/or make > it simpler to come up with a plain C reproducer. > > Thanks, > Mark. > > [3] https://www.kernel.org/pub/linux/kernel/people/mark/bugs/20171002-skb_clone-misaligned-atomic/syzkaller.repro