From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E902C43603 for ; Thu, 5 Dec 2019 11:27:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6FA7920707 for ; Thu, 5 Dec 2019 11:27:50 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="HcygGCX6" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729286AbfLEL1t (ORCPT ); Thu, 5 Dec 2019 06:27:49 -0500 Received: from mail-qv1-f67.google.com ([209.85.219.67]:41358 "EHLO mail-qv1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729117AbfLEL1t (ORCPT ); Thu, 5 Dec 2019 06:27:49 -0500 Received: by mail-qv1-f67.google.com with SMTP id b18so1127495qvo.8 for ; Thu, 05 Dec 2019 03:27:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RN4UxK4XX/wD+FOSD/QSslR64zPY0NoSPi7sfqEDTcg=; b=HcygGCX60Afhxpnw9ZYlpuKkkt5wdM44SN/KOzDuDxVXQAJYVla5vHk6t3E4umUT94 WY3Uy/DUPWgjn0jDpNuvlQTfbRf6E7c08Qp9KQdy8d9VELeRNDHm65ZdVHDB3uZSyxM7 eHufFLkzIjwZBrX6+UXDf4ik+qPNtMwBIdCqJDm4sA2uNoBYHBhVnpbaMdg/VJS1UEn8 AM0jTK3oFUhIZANAHf2pmaFrBnf0iz7jtAqeryjk6H+rOQm8s1DrQnC4hXGmy2QVdwbA KebmWYKIj3F0ms5Jw0G2v2v3JX7QX7bocZ4OdEkrQzuV2CoGugRaRRbvp9/fH59JF56p S+Zw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RN4UxK4XX/wD+FOSD/QSslR64zPY0NoSPi7sfqEDTcg=; b=KVsbdYMG0SflTkiglmD36Nq7RXqJz0xPm/1byHzth7FDXhC8Mt6Q6ez3a+GEYd8jwo FHYU5gvDctWWm8Q98rLfGlPJcmNcX8VG0Luo6daUQNfQEfLTq0Sey9OlXJItiJZmE6u9 ypZ4H7BylLRc+v+krbRjM8XgmYAf7TrBC8oyIzENFWmpGwB85ChfejMhr3a7xhSzUcaE c6rDL5N3Y8Vc2vsWhtWjhqBLt34/IqLjpbNJ2gZC/24AcOqQ+mWk9ud06Za68iX1KHeN uQKAKkCmwCENqP5mSR7U+N4GZXZiRVAa7yBamhgovc66KP9t5eJIEnHL0aKPlReKH4Ap pOGQ== X-Gm-Message-State: APjAAAWPhCN0sKSm5KCAgVXIFwqEwmhYEXukMpwaTojPCaZkl+ZL7j6k RG20xQvL96QxSouNabX6VOG3t3QJBKm3uNWuQXvgAQ== X-Google-Smtp-Source: APXvYqxH9YNJe5L8BxMqoB1aZ+mLyrbeKewaHX+sfn84IGKLFUtHvCbxNr7Nz7Mt9VNZMqmAAHeTZG/lcpsKaNbOTFE= X-Received: by 2002:a0c:f8d1:: with SMTP id h17mr7099085qvo.80.1575545267533; Thu, 05 Dec 2019 03:27:47 -0800 (PST) MIME-Version: 1.0 References: <0000000000003e640e0598e7abc3@google.com> <41c082f5-5d22-d398-3bdd-3f4bf69d7ea3@redhat.com> In-Reply-To: From: Dmitry Vyukov Date: Thu, 5 Dec 2019 12:27:35 +0100 Message-ID: Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font To: Paolo Bonzini Cc: syzbot , Andrey Ryabinin , Bartlomiej Zolnierkiewicz , Daniel Thompson , Daniel Vetter , DRI , ghalat@redhat.com, Gleb Natapov , gwshan@linux.vnet.ibm.com, "H. Peter Anvin" , James Morris , kasan-dev , KVM list , Linux Fbdev development list , LKML , linux-security-module , Maarten Lankhorst , Ingo Molnar , Michael Ellerman , Tetsuo Handa , Russell Currey , Sam Ravnborg , "Serge E. Hallyn" , stewart@linux.vnet.ibm.com, syzkaller-bugs , Kentaro Takeda , Thomas Gleixner , "the arch/x86 maintainers" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Dec 5, 2019 at 11:53 AM Paolo Bonzini wrote: > > On 05/12/19 11:31, Dmitry Vyukov wrote: > >> Ah, and because the machine is a KVM guest, kvm_wait appears in a lot of > >> backtrace and I get to share syzkaller's joy every time. :) > > I don't see any mention of "kvm" in the crash report. > > It's there in the stack trace, not sure if this is what triggered my Cc: > > [] kvm_wait+0xca/0xe0 arch/x86/kernel/kvm.c:612 > > Paolo Oh, you mean the final bisection crash. Indeed it contains a kvm frame and it turns out to be a bug in syzkaller code that indeed misattributed it to kvm instead of netfilter. Should be fixed now, you may read the commit message for details: https://github.com/google/syzkaller/commit/4fb74474cf0af2126be3a8989d770c3947ae9478 Overall this "making sense out of kernel output" task is the ultimate insanity, you may skim through this file to get a taste of amount of hardcoding and special corner cases that need to be handled: https://github.com/google/syzkaller/blob/master/pkg/report/linux.go And this is never done, such "exception from exception corner case" things pop up every week. There is always something to shuffle and tune. It only keeps functioning due to 500+ test cases for all possible insane kernel outputs: https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/report https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/guilty So thanks for persisting and questioning! We are getting better with each new test. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dmitry Vyukov Date: Thu, 05 Dec 2019 11:27:35 +0000 Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font Message-Id: List-Id: References: <0000000000003e640e0598e7abc3@google.com> <41c082f5-5d22-d398-3bdd-3f4bf69d7ea3@redhat.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Paolo Bonzini Cc: Linux Fbdev development list , KVM list , Tetsuo Handa , Daniel Vetter , "H. Peter Anvin" , DRI , ghalat@redhat.com, Russell Currey , Sam Ravnborg , syzbot , Kentaro Takeda , stewart@linux.vnet.ibm.com, Daniel Thompson , Michael Ellerman , the arch/x86 maintainers , James Morris , kasan-dev , Ingo Molnar , Andrey Ryabinin , "Serge E. Hallyn" , Bartlomiej Zolnierkiewicz , Gleb Natapov , syzkaller-bugs , gwshan@linux.vnet.ibm.com, Thomas Gleixner , LKML , linux-security-module On Thu, Dec 5, 2019 at 11:53 AM Paolo Bonzini wrote: > > On 05/12/19 11:31, Dmitry Vyukov wrote: > >> Ah, and because the machine is a KVM guest, kvm_wait appears in a lot of > >> backtrace and I get to share syzkaller's joy every time. :) > > I don't see any mention of "kvm" in the crash report. > > It's there in the stack trace, not sure if this is what triggered my Cc: > > [] kvm_wait+0xca/0xe0 arch/x86/kernel/kvm.c:612 > > Paolo Oh, you mean the final bisection crash. Indeed it contains a kvm frame and it turns out to be a bug in syzkaller code that indeed misattributed it to kvm instead of netfilter. Should be fixed now, you may read the commit message for details: https://github.com/google/syzkaller/commit/4fb74474cf0af2126be3a8989d770c3947ae9478 Overall this "making sense out of kernel output" task is the ultimate insanity, you may skim through this file to get a taste of amount of hardcoding and special corner cases that need to be handled: https://github.com/google/syzkaller/blob/master/pkg/report/linux.go And this is never done, such "exception from exception corner case" things pop up every week. There is always something to shuffle and tune. It only keeps functioning due to 500+ test cases for all possible insane kernel outputs: https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/report https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/guilty So thanks for persisting and questioning! We are getting better with each new test. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69664C2D0B1 for ; Fri, 6 Dec 2019 08:18:14 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 468D72467A for ; Fri, 6 Dec 2019 08:18:14 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 468D72467A Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 367A16F974; Fri, 6 Dec 2019 08:17:39 +0000 (UTC) Received: from mail-qv1-xf42.google.com (mail-qv1-xf42.google.com [IPv6:2607:f8b0:4864:20::f42]) by gabe.freedesktop.org (Postfix) with ESMTPS id D2F276E056 for ; Thu, 5 Dec 2019 11:27:48 +0000 (UTC) Received: by mail-qv1-xf42.google.com with SMTP id t7so1135861qve.4 for ; Thu, 05 Dec 2019 03:27:48 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=RN4UxK4XX/wD+FOSD/QSslR64zPY0NoSPi7sfqEDTcg=; b=tmsdWJ1K6lqN937Nq18LP+xTwd3N0pCdcJ5C/7CA65rIqDoMMaiaa6uG2Rbk6ux0yf CYDRTXqWbzVXT5ARbrpMxlVvS2fers5qnY5M8fxOqGHZGDtTMybCaeHNry9wOU8nKkZ1 qBuqtjO50W+c2JFZwB85xrC1VRrrIcC1prZgnJKMcLuoBi4R8VVP1n9PWNXKwd4COlOe q/taS/o4aPyYCtroP2nkYxN7JqZUiEgDfNJ1jObGwU2OZvwmDYknCu7JKt2Rsk+oogJ6 NahJOxSlRclCirWCX4PoHqhkDLWYFrWWlrTCQa9mbB5r4g7Wbgm/x5dOWyVh2FHg55MA ebdQ== X-Gm-Message-State: APjAAAWvb0DpFHFBsRFoaefkpHurO1JTJaUODRxD1S29FkgVZbRGmMOj wPaclnnwnbscHVfdmqOlLnkY1dpFwYmNfDxM9MiGNQ== X-Google-Smtp-Source: APXvYqxH9YNJe5L8BxMqoB1aZ+mLyrbeKewaHX+sfn84IGKLFUtHvCbxNr7Nz7Mt9VNZMqmAAHeTZG/lcpsKaNbOTFE= X-Received: by 2002:a0c:f8d1:: with SMTP id h17mr7099085qvo.80.1575545267533; Thu, 05 Dec 2019 03:27:47 -0800 (PST) MIME-Version: 1.0 References: <0000000000003e640e0598e7abc3@google.com> <41c082f5-5d22-d398-3bdd-3f4bf69d7ea3@redhat.com> In-Reply-To: From: Dmitry Vyukov Date: Thu, 5 Dec 2019 12:27:35 +0100 Message-ID: Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font To: Paolo Bonzini X-Mailman-Approved-At: Fri, 06 Dec 2019 08:17:34 +0000 X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=RN4UxK4XX/wD+FOSD/QSslR64zPY0NoSPi7sfqEDTcg=; b=HcygGCX60Afhxpnw9ZYlpuKkkt5wdM44SN/KOzDuDxVXQAJYVla5vHk6t3E4umUT94 WY3Uy/DUPWgjn0jDpNuvlQTfbRf6E7c08Qp9KQdy8d9VELeRNDHm65ZdVHDB3uZSyxM7 eHufFLkzIjwZBrX6+UXDf4ik+qPNtMwBIdCqJDm4sA2uNoBYHBhVnpbaMdg/VJS1UEn8 AM0jTK3oFUhIZANAHf2pmaFrBnf0iz7jtAqeryjk6H+rOQm8s1DrQnC4hXGmy2QVdwbA KebmWYKIj3F0ms5Jw0G2v2v3JX7QX7bocZ4OdEkrQzuV2CoGugRaRRbvp9/fH59JF56p S+Zw== X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Linux Fbdev development list , KVM list , Tetsuo Handa , Daniel Vetter , "H. Peter Anvin" , DRI , ghalat@redhat.com, Russell Currey , Sam Ravnborg , syzbot , Kentaro Takeda , stewart@linux.vnet.ibm.com, Daniel Thompson , Michael Ellerman , the arch/x86 maintainers , James Morris , kasan-dev , Ingo Molnar , Andrey Ryabinin , "Serge E. Hallyn" , Bartlomiej Zolnierkiewicz , Gleb Natapov , syzkaller-bugs , gwshan@linux.vnet.ibm.com, Thomas Gleixner , LKML , linux-security-module Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" T24gVGh1LCBEZWMgNSwgMjAxOSBhdCAxMTo1MyBBTSBQYW9sbyBCb256aW5pIDxwYm9uemluaUBy ZWRoYXQuY29tPiB3cm90ZToKPgo+IE9uIDA1LzEyLzE5IDExOjMxLCBEbWl0cnkgVnl1a292IHdy b3RlOgo+ID4+IEFoLCBhbmQgYmVjYXVzZSB0aGUgbWFjaGluZSBpcyBhIEtWTSBndWVzdCwga3Zt X3dhaXQgYXBwZWFycyBpbiBhIGxvdCBvZgo+ID4+IGJhY2t0cmFjZSBhbmQgSSBnZXQgdG8gc2hh cmUgc3l6a2FsbGVyJ3Mgam95IGV2ZXJ5IHRpbWUuIDopCj4gPiBJIGRvbid0IHNlZSBhbnkgbWVu dGlvbiBvZiAia3ZtIiBpbiB0aGUgY3Jhc2ggcmVwb3J0Lgo+Cj4gSXQncyB0aGVyZSBpbiB0aGUg c3RhY2sgdHJhY2UsIG5vdCBzdXJlIGlmIHRoaXMgaXMgd2hhdCB0cmlnZ2VyZWQgbXkgQ2M6Cj4K PiAgWzxmZmZmZmZmZjgxMGM3YzNhPl0ga3ZtX3dhaXQrMHhjYS8weGUwIGFyY2gveDg2L2tlcm5l bC9rdm0uYzo2MTIKPgo+IFBhb2xvCgoKT2gsIHlvdSBtZWFuIHRoZSBmaW5hbCBiaXNlY3Rpb24g Y3Jhc2guIEluZGVlZCBpdCBjb250YWlucyBhIGt2bSBmcmFtZQphbmQgaXQgdHVybnMgb3V0IHRv IGJlIGEgYnVnIGluIHN5emthbGxlciBjb2RlIHRoYXQgaW5kZWVkCm1pc2F0dHJpYnV0ZWQgaXQg dG8ga3ZtIGluc3RlYWQgb2YgbmV0ZmlsdGVyLgpTaG91bGQgYmUgZml4ZWQgbm93LCB5b3UgbWF5 IHJlYWQgdGhlIGNvbW1pdCBtZXNzYWdlIGZvciBkZXRhaWxzOgpodHRwczovL2dpdGh1Yi5jb20v Z29vZ2xlL3N5emthbGxlci9jb21taXQvNGZiNzQ0NzRjZjBhZjIxMjZiZTNhODk4OWQ3NzBjMzk0 N2FlOTQ3OAoKT3ZlcmFsbCB0aGlzICJtYWtpbmcgc2Vuc2Ugb3V0IG9mIGtlcm5lbCBvdXRwdXQi IHRhc2sgaXMgdGhlIHVsdGltYXRlCmluc2FuaXR5LCB5b3UgbWF5IHNraW0gdGhyb3VnaCB0aGlz IGZpbGUgdG8gZ2V0IGEgdGFzdGUgb2YgYW1vdW50IG9mCmhhcmRjb2RpbmcgYW5kIHNwZWNpYWwg Y29ybmVyIGNhc2VzIHRoYXQgbmVlZCB0byBiZSBoYW5kbGVkOgpodHRwczovL2dpdGh1Yi5jb20v Z29vZ2xlL3N5emthbGxlci9ibG9iL21hc3Rlci9wa2cvcmVwb3J0L2xpbnV4LmdvCkFuZCB0aGlz IGlzIG5ldmVyIGRvbmUsIHN1Y2ggImV4Y2VwdGlvbiBmcm9tIGV4Y2VwdGlvbiBjb3JuZXIgY2Fz ZSIKdGhpbmdzIHBvcCB1cCBldmVyeSB3ZWVrLiBUaGVyZSBpcyBhbHdheXMgc29tZXRoaW5nIHRv IHNodWZmbGUgYW5kCnR1bmUuIEl0IG9ubHkga2VlcHMgZnVuY3Rpb25pbmcgZHVlIHRvIDUwMCsg dGVzdCBjYXNlcyBmb3IgYWxsCnBvc3NpYmxlIGluc2FuZSBrZXJuZWwgb3V0cHV0czoKaHR0cHM6 Ly9naXRodWIuY29tL2dvb2dsZS9zeXprYWxsZXIvdHJlZS9tYXN0ZXIvcGtnL3JlcG9ydC90ZXN0 ZGF0YS9saW51eC9yZXBvcnQKaHR0cHM6Ly9naXRodWIuY29tL2dvb2dsZS9zeXprYWxsZXIvdHJl ZS9tYXN0ZXIvcGtnL3JlcG9ydC90ZXN0ZGF0YS9saW51eC9ndWlsdHkKClNvIHRoYW5rcyBmb3Ig cGVyc2lzdGluZyBhbmQgcXVlc3Rpb25pbmchIFdlIGFyZSBnZXR0aW5nIGJldHRlciB3aXRoCmVh Y2ggbmV3IHRlc3QuCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9y ZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RyaS1kZXZl bA==