From: 慕冬亮 <mudongliangabcd@gmail.com> To: andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, Daniel Borkmann <daniel@iogearbox.net>, davem@davemloft.net, hawk@kernel.org, john.fastabend@gmail.com, kafai@fb.com, kpsingh@chromium.org, kuba@kernel.org, linux-kernel <linux-kernel@vger.kernel.org>, mingo@redhat.com, netdev@vger.kernel.org, rostedt@goodmis.org, songliubraving@fb.com, yhs@fb.com, Dmitry Vyukov <dvyukov@google.com> Subject: "KASAN: vmalloc-out-of-bounds Read in bpf_trace_run1/2/3/5" and "BUG: unable to handle kernel paging request in bpf_trace_run1/2/3/4" should share the same root cause Date: Wed, 13 Jan 2021 17:11:39 +0800 Message-ID: <CAD-N9QWcdR5oxt2JJrEowPwddyNTZVfU5iSOXNV+cTy2+TKnuQ@mail.gmail.com> (raw) Hi developers, I found the following cases should share the same root cause: BUG: unable to handle kernel paging request in bpf_trace_run1 BUG: unable to handle kernel paging request in bpf_trace_run2 BUG: unable to handle kernel paging request in bpf_trace_run3 BUG: unable to handle kernel paging request in bpf_trace_run4 KASAN: vmalloc-out-of-bounds Read in bpf_trace_run1 KASAN: vmalloc-out-of-bounds Read in bpf_trace_run2 KASAN: vmalloc-out-of-bounds Read in bpf_trace_run3 KASAN: vmalloc-out-of-bounds Read in bpf_trace_run5 The PoCs after minimization are almost the same except for the different tracepoint arguments. And the difference for "bpf_trace_run1/2/3/4/5" is due to the corresponding tracepoints - "ext4_mballoc_alloc"/"sys_enter"/"sched_switch"/"ext4_ext_show_extent"/"ext4_journal_start". The underlying reason for those cases is the allocation failure in the following trace: tracepoint_probe_unregister tracepoint_remove_func func_remove allocate_probes kmalloc -- My best regards to you. No System Is Safe! Dongliang Mu
reply index Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAD-N9QWcdR5oxt2JJrEowPwddyNTZVfU5iSOXNV+cTy2+TKnuQ@mail.gmail.com \ --to=mudongliangabcd@gmail.com \ --cc=andriin@fb.com \ --cc=ast@kernel.org \ --cc=bpf@vger.kernel.org \ --cc=daniel@iogearbox.net \ --cc=davem@davemloft.net \ --cc=dvyukov@google.com \ --cc=hawk@kernel.org \ --cc=john.fastabend@gmail.com \ --cc=kafai@fb.com \ --cc=kpsingh@chromium.org \ --cc=kuba@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mingo@redhat.com \ --cc=netdev@vger.kernel.org \ --cc=rostedt@goodmis.org \ --cc=songliubraving@fb.com \ --cc=yhs@fb.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
BPF Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \ bpf@vger.kernel.org public-inbox-index bpf Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.bpf AGPL code for this site: git clone https://public-inbox.org/public-inbox.git