From: Pengfei Xu <pengfei.xu@intel.com>
To: <jolsa@kernel.org>
Cc: <bpf@vger.kernel.org>, <heng.su@intel.com>,
<pengfei.xu@intel.com>, <andrii@kernel.org>,
<laoar.shao@gmail.com>, <yonghong.song@linux.dev>,
<ast@kernel.org>, <lkp@intel.com>
Subject: [Syzkaller & bisect] There is KASAN: global-out-of-bounds Read in bpf_link_show_fdinfo in v6.7-rc5
Date: Thu, 14 Dec 2023 10:51:12 +0800 [thread overview]
Message-ID: <ZXptoKRSLspnk2ie@xpf.sh.intel.com> (raw)
Hi Jiri Olsa,
Greeting!
There is KASAN: global-out-of-bounds Read in bpf_link_show_fdinfo in v6.7-rc5
kernel in vm.
All detailed info: https://github.com/xupengfe/syzkaller_logs/tree/main/231213_090512_bpf_link_show_fdinfo
Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/231213_090512_bpf_link_show_fdinfo/repro.c
Syzkaller syscall reproduced steps: https://github.com/xupengfe/syzkaller_logs/blob/main/231213_090512_bpf_link_show_fdinfo/repro.prog
Kconfig(make olddefconfig): https://github.com/xupengfe/syzkaller_logs/blob/main/231213_090512_bpf_link_show_fdinfo/kconfig_origin
Bisect info: https://github.com/xupengfe/syzkaller_logs/blob/main/231213_090512_bpf_link_show_fdinfo/bisect_info.log
Issue dmesg: https://github.com/xupengfe/syzkaller_logs/blob/main/231213_090512_bpf_link_show_fdinfo/a39b6ac3781d46ba18193c9dbb2110f31e9bffe9_dmesg.log
bzImage: https://github.com/xupengfe/syzkaller_logs/raw/main/231213_090512_bpf_link_show_fdinfo/bzImage_a39b6ac3781d46ba18193c9dbb2110f31e9bffe9.tar.gz
Bisected and related commit is as follows:
"
0b779b61f651 bpf: Add cookies support for uprobe_multi link
"
Make the revert the commit on top of v6.7-rc5 kernel failed, could not double
confirm for the suspected commit.
[ 20.624445] repro[731]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 0 (core 0, socket 0)
[ 20.625349] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.631427] repro[734]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.632325] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.665797] repro[737]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 0 (core 0, socket 0)
[ 20.666718] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.671614] ==================================================================
[ 20.672115] BUG: KASAN: global-out-of-bounds in bpf_link_show_fdinfo+0x30b/0x330
[ 20.672598] Read of size 8 at addr ffffffff8593c9e0 by task systemd-coredum/732
[ 20.673066]
[ 20.673179] CPU: 0 PID: 732 Comm: systemd-coredum Not tainted 6.7.0-rc5-a39b6ac3781d+ #1
[ 20.673687] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[ 20.674381] Call Trace:
[ 20.674552] <TASK>
[ 20.674701] dump_stack_lvl+0xaa/0x110
[ 20.674964] print_report+0xcf/0x620
[ 20.675209] ? bpf_link_show_fdinfo+0x30b/0x330
[ 20.675514] ? kasan_addr_to_slab+0x11/0xb0
[ 20.675794] ? bpf_link_show_fdinfo+0x30b/0x330
[ 20.676103] kasan_report+0xcd/0x110
[ 20.676342] ? bpf_link_show_fdinfo+0x30b/0x330
[ 20.676651] __asan_report_load8_noabort+0x18/0x20
[ 20.676960] bpf_link_show_fdinfo+0x30b/0x330
[ 20.677253] ? __pfx_bpf_link_show_fdinfo+0x10/0x10
[ 20.677569] ? locks_remove_file+0x6d0/0x790
[ 20.677861] ? __pfx_bpf_link_show_fdinfo+0x10/0x10
[ 20.678169] seq_show+0x581/0x890
[ 20.678402] seq_read_iter+0x51a/0x1300
[ 20.678672] ? iov_iter_init+0x55/0x200
[ 20.678939] seq_read+0x171/0x210
[ 20.679172] ? __pfx_seq_read+0x10/0x10
[ 20.679438] ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30
[ 20.679784] ? fsnotify_perm.part.0+0x260/0x5f0
[ 20.680087] ? security_file_permission+0xc5/0xf0
[ 20.680399] vfs_read+0x202/0x930
[ 20.680626] ? __pfx_seq_read+0x10/0x10
[ 20.680884] ? __pfx_vfs_read+0x10/0x10
[ 20.681137] ? __pfx_lock_release+0x10/0x10
[ 20.681398] ? ktime_get_coarse_real_ts64+0x4d/0xf0
[ 20.681706] ? __this_cpu_preempt_check+0x21/0x30
[ 20.681997] ? seqcount_lockdep_reader_access.constprop.0+0xb4/0xd0
[ 20.682379] ? __sanitizer_cov_trace_const_cmp4+0x1a/0x20
[ 20.682722] ksys_read+0x14f/0x290
[ 20.682956] ? __pfx_ksys_read+0x10/0x10
[ 20.683226] __x64_sys_read+0x7b/0xc0
[ 20.683473] ? syscall_enter_from_user_mode+0x53/0x70
[ 20.683790] do_syscall_64+0x42/0xf0
[ 20.684027] entry_SYSCALL_64_after_hwframe+0x6e/0x76
[ 20.684327] RIP: 0033:0x7f688893eaf2
[ 20.684556] Code: c0 e9 b2 fe ff ff 50 48 8d 3d ca 0c 08 00 e8 35 eb 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
[ 20.685647] RSP: 002b:00007ffde2a29e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 20.686108] RAX: ffffffffffffffda RBX: 0000562b794752d0 RCX: 00007f688893eaf2
[ 20.686527] RDX: 0000000000000400 RSI: 0000562b79475530 RDI: 0000000000000006
[ 20.686964] RBP: 00007f68889f75e0 R08: 0000000000000006 R09: 00007f68889b14e0
[ 20.687401] R10: 0000000000001000 R11: 0000000000000246 R12: 00007f688863c9c8
[ 20.687837] R13: 0000000000000d68 R14: 00007f68889f69e0 R15: 0000000000000d68
[ 20.688309] </TASK>
[ 20.688465]
[ 20.688571] The buggy address belongs to the variable:
[ 20.688885] bpf_link_type_strs+0x60/0x80
[ 20.689145]
[ 20.689251] The buggy address belongs to the physical page:
[ 20.689611] page:00000000449bb84f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x593c
[ 20.690184] flags: 0xfffffc0004000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
[ 20.690601] page_type: 0xffffffff()
[ 20.690824] raw: 000fffffc0004000 ffffea0000164f08 ffffea0000164f08 0000000000000000
[ 20.691307] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 20.691795] page dumped because: kasan: bad access detected
[ 20.692152]
[ 20.692254] Memory state around the buggy address:
[ 20.692552] ffffffff8593c880: 04 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
[ 20.693008] ffffffff8593c900: 00 05 f9 f9 f9 f9 f9 f9 00 03 f9 f9 f9 f9 f9 f9
[ 20.693432] >ffffffff8593c980: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
[ 20.693877] ^
[ 20.694265] ffffffff8593ca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 20.694707] ffffffff8593ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 20.695158] ==================================================================
[ 20.695666] Disabling lock debugging due to kernel taint
[ 20.720062] repro[741]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 0 (core 0, socket 0)
[ 20.720827] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.724913] repro[744]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.725791] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.732282] repro[747]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.733148] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.770165] repro[750]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.771018] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.820152] repro[757]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.820984] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.837880] repro[760]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 1 (core 1, socket 0)
[ 20.838815] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 20.839423] repro[755]: segfault at 0 ip 0000000000000000 sp 0000000020000288 error 14 in repro[400000+1000] likely on CPU 0 (core 0, socket 0)
[ 20.840255] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 21.068187] Pid 786(repro) over core_pipe_limit
[ 21.068503] Skipping core dump
I hope it's helpful.
---
If you don't need the following environment to reproduce the problem or if you
already have one reproduced environment, please ignore the following information.
How to reproduce:
git clone https://gitlab.com/xupengfe/repro_vm_env.git
cd repro_vm_env
tar -xvf repro_vm_env.tar.gz
cd repro_vm_env; ./start3.sh // it needs qemu-system-x86_64 and I used v7.1.0
// start3.sh will load bzImage_2241ab53cbb5cdb08a6b2d4688feb13971058f65 v6.2-rc5 kernel
// You could change the bzImage_xxx as you want
// Maybe you need to remove line "-drive if=pflash,format=raw,readonly=on,file=./OVMF_CODE.fd \" for different qemu version
You could use below command to log in, there is no password for root.
ssh -p 10023 root@localhost
After login vm(virtual machine) successfully, you could transfer reproduced
binary to the vm by below way, and reproduce the problem in vm:
gcc -pthread -o repro repro.c
scp -P 10023 repro root@localhost:/root/
Get the bzImage for target kernel:
Please use target kconfig and copy it to kernel_src/.config
make olddefconfig
make -jx bzImage //x should equal or less than cpu num your pc has
Fill the bzImage file into above start3.sh to load the target kernel in vm.
Tips:
If you already have qemu-system-x86_64, please ignore below info.
If you want to install qemu v7.1.0 version:
git clone https://github.com/qemu/qemu.git
cd qemu
git checkout -f v7.1.0
mkdir build
cd build
yum install -y ninja-build.x86_64
yum -y install libslirp-devel.x86_64
../configure --target-list=x86_64-softmmu --enable-kvm --enable-vnc --enable-gtk --enable-sdl --enable-usb-redir --enable-slirp
make
make install
Best Regards,
Thanks!
next reply other threads:[~2023-12-14 2:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-14 2:51 Pengfei Xu [this message]
2023-12-14 6:33 ` [Syzkaller & bisect] There is KASAN: global-out-of-bounds Read in bpf_link_show_fdinfo in v6.7-rc5 Hou Tao
2023-12-14 8:52 ` Jiri Olsa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZXptoKRSLspnk2ie@xpf.sh.intel.com \
--to=pengfei.xu@intel.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=heng.su@intel.com \
--cc=jolsa@kernel.org \
--cc=laoar.shao@gmail.com \
--cc=lkp@intel.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).