Re: KASAN: slab-out-of-bounds Read in fbcon_get_font

From: Dmitry Vyukov <dvyukov@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: syzbot <syzbot+4455ca3b3291de891abc@syzkaller.appspotmail.com>,
	Andrey Ryabinin <aryabinin@virtuozzo.com>,
	Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
	Daniel Thompson <daniel.thompson@linaro.org>,
	Daniel Vetter <daniel.vetter@ffwll.ch>,
	DRI <dri-devel@lists.freedesktop.org>,
	ghalat@redhat.com, Gleb Natapov <gleb@kernel.org>,
	gwshan@linux.vnet.ibm.com, "H. Peter Anvin" <hpa@zytor.com>,
	James Morris <jmorris@namei.org>,
	kasan-dev <kasan-dev@googlegroups.com>,
	KVM list <kvm@vger.kernel.org>,
	Linux Fbdev development list <linux-fbdev@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	linux-security-module <linux-security-module@vger.kernel.org>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Ingo Molnar <mingo@redhat.com>,
	Michael Ellerman <mpe@ellerman.id.au>,
	Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Russell Currey <ruscur@russell.cc>,
	Sam Ravnborg <sam@ravnborg.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	stewart@linux.vnet.ibm.com,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
	Kentaro Takeda <takedakn@nttdata.co.jp>,
	Thomas Gleixner <tglx@linutronix.de>,
	"the arch/x86 maintainers" <x86@kernel.org>
Subject: Re: KASAN: slab-out-of-bounds Read in fbcon_get_font
Date: Thu, 5 Dec 2019 12:27:35 +0100	[thread overview]
Message-ID: <CACT4Y+YopHoCFDRHCE6brnWfHb5YUsTJS1Mc+58GgO8CDEcgHQ@mail.gmail.com> (raw)
In-Reply-To: <e03140c6-8ff5-9abb-1af6-17a5f68d1829@redhat.com>

On Thu, Dec 5, 2019 at 11:53 AM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 05/12/19 11:31, Dmitry Vyukov wrote:
> >> Ah, and because the machine is a KVM guest, kvm_wait appears in a lot of
> >> backtrace and I get to share syzkaller's joy every time. :)
> > I don't see any mention of "kvm" in the crash report.
>
> It's there in the stack trace, not sure if this is what triggered my Cc:
>
>  [<ffffffff810c7c3a>] kvm_wait+0xca/0xe0 arch/x86/kernel/kvm.c:612
>
> Paolo

Oh, you mean the final bisection crash. Indeed it contains a kvm frame
and it turns out to be a bug in syzkaller code that indeed
misattributed it to kvm instead of netfilter.
Should be fixed now, you may read the commit message for details:
https://github.com/google/syzkaller/commit/4fb74474cf0af2126be3a8989d770c3947ae9478

Overall this "making sense out of kernel output" task is the ultimate
insanity, you may skim through this file to get a taste of amount of
hardcoding and special corner cases that need to be handled:
https://github.com/google/syzkaller/blob/master/pkg/report/linux.go
And this is never done, such "exception from exception corner case"
things pop up every week. There is always something to shuffle and
tune. It only keeps functioning due to 500+ test cases for all
possible insane kernel outputs:
https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/report
https://github.com/google/syzkaller/tree/master/pkg/report/testdata/linux/guilty

So thanks for persisting and questioning! We are getting better with
each new test.