* Re: Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) [not found] <CAD1Xb+-kbRLxe1XNSkhY-VXZWV8fSy-gZeeGhtKH2hO42VJKzA@mail.gmail.com> @ 2018-05-02 11:18 ` Dmitry Vyukov 2018-05-07 6:01 ` Dmitry Vyukov 0 siblings, 1 reply; 2+ messages in thread From: Dmitry Vyukov @ 2018-05-02 11:18 UTC (permalink / raw) To: Dongsong Yu Cc: Johannes Weiner, Michal Hocko, Vladimir Davydov, cgroups, Linux-MM, LKML, syzkaller On Wed, May 2, 2018 at 1:11 PM, Dongsong Yu <yudongsong1992@gmail.com> wrote: > Hi, > I've got the following bug report while fuzzing linux kenrel (4.16.0) on > arm64 with syzkaller. > The kernel config file and poc generated by C reproducer are attached. > > Syzkaller hit 'KASAN: use-after-scope Write in mem_cgroup_uncharge' bug. Hi Dongsong, If I am looking at the right source: https://elixir.bootlin.com/linux/v4.16/source/mm/memcontrol.c#L5667 this report does not make sense. What version of compiler do you use? Please post disasm of mem_cgroup_uncharge with source/line annotations. Thanks > ================================================================== > BUG: KASAN: use-after-scope in uncharge_gather_clear mm/memcontrol.c:5546 > [inline] > BUG: KASAN: use-after-scope in mem_cgroup_uncharge+0xcc/0xf0 > mm/memcontrol.c:5667 > Write of size 64 at addr ffff8000738c6cf0 by task syzkaller348646/1477 > > CPU: 0 PID: 1477 Comm: syzkaller348646 Not tainted 4.16.0 #2 > Hardware name: linux,dummy-virt (DT) > Call trace: > dump_backtrace+0x0/0x350 arch/arm64/kernel/time.c:64 > show_stack+0x20/0x30 arch/arm64/kernel/traps.c:151 > __dump_stack lib/dump_stack.c:17 [inline] > dump_stack+0x11c/0x198 lib/dump_stack.c:53 > print_address_description+0x60/0x270 mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report+0x248/0x348 mm/kasan/report.c:412 > check_memory_region_inline mm/kasan/kasan.c:253 [inline] > check_memory_region+0x148/0x198 mm/kasan/kasan.c:267 > memset+0x2c/0x50 mm/kasan/kasan.c:285 > uncharge_gather_clear mm/memcontrol.c:5546 [inline] > mem_cgroup_uncharge+0xcc/0xf0 mm/memcontrol.c:5667 > __page_cache_release+0x11c/0x640 mm/swap.c:73 > __put_compound_page+0x30/0x70 mm/swap.c:93 > release_pages+0x6b4/0x990 mm/swap.c:760 > free_pages_and_swap_cache+0x1e8/0x250 mm/swap_state.c:322 > tlb_flush_mmu_free+0x6c/0xb8 mm/memory.c:259 > tlb_flush_mmu+0x3c/0x48 mm/memory.c:268 > arch_tlb_finish_mmu+0x70/0xc0 mm/memory.c:283 > tlb_finish_mmu+0xd0/0x128 mm/memory.c:433 > unmap_region+0x248/0x2b8 mm/mmap.c:2514 > do_munmap+0x3b8/0x670 mm/mmap.c:2726 > mmap_region+0x3b8/0xa78 mm/mmap.c:1646 > do_mmap+0x448/0x6a0 mm/mmap.c:1483 > do_mmap_pgoff include/linux/mm.h:2223 [inline] > vm_mmap_pgoff+0x17c/0x1b8 mm/util.c:355 > SYSC_mmap_pgoff mm/mmap.c:1533 [inline] > SyS_mmap_pgoff+0x184/0x3e8 mm/mmap.c:1491 > sys_mmap+0x58/0x80 arch/arm64/kernel/sys.c:37 > el0_svc_naked+0x30/0x34 > > The buggy address belongs to the page: > page:ffff7e0001ce3180 count:0 mapcount:0 mapping:0000000000000000 index:0x0 > flags: 0x4fffc00000000000() > raw: 4fffc00000000000 0000000000000000 0000000000000000 00000000ffffffff > raw: 0000000000000000 ffff7e0001ce31a0 0000000000000000 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff8000738c6b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff8000738c6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> ffff8000738c6c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1 f1 f1 f1 f8 f8 > ^ > ffff8000738c6d00: f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f8 f8 f8 f8 f8 f8 > ffff8000738c6d80: f8 f8 f8 f8 f8 f8 00 00 00 00 00 00 00 00 00 00 > ================================================================== > > -- > You received this message because you are subscribed to the Google Groups "syzkaller" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) 2018-05-02 11:18 ` Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) Dmitry Vyukov @ 2018-05-07 6:01 ` Dmitry Vyukov 0 siblings, 0 replies; 2+ messages in thread From: Dmitry Vyukov @ 2018-05-07 6:01 UTC (permalink / raw) To: Dongsong Yu Cc: Johannes Weiner, Michal Hocko, Vladimir Davydov, cgroups, Linux-MM, LKML, syzkaller, Mark Rutland On Wed, May 2, 2018 at 1:18 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Wed, May 2, 2018 at 1:11 PM, Dongsong Yu <yudongsong1992@gmail.com> wrote: >> Hi, >> I've got the following bug report while fuzzing linux kenrel (4.16.0) on >> arm64 with syzkaller. >> The kernel config file and poc generated by C reproducer are attached. >> >> Syzkaller hit 'KASAN: use-after-scope Write in mem_cgroup_uncharge' bug. > > Hi Dongsong, > > If I am looking at the right source: > https://elixir.bootlin.com/linux/v4.16/source/mm/memcontrol.c#L5667 > this report does not make sense. > What version of compiler do you use? > Please post disasm of mem_cgroup_uncharge with source/line annotations. I don't see how the bug can happen. Nor I see who stores 0xf8f8f8f8 into KASAN shadow, though I am not very proficient in arm64 asm. I don't remember any similar false positives on x86. +Mark, have you seen any KASAN false positives related to use-after-scope on arm64? >> ================================================================== >> BUG: KASAN: use-after-scope in uncharge_gather_clear mm/memcontrol.c:5546 >> [inline] >> BUG: KASAN: use-after-scope in mem_cgroup_uncharge+0xcc/0xf0 >> mm/memcontrol.c:5667 >> Write of size 64 at addr ffff8000738c6cf0 by task syzkaller348646/1477 >> >> CPU: 0 PID: 1477 Comm: syzkaller348646 Not tainted 4.16.0 #2 >> Hardware name: linux,dummy-virt (DT) >> Call trace: >> dump_backtrace+0x0/0x350 arch/arm64/kernel/time.c:64 >> show_stack+0x20/0x30 arch/arm64/kernel/traps.c:151 >> __dump_stack lib/dump_stack.c:17 [inline] >> dump_stack+0x11c/0x198 lib/dump_stack.c:53 >> print_address_description+0x60/0x270 mm/kasan/report.c:256 >> kasan_report_error mm/kasan/report.c:354 [inline] >> kasan_report+0x248/0x348 mm/kasan/report.c:412 >> check_memory_region_inline mm/kasan/kasan.c:253 [inline] >> check_memory_region+0x148/0x198 mm/kasan/kasan.c:267 >> memset+0x2c/0x50 mm/kasan/kasan.c:285 >> uncharge_gather_clear mm/memcontrol.c:5546 [inline] >> mem_cgroup_uncharge+0xcc/0xf0 mm/memcontrol.c:5667 >> __page_cache_release+0x11c/0x640 mm/swap.c:73 >> __put_compound_page+0x30/0x70 mm/swap.c:93 >> release_pages+0x6b4/0x990 mm/swap.c:760 >> free_pages_and_swap_cache+0x1e8/0x250 mm/swap_state.c:322 >> tlb_flush_mmu_free+0x6c/0xb8 mm/memory.c:259 >> tlb_flush_mmu+0x3c/0x48 mm/memory.c:268 >> arch_tlb_finish_mmu+0x70/0xc0 mm/memory.c:283 >> tlb_finish_mmu+0xd0/0x128 mm/memory.c:433 >> unmap_region+0x248/0x2b8 mm/mmap.c:2514 >> do_munmap+0x3b8/0x670 mm/mmap.c:2726 >> mmap_region+0x3b8/0xa78 mm/mmap.c:1646 >> do_mmap+0x448/0x6a0 mm/mmap.c:1483 >> do_mmap_pgoff include/linux/mm.h:2223 [inline] >> vm_mmap_pgoff+0x17c/0x1b8 mm/util.c:355 >> SYSC_mmap_pgoff mm/mmap.c:1533 [inline] >> SyS_mmap_pgoff+0x184/0x3e8 mm/mmap.c:1491 >> sys_mmap+0x58/0x80 arch/arm64/kernel/sys.c:37 >> el0_svc_naked+0x30/0x34 >> >> The buggy address belongs to the page: >> page:ffff7e0001ce3180 count:0 mapcount:0 mapping:0000000000000000 index:0x0 >> flags: 0x4fffc00000000000() >> raw: 4fffc00000000000 0000000000000000 0000000000000000 00000000ffffffff >> raw: 0000000000000000 ffff7e0001ce31a0 0000000000000000 0000000000000000 >> page dumped because: kasan: bad access detected >> >> Memory state around the buggy address: >> ffff8000738c6b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> ffff8000738c6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>> ffff8000738c6c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1 f1 f1 f1 f8 f8 >> ^ >> ffff8000738c6d00: f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f8 f8 f8 f8 f8 f8 >> ffff8000738c6d80: f8 f8 f8 f8 f8 f8 00 00 00 00 00 00 00 00 00 00 >> ================================================================== >> >> -- >> You received this message because you are subscribed to the Google Groups "syzkaller" group. >> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-05-07 6:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAD1Xb+-kbRLxe1XNSkhY-VXZWV8fSy-gZeeGhtKH2hO42VJKzA@mail.gmail.com>
2018-05-02 11:18 ` Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) Dmitry Vyukov
2018-05-07 6:01 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).