* WARNING in drm_mode_createblob_ioctl @ 2019-10-14 6:09 syzbot 2019-10-14 9:16 ` Daniel Vetter ` (2 more replies) 0 siblings, 3 replies; 11+ messages in thread From: syzbot @ 2019-10-14 6:09 UTC (permalink / raw) To: airlied, daniel, dri-devel, linux-kernel, maarten.lankhorst, mripard, sean, syzkaller-bugs Hello, syzbot found the following crash on: HEAD commit: 8ada228a Add linux-next specific files for 20191011 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1423a87f600000 kernel config: https://syzkaller.appspot.com/x/.config?x=7cf4eed5fe42c31a dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com ------------[ cut here ]------------ WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 check_copy_size include/linux/thread_info.h:150 [inline] WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 copy_from_user include/linux/uaccess.h:143 [inline] WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 30449 Comm: syz-executor.5 Not tainted 5.4.0-rc2-next-20191011 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x35 kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline] RIP: 0010:copy_from_user include/linux/uaccess.h:143 [inline] RIP: 0010:drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 Code: c1 ea 03 80 3c 02 00 0f 85 ed 00 00 00 49 89 5d 00 e8 3c 28 cb fd 4c 89 f7 e8 64 92 9e 03 31 c0 e9 75 fd ff ff e8 28 28 cb fd <0f> 0b e8 21 28 cb fd 4d 85 e4 b8 f2 ff ff ff 0f 84 5b fd ff ff 89 RSP: 0018:ffff8880584efaa8 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffff8880a3a90000 RCX: ffffc900109da000 RDX: 0000000000040000 RSI: ffffffff83a7eaf8 RDI: 0000000000000007 RBP: ffff8880584efae8 R08: ffff888096c40080 R09: ffffed1014752110 R10: ffffed101475210f R11: ffff8880a3a9087f R12: ffffc90014907000 R13: ffff888028aa0000 R14: 000000009a6c7969 R15: ffffc90014907058 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-10-14 6:09 WARNING in drm_mode_createblob_ioctl syzbot @ 2019-10-14 9:16 ` Daniel Vetter 2019-10-14 9:39 ` syzbot 2019-11-06 12:30 ` syzbot 2019-11-06 15:20 ` syzbot 2 siblings, 1 reply; 11+ messages in thread From: Daniel Vetter @ 2019-10-14 9:16 UTC (permalink / raw) To: syzbot Cc: airlied, daniel, dri-devel, linux-kernel, maarten.lankhorst, mripard, sean, syzkaller-bugs On Sun, Oct 13, 2019 at 11:09:09PM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: 8ada228a Add linux-next specific files for 20191011 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=1423a87f600000 > kernel config: https://syzkaller.appspot.com/x/.config?x=7cf4eed5fe42c31a > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. Hm only thing that could go wrong is how we allocate the target for the user_copy, which is an argument directly from the ioctl parameter struct. Does syzbot not track that? We use the standard linux ioctl struct encoding in drm. Otherwise I have no idea why it can't create a reliable reproducer for this ... I'm also not seeing the bug, all the input validation we have seems correct :-/ -Daniel > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 > check_copy_size include/linux/thread_info.h:150 [inline] > WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 copy_from_user > include/linux/uaccess.h:143 [inline] > WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 > drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 > Kernel panic - not syncing: panic_on_warn set ... > CPU: 1 PID: 30449 Comm: syz-executor.5 Not tainted 5.4.0-rc2-next-20191011 > #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > panic+0x2e3/0x75c kernel/panic.c:221 > __warn.cold+0x2f/0x35 kernel/panic.c:582 > report_bug+0x289/0x300 lib/bug.c:195 > fixup_bug arch/x86/kernel/traps.c:174 [inline] > fixup_bug arch/x86/kernel/traps.c:169 [inline] > do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 > do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 > invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 > RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline] > RIP: 0010:copy_from_user include/linux/uaccess.h:143 [inline] > RIP: 0010:drm_mode_createblob_ioctl+0x398/0x490 > drivers/gpu/drm/drm_property.c:800 > Code: c1 ea 03 80 3c 02 00 0f 85 ed 00 00 00 49 89 5d 00 e8 3c 28 cb fd 4c > 89 f7 e8 64 92 9e 03 31 c0 e9 75 fd ff ff e8 28 28 cb fd <0f> 0b e8 21 28 cb > fd 4d 85 e4 b8 f2 ff ff ff 0f 84 5b fd ff ff 89 > RSP: 0018:ffff8880584efaa8 EFLAGS: 00010246 > RAX: 0000000000040000 RBX: ffff8880a3a90000 RCX: ffffc900109da000 > RDX: 0000000000040000 RSI: ffffffff83a7eaf8 RDI: 0000000000000007 > RBP: ffff8880584efae8 R08: ffff888096c40080 R09: ffffed1014752110 > R10: ffffed101475210f R11: ffff8880a3a9087f R12: ffffc90014907000 > R13: ffff888028aa0000 R14: 000000009a6c7969 R15: ffffc90014907058 > > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-10-14 9:16 ` Daniel Vetter @ 2019-10-14 9:39 ` syzbot 2019-10-14 10:43 ` Dmitry Vyukov 0 siblings, 1 reply; 11+ messages in thread From: syzbot @ 2019-10-14 9:39 UTC (permalink / raw) To: syzbot, airlied, dri-devel, linux-kernel, mripard, sean, syzkaller-bugs Op 14-10-2019 om 11:16 schreef Daniel Vetter: > On Sun, Oct 13, 2019 at 11:09:09PM -0700, syzbot wrote: >> Hello, >> >> syzbot found the following crash on: >> >> HEAD commit: 8ada228a Add linux-next specific files for 20191011 >> git tree: linux-next >> console output: https://syzkaller.appspot.com/x/log.txt?x=1423a87f600000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=7cf4eed5fe42c31a >> dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 >> compiler: gcc (GCC) 9.0.0 20181231 (experimental) >> >> Unfortunately, I don't have any reproducer for this crash yet. > Hm only thing that could go wrong is how we allocate the target for the > user_copy, which is an argument directly from the ioctl parameter struct. > Does syzbot not track that? We use the standard linux ioctl struct > encoding in drm. > > Otherwise I have no idea why it can't create a reliable reproducer for > this ... I'm also not seeing the bug, all the input validation we have > seems correct :-/ I would like to see the entire dmesg? in particular because it's likely WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count), so I'd like to see the size it thinks for both.. > -Daniel >> IMPORTANT: if you fix the bug, please add the following tag to the commit: >> Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com >> >> ------------[ cut here ]------------ >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 >> check_copy_size include/linux/thread_info.h:150 [inline] >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 copy_from_user >> include/linux/uaccess.h:143 [inline] >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 >> drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 >> Kernel panic - not syncing: panic_on_warn set ... >> CPU: 1 PID: 30449 Comm: syz-executor.5 Not tainted 5.4.0-rc2-next-20191011 >> #0 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS >> Google 01/01/2011 >> Call Trace: >> __dump_stack lib/dump_stack.c:77 [inline] >> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 >> panic+0x2e3/0x75c kernel/panic.c:221 >> __warn.cold+0x2f/0x35 kernel/panic.c:582 >> report_bug+0x289/0x300 lib/bug.c:195 >> fixup_bug arch/x86/kernel/traps.c:174 [inline] >> fixup_bug arch/x86/kernel/traps.c:169 [inline] >> do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 >> do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 >> invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 >> RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline] >> RIP: 0010:copy_from_user include/linux/uaccess.h:143 [inline] >> RIP: 0010:drm_mode_createblob_ioctl+0x398/0x490 >> drivers/gpu/drm/drm_property.c:800 >> Code: c1 ea 03 80 3c 02 00 0f 85 ed 00 00 00 49 89 5d 00 e8 3c 28 cb fd 4c >> 89 f7 e8 64 92 9e 03 31 c0 e9 75 fd ff ff e8 28 28 cb fd <0f> 0b e8 21 28 cb >> fd 4d 85 e4 b8 f2 ff ff ff 0f 84 5b fd ff ff 89 >> RSP: 0018:ffff8880584efaa8 EFLAGS: 00010246 >> RAX: 0000000000040000 RBX: ffff8880a3a90000 RCX: ffffc900109da000 >> RDX: 0000000000040000 RSI: ffffffff83a7eaf8 RDI: 0000000000000007 >> RBP: ffff8880584efae8 R08: ffff888096c40080 R09: ffffed1014752110 >> R10: ffffed101475210f R11: ffff8880a3a9087f R12: ffffc90014907000 >> R13: ffff888028aa0000 R14: 000000009a6c7969 R15: ffffc90014907058 >> >> >> --- >> This bug is generated by a bot. It may contain errors. >> See https://goo.gl/tpsmEJ for more information about syzbot. >> syzbot engineers can be reached at syzkaller@googlegroups.com. >> >> syzbot will keep track of this bug report. See: >> https://goo.gl/tpsmEJ#status for how to communicate with syzbot. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-10-14 9:39 ` syzbot @ 2019-10-14 10:43 ` Dmitry Vyukov 0 siblings, 0 replies; 11+ messages in thread From: Dmitry Vyukov @ 2019-10-14 10:43 UTC (permalink / raw) To: syzbot; +Cc: David Airlie, DRI, LKML, mripard, sean, syzkaller-bugs On Mon, Oct 14, 2019 at 11:39 AM syzbot <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > Op 14-10-2019 om 11:16 schreef Daniel Vetter: > > On Sun, Oct 13, 2019 at 11:09:09PM -0700, syzbot wrote: > >> Hello, > >> > >> syzbot found the following crash on: > >> > >> HEAD commit: 8ada228a Add linux-next specific files for 20191011 > >> git tree: linux-next > >> console output: https://syzkaller.appspot.com/x/log.txt?x=1423a87f600000 > >> kernel config: https://syzkaller.appspot.com/x/.config?x=7cf4eed5fe42c31a > >> dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > >> compiler: gcc (GCC) 9.0.0 20181231 (experimental) > >> > >> Unfortunately, I don't have any reproducer for this crash yet. > > Hm only thing that could go wrong is how we allocate the target for the > > user_copy, which is an argument directly from the ioctl parameter struct. > > Does syzbot not track that? We use the standard linux ioctl struct > > encoding in drm. > > > > Otherwise I have no idea why it can't create a reliable reproducer for > > this ... I'm also not seeing the bug, all the input validation we have > > seems correct :-/ > > I would like to see the entire dmesg? > > in particular because it's likely WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count), > > so I'd like to see the size it thinks for both.. And who are "you"? :) The email as if comes from syzbot: From: syzbot <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> But it is clearly not generated by syzbot code. Or is it some kind of a glitch?... Anyway, full console output is always referenced on every syzbot bug report as "console output:" link. > > -Daniel > >> IMPORTANT: if you fix the bug, please add the following tag to the commit: > >> Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > >> > >> ------------[ cut here ]------------ > >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 > >> check_copy_size include/linux/thread_info.h:150 [inline] > >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 copy_from_user > >> include/linux/uaccess.h:143 [inline] > >> WARNING: CPU: 1 PID: 30449 at include/linux/thread_info.h:150 > >> drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 > >> Kernel panic - not syncing: panic_on_warn set ... > >> CPU: 1 PID: 30449 Comm: syz-executor.5 Not tainted 5.4.0-rc2-next-20191011 > >> #0 > >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > >> Google 01/01/2011 > >> Call Trace: > >> __dump_stack lib/dump_stack.c:77 [inline] > >> dump_stack+0x172/0x1f0 lib/dump_stack.c:113 > >> panic+0x2e3/0x75c kernel/panic.c:221 > >> __warn.cold+0x2f/0x35 kernel/panic.c:582 > >> report_bug+0x289/0x300 lib/bug.c:195 > >> fixup_bug arch/x86/kernel/traps.c:174 [inline] > >> fixup_bug arch/x86/kernel/traps.c:169 [inline] > >> do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 > >> do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 > >> invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 > >> RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline] > >> RIP: 0010:copy_from_user include/linux/uaccess.h:143 [inline] > >> RIP: 0010:drm_mode_createblob_ioctl+0x398/0x490 > >> drivers/gpu/drm/drm_property.c:800 > >> Code: c1 ea 03 80 3c 02 00 0f 85 ed 00 00 00 49 89 5d 00 e8 3c 28 cb fd 4c > >> 89 f7 e8 64 92 9e 03 31 c0 e9 75 fd ff ff e8 28 28 cb fd <0f> 0b e8 21 28 cb > >> fd 4d 85 e4 b8 f2 ff ff ff 0f 84 5b fd ff ff 89 > >> RSP: 0018:ffff8880584efaa8 EFLAGS: 00010246 > >> RAX: 0000000000040000 RBX: ffff8880a3a90000 RCX: ffffc900109da000 > >> RDX: 0000000000040000 RSI: ffffffff83a7eaf8 RDI: 0000000000000007 > >> RBP: ffff8880584efae8 R08: ffff888096c40080 R09: ffffed1014752110 > >> R10: ffffed101475210f R11: ffff8880a3a9087f R12: ffffc90014907000 > >> R13: ffff888028aa0000 R14: 000000009a6c7969 R15: ffffc90014907058 > >> > >> > >> --- > >> This bug is generated by a bot. It may contain errors. > >> See https://goo.gl/tpsmEJ for more information about syzbot. > >> syzbot engineers can be reached at syzkaller@googlegroups.com. > >> > >> syzbot will keep track of this bug report. See: > >> https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/67fb1a91-7ef3-9036-2d1b-877e394bcab2%40linux.intel.com. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-10-14 6:09 WARNING in drm_mode_createblob_ioctl syzbot 2019-10-14 9:16 ` Daniel Vetter @ 2019-11-06 12:30 ` syzbot 2019-11-06 15:20 ` syzbot 2 siblings, 0 replies; 11+ messages in thread From: syzbot @ 2019-11-06 12:30 UTC (permalink / raw) To: airlied, daniel, dri-devel, dvyukov, linux-kernel, maarten.lankhorst, mripard, sean, syzkaller-bugs syzbot has found a reproducer for the following crash on: HEAD commit: 51309b9d Add linux-next specific files for 20191105 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=13f5c078e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8842 at include/linux/thread_info.h:150 check_copy_size include/linux/thread_info.h:150 [inline] WARNING: CPU: 0 PID: 8842 at include/linux/thread_info.h:150 copy_from_user include/linux/uaccess.h:143 [inline] WARNING: CPU: 0 PID: 8842 at include/linux/thread_info.h:150 drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 8842 Comm: syz-executor938 Not tainted 5.4.0-rc6-next-20191105 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x35 kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:check_copy_size include/linux/thread_info.h:150 [inline] RIP: 0010:copy_from_user include/linux/uaccess.h:143 [inline] RIP: 0010:drm_mode_createblob_ioctl+0x398/0x490 drivers/gpu/drm/drm_property.c:800 Code: c1 ea 03 80 3c 02 00 0f 85 ed 00 00 00 49 89 5d 00 e8 0c f2 c6 fd 4c 89 f7 e8 24 af aa 03 31 c0 e9 75 fd ff ff e8 f8 f1 c6 fd <0f> 0b e8 f1 f1 c6 fd 4d 85 e4 b8 f2 ff ff ff 0f 84 5b fd ff ff 89 RSP: 0018:ffff8880a5e07aa8 EFLAGS: 00010293 RAX: ffff88809f3a0440 RBX: ffff8880a387c000 RCX: ffffffff83ac75e2 RDX: 0000000000000000 RSI: ffffffff83ac77a8 RDI: 0000000000000007 RBP: ffff8880a5e07ae8 R08: ffff88809f3a0440 R09: ffffed101470f910 R10: ffffed101470f90f R11: ffff8880a387c87f R12: ffffc90005f5d000 R13: ffff8880a4d78000 R14: 0000000096e170d0 R15: ffffc90005f5d058 drm_ioctl_kernel+0x244/0x300 drivers/gpu/drm/drm_ioctl.c:786 drm_ioctl+0x54e/0xa60 drivers/gpu/drm/drm_ioctl.c:886 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x449659 Code: e8 fc b8 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab d6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f6951f91db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000006dac38 RCX: 0000000000449659 RDX: 0000000020000000 RSI: ffffffffffffffbd RDI: 0000000000000004 RBP: 00000000006dac30 R08: 00007f6951f92700 R09: 0000000000000000 R10: 00007f6951f92700 R11: 0000000000000246 R12: 00000000006dac3c R13: 00007ffeae0e7e9f R14: 00007f6951f929c0 R15: 20c49ba5e353f7cf Kernel Offset: disabled Rebooting in 86400 seconds.. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-10-14 6:09 WARNING in drm_mode_createblob_ioctl syzbot 2019-10-14 9:16 ` Daniel Vetter 2019-11-06 12:30 ` syzbot @ 2019-11-06 15:20 ` syzbot 2019-11-06 15:23 ` Daniel Vetter 2 siblings, 1 reply; 11+ messages in thread From: syzbot @ 2019-11-06 15:20 UTC (permalink / raw) To: airlied, akpm, daniel, dri-devel, dvyukov, keescook, linux-kernel, maarten.lankhorst, mripard, sean, sfr, syzkaller-bugs, viro syzbot has bisected this bug to: commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba Author: Kees Cook <keescook@chromium.org> Date: Mon Nov 4 22:57:23 2019 +0000 uaccess: disallow > INT_MAX copy sizes bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 start commit: 51309b9d Add linux-next specific files for 20191105 git tree: linux-next final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-11-06 15:20 ` syzbot @ 2019-11-06 15:23 ` Daniel Vetter 2019-11-06 15:28 ` Daniel Vetter 2019-11-06 15:36 ` Dmitry Vyukov 0 siblings, 2 replies; 11+ messages in thread From: Daniel Vetter @ 2019-11-06 15:23 UTC (permalink / raw) To: syzbot Cc: Dave Airlie, Andrew Morton, dri-devel, Dmitry Vyukov, Kees Cook, Linux Kernel Mailing List, Maarten Lankhorst, Maxime Ripard, Sean Paul, Stephen Rothwell, syzkaller-bugs, Al Viro On Wed, Nov 6, 2019 at 4:20 PM syzbot <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > syzbot has bisected this bug to: > > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > Author: Kees Cook <keescook@chromium.org> > Date: Mon Nov 4 22:57:23 2019 +0000 > > uaccess: disallow > INT_MAX copy sizes Ah cool, this explains it. fwiw I never managed to get the WARNING in the backtrace to lign up with any code. No idea what's been going on. I'll type a patch to paper over this. -Daniel > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 > start commit: 51309b9d Add linux-next specific files for 20191105 > git tree: linux-next > final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 > > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-11-06 15:23 ` Daniel Vetter @ 2019-11-06 15:28 ` Daniel Vetter 2019-11-06 15:33 ` Dmitry Vyukov 2019-11-06 15:36 ` Dmitry Vyukov 1 sibling, 1 reply; 11+ messages in thread From: Daniel Vetter @ 2019-11-06 15:28 UTC (permalink / raw) To: syzbot Cc: Dave Airlie, Andrew Morton, dri-devel, Dmitry Vyukov, Kees Cook, Linux Kernel Mailing List, Maarten Lankhorst, Maxime Ripard, Sean Paul, Stephen Rothwell, syzkaller-bugs, Al Viro On Wed, Nov 6, 2019 at 4:23 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > On Wed, Nov 6, 2019 at 4:20 PM syzbot > <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > > > syzbot has bisected this bug to: > > > > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > > Author: Kees Cook <keescook@chromium.org> > > Date: Mon Nov 4 22:57:23 2019 +0000 > > > > uaccess: disallow > INT_MAX copy sizes > > Ah cool, this explains it. > > fwiw I never managed to get the WARNING in the backtrace to lign up > with any code. No idea what's been going on. Ok I think I have an idea, the above commit isn't in the linux-next I have here. Where is this from? -Daniel > > I'll type a patch to paper over this. > -Daniel > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 > > start commit: 51309b9d Add linux-next specific files for 20191105 > > git tree: linux-next > > final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 > > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 > > > > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > > Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") > > > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection > > > > -- > Daniel Vetter > Software Engineer, Intel Corporation > +41 (0) 79 365 57 48 - http://blog.ffwll.ch -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-11-06 15:28 ` Daniel Vetter @ 2019-11-06 15:33 ` Dmitry Vyukov 2019-11-06 15:56 ` Daniel Vetter 0 siblings, 1 reply; 11+ messages in thread From: Dmitry Vyukov @ 2019-11-06 15:33 UTC (permalink / raw) To: Daniel Vetter Cc: syzbot, Dave Airlie, Andrew Morton, dri-devel, Kees Cook, Linux Kernel Mailing List, Maarten Lankhorst, Maxime Ripard, Sean Paul, Stephen Rothwell, syzkaller-bugs, Al Viro On Wed, Nov 6, 2019 at 4:28 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > On Wed, Nov 6, 2019 at 4:23 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > On Wed, Nov 6, 2019 at 4:20 PM syzbot > > <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > > > > > syzbot has bisected this bug to: > > > > > > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > > > Author: Kees Cook <keescook@chromium.org> > > > Date: Mon Nov 4 22:57:23 2019 +0000 > > > > > > uaccess: disallow > INT_MAX copy sizes > > > > Ah cool, this explains it. > > > > fwiw I never managed to get the WARNING in the backtrace to lign up > > with any code. No idea what's been going on. > > Ok I think I have an idea, the above commit isn't in the linux-next I > have here. Where is this from? > -Daniel You need to fetch tags to linux-next. syzbot started bisecting from the commit where the crash happened, and it is now probably not the current tag. linux$ git show 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba Author: Kees Cook <keescook@chromium.org> Date: Tue Nov 5 09:57:23 2019 +1100 uaccess: disallow > INT_MAX copy sizes As we've done with VFS, string operations, etc, reject usercopy sizes larger than INT_MAX, which would be nice to have for catching bugs related to size calculation overflows[1]. This adds 10 bytes to x86_64 defconfig text and 1980 bytes to the data section: text data bss dec hex filename 19691167 5134320 1646664 26472151 193eed7 vmlinux.before 19691177 5136300 1646664 26474141 193f69d vmlinux.after [1] https://marc.info/?l=linux-s390&m=156631939010493&w=2 Link: http://lkml.kernel.org/r/201908251612.F9902D7A@keescook Signed-off-by: Kees Cook <keescook@chromium.org> Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h index 659a4400517b2..e93e249a4e9bf 100644 --- a/include/linux/thread_info.h +++ b/include/linux/thread_info.h @@ -147,6 +147,8 @@ check_copy_size(const void *addr, size_t bytes, bool is_source) __bad_copy_to(); return false; } + if (WARN_ON_ONCE(bytes > INT_MAX)) + return false; check_object_size(addr, bytes, is_source); return true; } > > I'll type a patch to paper over this. > > -Daniel > > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 > > > start commit: 51309b9d Add linux-next specific files for 20191105 > > > git tree: linux-next > > > final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 > > > console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 > > > > > > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > > > Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") > > > > > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection > > > > > > > > -- > > Daniel Vetter > > Software Engineer, Intel Corporation > > +41 (0) 79 365 57 48 - http://blog.ffwll.ch > > > > -- > Daniel Vetter > Software Engineer, Intel Corporation > +41 (0) 79 365 57 48 - http://blog.ffwll.ch ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-11-06 15:33 ` Dmitry Vyukov @ 2019-11-06 15:56 ` Daniel Vetter 0 siblings, 0 replies; 11+ messages in thread From: Daniel Vetter @ 2019-11-06 15:56 UTC (permalink / raw) To: Dmitry Vyukov Cc: syzbot, Dave Airlie, Andrew Morton, dri-devel, Kees Cook, Linux Kernel Mailing List, Maarten Lankhorst, Maxime Ripard, Sean Paul, Stephen Rothwell, syzkaller-bugs, Al Viro On Wed, Nov 6, 2019 at 4:33 PM Dmitry Vyukov <dvyukov@google.com> wrote: > > On Wed, Nov 6, 2019 at 4:28 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > On Wed, Nov 6, 2019 at 4:23 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > > > > > On Wed, Nov 6, 2019 at 4:20 PM syzbot > > > <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > > > > > > > syzbot has bisected this bug to: > > > > > > > > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > > > > Author: Kees Cook <keescook@chromium.org> > > > > Date: Mon Nov 4 22:57:23 2019 +0000 > > > > > > > > uaccess: disallow > INT_MAX copy sizes > > > > > > Ah cool, this explains it. > > > > > > fwiw I never managed to get the WARNING in the backtrace to lign up > > > with any code. No idea what's been going on. > > > > Ok I think I have an idea, the above commit isn't in the linux-next I > > have here. Where is this from? > > -Daniel > > You need to fetch tags to linux-next. syzbot started bisecting from > the commit where the crash happened, and it is now probably not the > current tag. Indeed it's an -mm patch so rebases every day. I tried looking for it, but found nothing, not sure what exactly I screwed up. Patch on the way. -Daniel > > linux$ git show 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > Author: Kees Cook <keescook@chromium.org> > Date: Tue Nov 5 09:57:23 2019 +1100 > > uaccess: disallow > INT_MAX copy sizes > > As we've done with VFS, string operations, etc, reject usercopy sizes > larger than INT_MAX, which would be nice to have for catching bugs related > to size calculation overflows[1]. > > This adds 10 bytes to x86_64 defconfig text and 1980 bytes to the data > section: > > text data bss dec hex filename > 19691167 5134320 1646664 26472151 193eed7 vmlinux.before > 19691177 5136300 1646664 26474141 193f69d vmlinux.after > > [1] https://marc.info/?l=linux-s390&m=156631939010493&w=2 > > Link: http://lkml.kernel.org/r/201908251612.F9902D7A@keescook > Signed-off-by: Kees Cook <keescook@chromium.org> > Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> > Cc: Alexander Viro <viro@zeniv.linux.org.uk> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org> > Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> > > diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h > index 659a4400517b2..e93e249a4e9bf 100644 > --- a/include/linux/thread_info.h > +++ b/include/linux/thread_info.h > @@ -147,6 +147,8 @@ check_copy_size(const void *addr, size_t bytes, > bool is_source) > __bad_copy_to(); > return false; > } > + if (WARN_ON_ONCE(bytes > INT_MAX)) > + return false; > check_object_size(addr, bytes, is_source); > return true; > } > > > > > I'll type a patch to paper over this. > > > -Daniel > > > > > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 > > > > start commit: 51309b9d Add linux-next specific files for 20191105 > > > > git tree: linux-next > > > > final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 > > > > > > > > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > > > > Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") > > > > > > > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection > > > > > > > > > > > > -- > > > Daniel Vetter > > > Software Engineer, Intel Corporation > > > +41 (0) 79 365 57 48 - http://blog.ffwll.ch > > > > > > > > -- > > Daniel Vetter > > Software Engineer, Intel Corporation > > +41 (0) 79 365 57 48 - http://blog.ffwll.ch -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: WARNING in drm_mode_createblob_ioctl 2019-11-06 15:23 ` Daniel Vetter 2019-11-06 15:28 ` Daniel Vetter @ 2019-11-06 15:36 ` Dmitry Vyukov 1 sibling, 0 replies; 11+ messages in thread From: Dmitry Vyukov @ 2019-11-06 15:36 UTC (permalink / raw) To: Daniel Vetter Cc: syzbot, Dave Airlie, Andrew Morton, dri-devel, Kees Cook, Linux Kernel Mailing List, Maarten Lankhorst, Maxime Ripard, Sean Paul, Stephen Rothwell, syzkaller-bugs, Al Viro On Wed, Nov 6, 2019 at 4:30 PM Daniel Vetter <daniel@ffwll.ch> wrote: > > On Wed, Nov 6, 2019 at 4:20 PM syzbot > <syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com> wrote: > > > > syzbot has bisected this bug to: > > > > commit 9e5a64c71b2f70ba530f8156046dd7dfb8a7a0ba > > Author: Kees Cook <keescook@chromium.org> > > Date: Mon Nov 4 22:57:23 2019 +0000 > > > > uaccess: disallow > INT_MAX copy sizes > > Ah cool, this explains it. > > fwiw I never managed to get the WARNING in the backtrace to lign up > with any code. No idea what's been going on. > > I'll type a patch to paper over this. > -Daniel If I get: git checkout 8ada228a then include/linux/thread_info.h:150 points right to: if (WARN_ON_ONCE(bytes > INT_MAX)) Is the size user-controllable here? > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=125fe6dce00000 > > start commit: 51309b9d Add linux-next specific files for 20191105 > > git tree: linux-next > > final crash: https://syzkaller.appspot.com/x/report.txt?x=115fe6dce00000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=165fe6dce00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=a9b1a641c1f1fc52 > > dashboard link: https://syzkaller.appspot.com/bug?extid=fb77e97ebf0612ee6914 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1212dc3ae00000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=145f604ae00000 > > > > Reported-by: syzbot+fb77e97ebf0612ee6914@syzkaller.appspotmail.com > > Fixes: 9e5a64c71b2f ("uaccess: disallow > INT_MAX copy sizes") > > > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection > > > > -- > Daniel Vetter > Software Engineer, Intel Corporation > +41 (0) 79 365 57 48 - http://blog.ffwll.ch > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CAKMK7uFQt%2B%3D7XMo9jvz77QvDWLAAU_V7-_qZ%3DiKe-GXG7cqeJg%40mail.gmail.com. ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2019-11-06 15:57 UTC | newest] Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-10-14 6:09 WARNING in drm_mode_createblob_ioctl syzbot 2019-10-14 9:16 ` Daniel Vetter 2019-10-14 9:39 ` syzbot 2019-10-14 10:43 ` Dmitry Vyukov 2019-11-06 12:30 ` syzbot 2019-11-06 15:20 ` syzbot 2019-11-06 15:23 ` Daniel Vetter 2019-11-06 15:28 ` Daniel Vetter 2019-11-06 15:33 ` Dmitry Vyukov 2019-11-06 15:56 ` Daniel Vetter 2019-11-06 15:36 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).