From: syzbot <syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com>
To: aha310510@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [bpf?] [net?] general protection fault in __dev_flush
Date: Mon, 22 Jul 2024 04:11:03 -0700 [thread overview]
Message-ID: <000000000000d588a4061dd41951@google.com> (raw)
In-Reply-To: <20240722103139.4718-1-aha310510@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: stack-out-of-bounds Read in xdp_do_check_flushed
==================================================================
BUG: KASAN: stack-out-of-bounds in bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline]
BUG: KASAN: stack-out-of-bounds in xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4298
Read of size 4 at addr ffffc9000167fa50 by task syz.0.111/5959
CPU: 1 UID: 0 PID: 5959 Comm: syz.0.111 Not tainted 6.10.0-syzkaller-g933069701c1b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline]
xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4298
__napi_poll.constprop.0+0xd1/0x550 net/core/dev.c:6774
napi_poll net/core/dev.c:6840 [inline]
net_rx_action+0xa92/0x1010 net/core/dev.c:6962
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:write_comp_data+0x0/0x90 kernel/kcov.c:230
Code: 48 8b 05 e3 5c 79 7e 48 8b 80 10 16 00 00 c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <49> 89 d2 49 89 f8 49 89 f1 65 48 8b 15 af 5c 79 7e 65 8b 05 b0 5c
RSP: 0018:ffffc9000167f618 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffffea0000d86e40 RCX: ffffffff81d6e231
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000005
RBP: ffffea0000d86e40 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffffc9000167fab8
__folio_rmap_sanity_checks+0x61/0x550 include/linux/rmap.h:201
__folio_remove_rmap mm/rmap.c:1514 [inline]
folio_remove_rmap_ptes+0x31/0x3d0 mm/rmap.c:1595
zap_present_folio_ptes mm/memory.c:1517 [inline]
zap_present_ptes mm/memory.c:1576 [inline]
zap_pte_range mm/memory.c:1618 [inline]
zap_pmd_range mm/memory.c:1736 [inline]
zap_pud_range mm/memory.c:1765 [inline]
zap_p4d_range mm/memory.c:1786 [inline]
unmap_page_range+0x1997/0x3c10 mm/memory.c:1807
unmap_single_vma+0x194/0x2b0 mm/memory.c:1853
unmap_vmas+0x22f/0x490 mm/memory.c:1897
exit_mmap+0x1b8/0xb20 mm/mmap.c:3382
__mmput+0x12a/0x480 kernel/fork.c:1345
mmput+0x62/0x70 kernel/fork.c:1367
exit_mm kernel/exit.c:571 [inline]
do_exit+0x9bf/0x2bb0 kernel/exit.c:869
do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
get_signal+0x25fd/0x2770 kernel/signal.c:2917
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f66e7375b59
Code: Unable to access opcode bytes at 0x7f66e7375b2f.
RSP: 002b:00007f66e809c0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f66e7505f68 RCX: 00007f66e7375b59
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f66e7505f68
RBP: 00007f66e7505f60 R08: 00007f66e809c6c0 R09: 00007f66e809c6c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f66e7505f6c
R13: 000000000000000b R14: 00007ffd814e49e0 R15: 00007ffd814e4ac8
</TASK>
The buggy address belongs to stack of task syz.0.111/5959
and is located at offset 24 in frame:
exit_mmap+0x0/0xb20 mm/mmap.c:3202
This frame has 2 objects:
[32, 96) 'vmi'
[128, 256) 'tlb'
The buggy address belongs to the virtual mapping at
[ffffc90001678000, ffffc90001681000) created by:
kernel_clone+0xfd/0x980 kernel/fork.c:2781
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801ec13150 pfn:0x1ec13
memcg:ffff8880261f3b82
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88801ec13150 0000000000000000 00000001ffffffff ffff8880261f3b82
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 5636, tgid 5636 (syz-executor), ts 121181133330, free_ts 121100052787
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1493
prep_new_page mm/page_alloc.c:1501 [inline]
get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3438
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4696
alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2263
vm_area_alloc_pages mm/vmalloc.c:3584 [inline]
__vmalloc_area_node mm/vmalloc.c:3660 [inline]
__vmalloc_node_range_noprof+0xa6a/0x1520 mm/vmalloc.c:3841
alloc_thread_stack_node kernel/fork.c:313 [inline]
dup_task_struct kernel/fork.c:1113 [inline]
copy_process+0x2f3b/0x8de0 kernel/fork.c:2204
kernel_clone+0xfd/0x980 kernel/fork.c:2781
__do_sys_clone+0xba/0x100 kernel/fork.c:2924
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 0 tgid 0 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1094 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2608
__folio_put+0x31c/0x3e0 mm/swap.c:128
folio_put include/linux/mm.h:1479 [inline]
free_page_and_swap_cache+0x249/0x2c0 mm/swap_state.c:308
__tlb_remove_table arch/x86/include/asm/tlb.h:34 [inline]
__tlb_remove_table_free mm/mmu_gather.c:227 [inline]
tlb_remove_table_rcu+0x89/0xe0 mm/mmu_gather.c:282
rcu_do_batch kernel/rcu/tree.c:2569 [inline]
rcu_core+0x828/0x16b0 kernel/rcu/tree.c:2843
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
Memory state around the buggy address:
ffffc9000167f900: 00 f2 f2 f2 00 f2 f2 f2 00 00 f2 f2 00 00 00 00
ffffc9000167f980: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
>ffffc9000167fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
^
ffffc9000167fa80: 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00
ffffc9000167fb00: 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 48 8b 05 e3 5c 79 7e mov 0x7e795ce3(%rip),%rax # 0x7e795cea
7: 48 8b 80 10 16 00 00 mov 0x1610(%rax),%rax
e: c3 ret
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
* 2a: 49 89 d2 mov %rdx,%r10 <-- trapping instruction
2d: 49 89 f8 mov %rdi,%r8
30: 49 89 f1 mov %rsi,%r9
33: 65 48 8b 15 af 5c 79 mov %gs:0x7e795caf(%rip),%rdx # 0x7e795cea
3a: 7e
3b: 65 gs
3c: 8b .byte 0x8b
3d: 05 .byte 0x5
3e: b0 5c mov $0x5c,%al
Tested on:
commit: 93306970 Merge tag '6.11-rc-smb3-server-fixes' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17687d79980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c043ce4607a33671
dashboard link: https://syzkaller.appspot.com/bug?extid=44623300f057a28baf1e
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
next parent reply other threads:[~2024-07-22 11:11 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20240722103139.4718-1-aha310510@gmail.com>
2024-07-22 11:11 ` syzbot [this message]
[not found] <20240725112758.15367-1-aha310510@gmail.com>
2024-07-25 12:18 ` [syzbot] [bpf?] [net?] general protection fault in __dev_flush syzbot
[not found] <20240725112730.15279-1-aha310510@gmail.com>
2024-07-25 11:53 ` syzbot
[not found] <20240724141325.10569-1-aha310510@gmail.com>
2024-07-24 14:38 ` syzbot
[not found] <20240724134011.10477-1-aha310510@gmail.com>
2024-07-24 13:51 ` syzbot
[not found] <20240724122756.9572-1-aha310510@gmail.com>
2024-07-24 13:02 ` syzbot
[not found] <20240724114325.8995-1-aha310510@gmail.com>
2024-07-24 12:20 ` syzbot
[not found] <20240724093902.8331-1-aha310510@gmail.com>
2024-07-24 9:59 ` syzbot
[not found] <20240722114035.5337-1-aha310510@gmail.com>
2024-07-22 12:01 ` syzbot
[not found] <20240722103109.4668-1-aha310510@gmail.com>
2024-07-22 10:52 ` syzbot
2024-07-19 3:59 [syzbot] [net?] [bpf?] " syzbot
2024-07-22 2:59 ` [syzbot] [bpf?] [net?] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000d588a4061dd41951@google.com \
--to=syzbot+44623300f057a28baf1e@syzkaller.appspotmail.com \
--cc=aha310510@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.