From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEE2EC2B9F4 for ; Fri, 25 Jun 2021 18:59:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8404661879 for ; Fri, 25 Jun 2021 18:59:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229738AbhFYTBz (ORCPT ); Fri, 25 Jun 2021 15:01:55 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:57474 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229531AbhFYTBy (ORCPT ); Fri, 25 Jun 2021 15:01:54 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out02.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lwr35-000f6c-RJ; Fri, 25 Jun 2021 12:59:31 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95]:53632 helo=email.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1lwr33-00718c-IM; Fri, 25 Jun 2021 12:59:31 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Dmitry Vyukov Cc: syzbot , akpm@linux-foundation.org, ast@kernel.org, christian@brauner.io, jnewsome@torproject.org, linux-kernel@vger.kernel.org, minchan@kernel.org, oleg@redhat.com, syzkaller-bugs@googlegroups.com, Ingo Molnar , kasan-dev References: <000000000000ef5d1b05c57c2262@google.com> <87fsx7akyf.fsf@disp2133> Date: Fri, 25 Jun 2021 13:59:22 -0500 In-Reply-To: (Dmitry Vyukov's message of "Fri, 25 Jun 2021 16:39:46 +0200") Message-ID: <87lf6x4vp1.fsf@disp2133> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1lwr33-00718c-IM;;;mid=<87lf6x4vp1.fsf@disp2133>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/6K7QSNjyoSlC4Vghb9ddd0B5Hb2/12rg= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [syzbot] KASAN: out-of-bounds Read in do_exit X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dmitry Vyukov writes: > On Thu, Jun 24, 2021 at 7:31 AM Eric W. Biederman wrote: >> >> syzbot writes: >> >> > Hello, >> > >> > syzbot found the following issue on: >> >> This looks like dueling debug mechanism. At a quick glance >> stack_no_used is deliberately looking for an uninitialized part of the >> stack. >> >> Perhaps the fix is to make KASAN and DEBUG_STACK_USAGE impossible to >> select at the same time in Kconfig? > > +kasan-dev > > Hi Eric, > > Thanks for looking into this. > > I see several strange things about this KASAN report: > 1. KASAN is not supposed to leave unused stack memory as "poisoned". > Function entry poisons its own frame and function exit unpoisions it. > Longjmp-like things can leave unused stack poisoned. We have > kasan_unpoison_task_stack_below() for these, so maybe we are missing > this annotation somewhere. > > 2. This stand-alone shadow pattern "07 07 07 07 07 07 07 07" looks fishy. > It means there are 7 good bytes, then 1 poisoned byte, then 7 good > bytes and so on. I am not sure what can leave such a pattern. Both > heap and stack objects have larger redzones in between. I am not sure > about globals, but stack should not overlap with globals (and there > are no modules on syzbot). > > So far this happened only once and no reproducer. If nobody sees > anything obvious, I would say we just wait for more info. I may be mixing things up but on second glance this entire setup feels very familiar. I think this is the second time I have made this request that the two pieces of debugging code play nice. Perhaps it is a different piece of debugging code and KASAN that I am remembering but I think this is the second time this issue has come up. Eric