Re: [6.1.0][bpf] BUG: KASAN: slab-out-of-bounds in copy_array (kernel/bpf/verifier.c:1074)

[sdf@google.com]

On 12/19, Bruno Goncalves wrote:
> We recently started to hit the following issue on the mainline kernel
> [1], the call trace is from commit [2]. The first commit we noticed
> the problem is [3], although we don't know exactly when it was
> introduced.

Seems similar to  
https://lore.kernel.org/bpf/Y6C1SFEj9MOOnAnb@google.com/T/#t ?

> ==================================================================
> [   46.073262] BUG: KASAN: slab-out-of-bounds in copy_array
> (kernel/bpf/verifier.c:1074)
> [   46.074131] Write of size 40 at addr ffff8880079cf840 by task systemd/1
> [   46.075043]
> [   46.076104] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> [   46.076926] Call Trace:
> [   46.077331]  <TASK>
> [   46.077670] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
> [   46.078240] print_report (mm/kasan/report.c:307 mm/kasan/report.c:417)
> [   46.078769] ? __virt_addr_valid (./include/linux/mmzone.h:1783
> ./include/linux/mmzone.h:1879 arch/x86/mm/physaddr.c:65)
> [   46.079389] ? copy_array (kernel/bpf/verifier.c:1074)
> [   46.079885] kasan_report (mm/kasan/report.c:184 mm/kasan/report.c:519)
> [   46.080430] ? copy_array (kernel/bpf/verifier.c:1074)
> [   46.080929] ? kasan_check_range (mm/kasan/generic.c:190)
> [   46.081556] ? memcpy (mm/kasan/shadow.c:65 (discriminator 1))
> [   46.082006] ? copy_array (kernel/bpf/verifier.c:1074)
> [   46.082571] ? copy_verifier_state (kernel/bpf/verifier.c:1250)
> [   46.083231] ? pop_stack (kernel/bpf/verifier.c:1315)
> [   46.083718] ? do_check_common (kernel/bpf/verifier.c:14031
> kernel/bpf/verifier.c:16289)
> [   46.084364] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4383)
> [   46.084979] ? __pfx_do_check_common (kernel/bpf/verifier.c:16225)
> [   46.085644] ? __kmem_cache_free (mm/slub.c:3787 mm/slub.c:3800)
> [   46.086244] ? check_cfg (kernel/bpf/verifier.c:12511)
> [   46.086766] ? bpf_check (kernel/bpf/verifier.c:16352
> kernel/bpf/verifier.c:16936)
> [   46.087313] ? __pfx_bpf_check (kernel/bpf/verifier.c:16819)
> [   46.087878] ? __pfx___lock_acquire (kernel/locking/lockdep.c:4913)
> [   46.088548] ? lock_is_held_type (kernel/locking/lockdep.c:466
> kernel/locking/lockdep.c:5712)
> [   46.089122] ? find_held_lock (kernel/locking/lockdep.c:5179)
> [   46.089697] ? lock_release (kernel/locking/lockdep.c:466
> kernel/locking/lockdep.c:5690)
> [   46.090261] ? ktime_get_with_offset (./include/linux/seqlock.h:274
> kernel/time/timekeeping.c:889)
> [   46.090921] ? __pfx_lock_release (kernel/locking/lockdep.c:5676)
> [   46.091521] ? __might_fault (mm/memory.c:5647 mm/memory.c:5640)
> [   46.092048] ? __might_resched (kernel/sched/core.c:9950)
> [   46.092650] ? memset (mm/kasan/shadow.c:44)
> [   46.093109] ? bpf_prog_load (kernel/bpf/syscall.c:2619)
> [   46.093722] ? __pfx_bpf_prog_load (kernel/bpf/syscall.c:2478)
> [   46.094357] ? lock_is_held_type (kernel/locking/lockdep.c:466
> kernel/locking/lockdep.c:5712)
> [   46.094963] ? __sys_bpf (kernel/bpf/syscall.c:4979)
> [   46.095496] ? __pfx___sys_bpf (kernel/bpf/syscall.c:4926)
> [   46.096073] ? mark_held_locks (kernel/locking/lockdep.c:4224)
> [   46.096658] ? __x64_sys_bpf (kernel/bpf/syscall.c:5081)
> [   46.097187] ? do_syscall_64 (arch/x86/entry/common.c:50
> arch/x86/entry/common.c:80)
> [   46.097753] ? entry_SYSCALL_64_after_hwframe  
> (arch/x86/entry/entry_64.S:120)
> [   46.098510]  </TASK>
> [   46.098830]
> [   46.099066] Allocated by task 1:
> [   46.099597] kasan_save_stack (mm/kasan/common.c:46)
> [   46.100146] kasan_set_track (mm/kasan/common.c:52)
> [   46.100705] __kasan_krealloc (mm/kasan/common.c:371  
> mm/kasan/common.c:439)
> [   46.101295] krealloc (./include/linux/kasan.h:231
> mm/slab_common.c:1361 mm/slab_common.c:1398)
> [   46.101754] push_jmp_history (kernel/bpf/verifier.c:2593)
> [   46.102334] do_check_common (kernel/bpf/verifier.c:13552
> kernel/bpf/verifier.c:13752 kernel/bpf/verifier.c:16289)
> [   46.102908] bpf_check (kernel/bpf/verifier.c:16352
> kernel/bpf/verifier.c:16936)
> [   46.103439] bpf_prog_load (kernel/bpf/syscall.c:2619)
> [   46.103986] __sys_bpf (kernel/bpf/syscall.c:4979)
> [   46.104512] __x64_sys_bpf (kernel/bpf/syscall.c:5081)
> [   46.105012] do_syscall_64 (arch/x86/entry/common.c:50
> arch/x86/entry/common.c:80)
> [   46.105613] entry_SYSCALL_64_after_hwframe  
> (arch/x86/entry/entry_64.S:120)
> [   46.106377]
> [   46.106641] The buggy address belongs to the object at ffff8880079cf840
> [   46.106641]  which belongs to the cache kmalloc-64 of size 64
> [   46.108316] The buggy address is located 0 bytes inside of
> [   46.108316]  64-byte region [ffff8880079cf840, ffff8880079cf880)
> [   46.109904]
> [   46.110167] The buggy address belongs to the physical page:
> [   46.110981] page:ffffea00001e73c0 refcount:1 mapcount:0
> mapping:0000000000000000 index:0xffff8880079cf040 pfn:0x79cf
> [   46.112490] flags: 0xfffffc0000200(slab|node=0|zone=1| 
> lastcpupid=0x1fffff)
> [   46.113456] raw: 000fffffc0000200 ffff888100042900 ffffea00040605d0
> ffff8881000406c8
> [   46.114534] raw: ffff8880079cf040 000000000010000a 00000001ffffffff
> 0000000000000000
> [   46.115617] page dumped because: kasan: bad access detected
> [   46.116394]
> [   46.116632] Memory state around the buggy address:
> [   46.117339]  ffff8880079cf700: fc fc fc fc fc fc fc fc fc fc fc fc
> fc fc fc fc
> [   46.118303]  ffff8880079cf780: fc fc fc fc fc fc fc fc fc fc fc fc
> fc fc fc fc
> [   46.119305] >ffff8880079cf800: fc fc fc fc fc fc fc fc 00 00 00 00
> fc fc fc fc
> [   46.120328]                                                        ^
> [   46.121235]  ffff8880079cf880: fc fc fc fc fc fc fc fc fc fc fc fc
> fc fc fc fc
> [   46.122299]  ffff8880079cf900: fc fc fc fc fc fc fc fc fa fb fb fb
> fb fb fb fb
> [   46.123316]  
> ==================================================================

> kernel tarball:
> https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/725608072/publish%20x86_64%20debug/3491129543/artifacts/kernel-mainline.kernel.org-redhat_725608072_x86_64_debug.tar.gz

> kernel config:  
> https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/725608072/build%20x86_64%20debug/3491129500/artifacts/kernel-mainline.kernel.org-redhat_725608072_x86_64_debug.config

> test logs: https://datawarehouse.cki-project.org/kcidb/tests/6444438
> cki issue tracker: https://datawarehouse.cki-project.org/issue/1770

> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> [2] f9ff5644bcc04221bae56f922122f2b7f5d24d62
> [3] 93761c93e9da28d8a020777cee2a84133082b477

> Thank you,
> Bruno Goncalves