From: ebiederm@xmission.com (Eric W. Biederman)
To: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>,
LKML <linux-kernel@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
"davej \@mail.xmission.com\>\> Dave Jones" <davej@redhat.com>
Subject: Re: fs: proc: gpf in find_entry
Date: Mon, 22 Dec 2014 09:51:45 -0600 [thread overview]
Message-ID: <87oaqvd6ni.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <CAPAsAGzHyx=9oy7ZFdL3dERrKR3or_PiDqm_chbDRvx+c3ZHPg@mail.gmail.com> (Andrey Ryabinin's message of "Mon, 22 Dec 2014 19:31:27 +0400")
Andrey Ryabinin <ryabinin.a.a@gmail.com> writes:
> 2014-12-22 17:37 GMT+03:00 Sasha Levin <sasha.levin@oracle.com>:
>> Hi all,
>>
>> While fuzzing with trinity inside a KVM tools guest running the latest -next
>> kernel, I've stumbled on the following spew:
>>
>> [ 2015.960381] general protection fault: 0000 [#1] PREEMPT SMP KASAN
>
> Actually this is NULL-ptr dereference. Since you are using kasan with
> inline instrumentation
> NULL-ptr deref transforms into GPF.
>
>
>> [ 2015.970534] RAX: 0000000000000000 RBX: ffff88000003a960 RCX: 0000000000000073
>> [ 2015.970534] RDX: 1ffff10101c8f3c4 RSI: 0000000000000000 RDI: ffff88080e479e20
>> [ 2015.970534] RBP: ffff88080e477a28 R08: 0000000000000066 R09: 0000000000000073
>> [ 2015.970534] R10: ffffda0017d55630 R11: dfffe90000000000 R12: ffff88005fc644b8
>> [ 2015.970534] R13: dfffe90000000000 R14: ffffffff92464884 R15: 0000000000000000
>
> [...]
>
>> All code
>> ========
>> 0: e8 03 42 80 3c callq 0x3c804208
>> 5: 28 00 sub %al,(%rax)
>> 7: 0f 85 ff 01 00 00 jne 0x20c
>> d: 4c 8b 7b 18 mov 0x18(%rbx),%r15
>> 11: 4d 85 ff test %r15,%r15
>> 14: 0f 84 de 01 00 00 je 0x1f8
>> 1a: 41 f6 c7 07 test $0x7,%r15b
>> 1e: 0f 85 d4 01 00 00 jne 0x1f8
>> 24: 4c 89 f8 mov %r15,%rax
>> 27: 48 c1 e8 03 shr $0x3,%rax
>> 2b:* 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
>
> Three commands above are result of KASAN's instrumentation.
> They check shadow for address in %r15:
> if (*((%r15 >> 3) + kasan_shadow_offset)
>
>
>> 30: 0f 85 b5 01 00 00 jne 0x1eb
>> 36: 4d 8b 37 mov (%r15),%r14
>
> And here is memory access, that KASAN checking.
Then frankly I suspect this is a KASAN bug.
These two instructions:
>> 11: 4d 85 ff test %r15,%r15
>> 14: 0f 84 de 01 00 00 je 0x1f8
Should prevent a NULL %r15 value from ever reaching the trapping
instruction.
What other horrible things does KASAN do to the machine code?
Eric
next prev parent reply other threads:[~2014-12-22 15:51 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-22 14:37 fs: proc: gpf in find_entry Sasha Levin
2014-12-22 15:31 ` Andrey Ryabinin
2014-12-22 15:51 ` Eric W. Biederman [this message]
2014-12-22 17:52 ` Andrey Ryabinin
2014-12-22 18:12 ` Sasha Levin
2014-12-22 20:39 ` Eric W. Biederman
2014-12-23 8:20 ` Andrey Ryabinin
2014-12-22 15:32 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87oaqvd6ni.fsf@x220.int.ebiederm.org \
--to=ebiederm@xmission.com \
--cc=davej@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ryabinin.a.a@gmail.com \
--cc=sasha.levin@oracle.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox