Re: PROBLEM: syzkaller found / pool corruption-overwrite / page in user-area or NULL

Esme
2019-01-10T22:58:30Z

The console debug/stacks/info from just now. The previous config, current kernel from github.
--
Esme

[ 75.783231] kasan: CONFIG_KASAN_INLINE enabled
[ 75.785870] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 75.787695] general protection fault: 0000 [#1] SMP KASAN
[ 75.789084] CPU: 0 PID: 3434 Comm: systemd-journal Not tainted 5.0.0-rc1+ #5
[ 75.790938] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1ubuntu1 04/01/2014
[ 75.793150] RIP: 0010:rb_insert_color+0x189/0x1480
[ 75.794421] Code: 09 00 00 4d 8b 65 00 41 f6 c4 01 0f 85 01 02 00 00 48 ba 00 00 00 00 00 fc ff df 49 8d 4c 24 08 4d 89 e0 48 89 c8 48 c1 e8 03 <80> 3c 10 00 0f 85 e5 08 00 00 49 8b 44 24 08 4c 32
[ 75.799181] RSP: 0018:ffff88805d4876c8 EFLAGS: 00010012
[ 75.800558] RAX: 0000000000000001 RBX: 1ffff1100ba90edf RCX: 0000000000000008
[ 75.802393] RDX: dffffc0000000000 RSI: ffffffff8c694c20 RDI: ffff88805ce0fc78
[ 75.804221] RBP: ffff88805d487ac0 R08: 0000000000000000 R09: ffff88805b46f3b0
[ 75.806071] R10: ffffed100ba90f46 R11: 0000000000000003 R12: 0000000000000000
[ 75.807867] R13: ffff88805b46f3b0 R14: ffff88805d487a98 R15: ffff88805ce0fc78
[ 75.809705] FS: 00007f26b66568c0(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000
[ 75.811665] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 75.813090] CR2: 00007f26b33b2000 CR3: 000000006b5c8000 CR4: 00000000000006f0
[ 75.814941] Call Trace:
[ 75.815607] ? is_bpf_text_address+0xdd/0x180
[ 75.816774] ? __bpf_address_lookup+0x310/0x310
[ 75.817968] ? ___ratelimit.cold.2+0x60/0x60
[ 75.819119] ? __kernel_text_address+0xd/0x40
[ 75.820282] ? unwind_get_return_address+0x61/0xb0
[ 75.821564] ? graph_lock+0x270/0x270
[ 75.822522] ? __save_stack_trace+0x8d/0xf0
[ 75.823640] ? find_held_lock+0x36/0x1d0
[ 75.824603] ? __bpf_trace_xdp_cpumap_enqueue+0x60/0x60
[ 75.825878] ? is_bpf_text_address+0xb4/0x180
[ 75.826940] ? lock_downgrade+0x900/0x900
[ 75.827892] ? kasan_check_read+0x11/0x20
[ 75.828878] ? rcu_is_watching+0x9d/0x160
[ 75.829660] ? rcu_cleanup_dead_rnp+0x230/0x230
[ 75.830625] ? rcu_is_watching+0x9d/0x160
[ 75.831443] ? create_object+0x5e8/0xca0
[ 75.832280] ? is_bpf_text_address+0xdd/0x180
[ 75.833185] ? __bpf_address_lookup+0x310/0x310
[ 75.834159] ? kasan_check_read+0x11/0x20
[ 75.834927] ? do_raw_write_lock+0x14f/0x310
[ 75.835755] ? do_raw_read_unlock+0x80/0x80
[ 75.836587] ? __save_stack_trace+0x8d/0xf0
[ 75.837485] create_object+0x785/0xca0
[ 75.838485] ? kmemleak_seq_show+0x190/0x190
[ 75.839552] ? kasan_check_read+0x11/0x20
[ 75.840536] ? do_raw_spin_unlock+0xa7/0x340
[ 75.841680] ? kmem_cache_alloc+0x21a/0x3c0
[ 75.842718] ? kmem_cache_alloc+0x21a/0x3c0
[ 75.843829] ? lockdep_hardirqs_on+0x421/0x610
[ 75.844857] ? trace_hardirqs_on+0xce/0x310
[ 75.845915] ? cache_grow_end+0xb1/0x1b0
[ 75.846938] ? getname_flags+0xdb/0x5d0
[ 75.847964] ? __bpf_trace_preemptirq_template+0x30/0x30
[ 75.849222] ? cache_alloc_refill+0x323/0x360
[ 75.850374] kmemleak_alloc+0x2f/0x50
[ 75.851300] kmem_cache_alloc+0x1b9/0x3c0
[ 75.852344] getname_flags+0xdb/0x5d0
[ 75.853328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 75.854773] getname+0x1e/0x20
[ 75.855584] do_sys_open+0x3a1/0x7d0
[ 75.856431] ? filp_open+0x90/0x90
[ 75.857110] __x64_sys_open+0x7e/0xc0
[ 75.857836] do_syscall_64+0x1b3/0x820
[ 75.858585] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 75.859671] ? syscall_return_slowpath+0x630/0x630
[ 75.860888] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 75.861913] ? trace_hardirqs_on_caller+0x300/0x300
[ 75.862869] ? prepare_exit_to_usermode+0x291/0x3d0
[ 75.863826] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 75.864752] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 75.865735] RIP: 0033:0x7f26b5be783d
[ 75.866444] Code: bb 20 00 00 75 10 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e f6 ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 67 f6 ff ff 48 89 d0 48 81
[ 75.870311] RSP: 002b:00007ffd20c5cbd0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
[ 75.872049] RAX: ffffffffffffffda RBX: 00007ffd20c5cee0 RCX: 00007f26b5be783d
[ 75.873759] RDX: 00000000000001a0 RSI: 0000000000080042 RDI: 000056539c3a9e30
[ 75.875477] RBP: 000000000000000d R08: 000000000000c0c1 R09: 00000000ffffffff
[ 75.877132] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000ffffffff
[ 75.878851] R13: 000056539c39b040 R14: 00007ffd20c5cea0 R15: 000056539c3a9eb0
[ 75.880569] Modules linked in:
[ 75.881339]
[ 75.881344] ======================================================
[ 75.881348] WARNING: possible circular locking dependency detected
[ 75.881351] 5.0.0-rc1+ #5 Not tainted
[ 75.881355] ------------------------------------------------------
[ 75.881359] systemd-journal/3434 is trying to acquire lock:
[ 75.881361] 00000000b15d7606 (console_owner){-.-.}, at: console_unlock+0x57d/0x1160
[ 75.881371]
[ 75.881374] but task is already holding lock:
[ 75.881377] 00000000c5ec5b7e (kmemleak_lock){-.--}, at: create_object+0x5e8/0xca0
[ 75.881387]
[ 75.881391] which lock already depends on the new lock.
[ 75.881392]
[ 75.881394]
[ 75.881398] the existing dependency chain (in reverse order) is:
[ 75.881400]
[ 75.881402] -> #2 (kmemleak_lock){-.--}:
[ 75.881412] _raw_write_lock_irqsave+0x9f/0xd0
[ 75.881415] create_object+0x5e8/0xca0
[ 75.881418] kmemleak_alloc+0x2f/0x50
[ 75.881421] __kmalloc+0x1d9/0x3f0
[ 75.881424] __tty_buffer_request_room+0x2da/0x820
[ 75.881428] __tty_insert_flip_char+0x49/0x220
[ 75.881431] uart_insert_char+0x3a4/0x6d0
[ 75.881434] serial8250_read_char+0x270/0x950
[ 75.881437] serial8250_rx_chars+0x2b/0x110
[ 75.881441] serial8250_handle_irq.part.23+0x23a/0x300
[ 75.881444] serial8250_default_handle_irq+0xd1/0x170
[ 75.881448] serial8250_interrupt+0xee/0x1b0
[ 75.881451] __handle_irq_event_percpu+0x1e4/0xae0
[ 75.881454] handle_irq_event_percpu+0xae/0x1f0
[ 75.881457] handle_irq_event+0xb8/0x160
[ 75.881461] handle_edge_irq+0x20a/0x8c0
[ 75.881463] handle_irq+0x186/0x2e8
[ 75.881466] do_IRQ+0x87/0x1c0
[ 75.881469] ret_from_intr+0x0/0x1e
[ 75.881472] do_syscall_64+0xc7/0x820
[ 75.881475] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 75.881477]
[ 75.881479] -> #1 (&port_lock_key){-.-.}:
[ 75.881489] _raw_spin_lock_irqsave+0x9f/0xd0
[ 75.881493] serial8250_console_write+0x263/0xac0
[ 75.881496] univ8250_console_write+0x69/0x80
[ 75.881499] console_unlock+0xc97/0x1160
[ 75.881502] vprintk_emit+0x3a5/0x970
[ 75.881505] vprintk_default+0x31/0x40
[ 75.881508] vprintk_func+0x85/0x130
[ 75.881510] printk+0xad/0xd3
[ 75.881513] register_console+0x77d/0xbf0
[ 75.881517] univ8250_console_init+0x3f/0x4b
[ 75.881519] console_init+0x63e/0x934
[ 75.881522] start_kernel+0x5da/0x8a7
[ 75.881526] x86_64_start_reservations+0x29/0x2b
[ 75.881529] x86_64_start_kernel+0x76/0x79
[ 75.881532] secondary_startup_64+0xa4/0xb0
[ 75.881534]
[ 75.881535] -> #0 (console_owner){-.-.}:
[ 75.881545] lock_acquire+0x20d/0x520
[ 75.881548] console_unlock+0x5ec/0x1160
[ 75.881551] vprintk_emit+0x3a5/0x970
[ 75.881554] vprintk_default+0x31/0x40
[ 75.881557] vprintk_func+0x85/0x130
[ 75.881560] printk+0xad/0xd3
[ 75.881563] kasan_die_handler.cold.22+0x11/0x31
[ 75.881566] notifier_call_chain+0x17b/0x390
[ 75.881570] atomic_notifier_call_chain+0xa7/0x1b0
[ 75.881573] notify_die+0x1be/0x2e0
[ 75.881576] do_general_protection+0x13e/0x330
[ 75.881579] general_protection+0x1e/0x30
[ 75.881582] rb_insert_color+0x189/0x1480
[ 75.881585] create_object+0x785/0xca0
[ 75.881588] kmemleak_alloc+0x2f/0x50
[ 75.881591] kmem_cache_alloc+0x1b9/0x3c0
[ 75.881594] getname_flags+0xdb/0x5d0
[ 75.881596] getname+0x1e/0x20
[ 75.881599] do_sys_open+0x3a1/0x7d0
[ 75.881602] __x64_sys_open+0x7e/0xc0
[ 75.881605] do_syscall_64+0x1b3/0x820
[ 75.881609] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 75.881610]
[ 75.881614] other info that might help us debug this:
[ 75.881615]
[ 75.881618] Chain exists of:
[ 75.881619] console_owner --> &port_lock_key --> kmemleak_lock
[ 75.881632]
[ 75.881635] Possible unsafe locking scenario:
[ 75.881637]
[ 75.881640] CPU0 CPU1
[ 75.881643] ---- ----
[ 75.881645] lock(kmemleak_lock);
[ 75.881651] lock(&port_lock_key);
[ 75.881658] lock(kmemleak_lock);
[ 75.881664] lock(console_owner);
[ 75.881670]
[ 75.881672] *** DEADLOCK ***
[ 75.881674]
[ 75.881677] 3 locks held by systemd-journal/3434:
[ 75.881679] #0: 00000000c5ec5b7e (kmemleak_lock){-.--}, at: create_object+0x5e8/0xca0
[ 75.881690] #1: 00000000aca2d278 (rcu_read_lock){....}, at: atomic_notifier_call_chain+0x0/0x1b0
[ 75.881703] #2: 00000000afe6836d (console_lock){+.+.}, at: vprintk_emit+0x385/0x970
[ 75.881715]
[ 75.881717] stack backtrace:
[ 75.881721] CPU: 0 PID: 3434 Comm: systemd-journal Not tainted 5.0.0-rc1+ #5
[ 75.881726] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1ubuntu1 04/01/2014
[ 75.881729] Call Trace:
[ 75.881732] dump_stack+0x1d3/0x2c2
[ 75.881735] ? dump_stack_print_info.cold.1+0x20/0x20
[ 75.881739] print_circular_bug.isra.34.cold.56+0x1bc/0x27a
[ 75.881742] ? save_trace+0xe0/0x2a0
[ 75.881745] __lock_acquire+0x3320/0x4d00
[ 75.881748] ? mark_held_locks+0x130/0x130
[ 75.881750] ? put_dec+0x48/0x100
[ 75.881754] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 75.881757] ? enable_ptr_key_workfn+0x30/0x30
[ 75.881760] ? memcpy+0x50/0x60
[ 75.881763] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 75.881766] ? vsnprintf+0x214/0x1a30
[ 75.881769] ? graph_lock+0x270/0x270
[ 75.881773] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 75.881776] ? kernel_poison_pages+0x133/0x220
[ 75.881779] ? find_held_lock+0x36/0x1d0
[ 75.881782] lock_acquire+0x20d/0x520
[ 75.881785] ? console_unlock+0x57d/0x1160
[ 75.881788] ? lock_release+0xaf0/0xaf0
[ 75.881791] ? do_raw_spin_unlock+0xa7/0x340
[ 75.881794] ? do_raw_spin_trylock+0x280/0x280
[ 75.881797] ? trace_hardirqs_on+0x310/0x310
[ 75.881800] console_unlock+0x5ec/0x1160
[ 75.881803] ? console_unlock+0x57d/0x1160
[ 75.881806] ? devkmsg_read+0xbd0/0xbd0
[ 75.881809] ? trace_hardirqs_on+0x310/0x310
[ 75.881812] ? vprintk_emit+0x385/0x970
[ 75.881816] ? _raw_spin_unlock_irqrestore+0x63/0xc0
[ 75.881819] ? vprintk_emit+0x385/0x970
[ 75.881822] ? __down_trylock_console_sem+0x168/0x220
[ 75.881825] ? vprintk_emit+0x385/0x970
[ 75.881828] vprintk_emit+0x3a5/0x970
[ 75.881831] ? wake_up_klogd+0x130/0x130
[ 75.881834] ? mark_held_locks+0x130/0x130
[ 75.881837] ? print_usage_bug+0xe0/0xe0
[ 75.881840] ? __lock_acquire+0x632/0x4d00
[ 75.881843] ? graph_lock+0x270/0x270
[ 75.881846] ? __lock_acquire+0x632/0x4d00
[ 75.881848] vprintk_default+0x31/0x40
[ 75.881851] vprintk_func+0x85/0x130
[ 75.881854] printk+0xad/0xd3
[ 75.881857] ? kmsg_dump_rewind_nolock+0xf0/0xf0
[ 75.881860] ? kasan_check_read+0x11/0x20
[ 75.881864] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 75.881867] ? kasan_die_handler.cold.22+0x5/0x31
[ 75.881870] ? kasan_die_handler+0x1a/0x31
[ 75.881873] kasan_die_handler.cold.22+0x11/0x31
[ 75.881876] notifier_call_chain+0x17b/0x390
[ 75.881880] ? unregister_die_notifier+0x20/0x20
[ 75.881883] ? rcu_is_watching+0x9d/0x160
[ 75.881886] ? rcu_cleanup_dead_rnp+0x230/0x230
[ 75.881889] ? kasan_check_read+0x11/0x20
[ 75.881892] ? rcu_is_watching+0x9d/0x160
[ 75.881895] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 75.881899] ? rcu_cleanup_dead_rnp+0x230/0x230
[ 75.881902] atomic_notifier_call_chain+0xa7/0x1b0
[ 75.881905] ? blocking_notifier_call_chain+0x1a0/0x1a0
[ 75.881908] notify_die+0x1be/0x2e0
[ 75.881912] ? __atomic_notifier_call_chain+0x1c0/0x1c0
[ 75.881915] ? rb_insert_color+0x189/0x1480
[ 75.881918] ? search_exception_tables+0x47/0x50
[ 75.881921] ? fixup_exception+0xb9/0xf0
[ 75.881924] do_general_protection+0x13e/0x330
[ 75.881927] general_protection+0x1e/0x30
[ 75.881930] RIP: 0010:rb_insert_color+0x189/0x1480
[ 75.881940] Code: 09 00 00 4d 8b 65 00 41 f6 c4 01 0f 85 01 02 00 00 48 ba 00 00 00 00 00 fc ff df 49 8d 4c 24 08 4d 89 e0 48 89 c8 48 c1 e8 03 <80> 3c 10 00 0f 85 e5 08 00 00 49 8b 44 24 08 4c 39
[ 75.881943] RSP: 0018:ffff88805d4876c8 EFLAGS: 00010012
[ 75.881950] RAX: 0000000000000001 RBX: 1ffff1100ba90edf RCX: 0000000000000008
[ 75.881954] RDX: dffffc0000000000 RSI: ffffffff8c694c20 RDI: ffff88805ce0fc78
[ 75.881959] RBP: ffff88805d487ac0 R08: 0000000000000000 R09: ffff88805b46f3b0
[ 75.881963] R10: ffffed100ba90f46 R11: 0000000000000003 R12: 0000000000000000
[ 75.881968] R13: ffff88805b46f3b0 R14: ffff88805d487a98 R15: ffff88805ce0fc78
[ 75.881971] ? is_bpf_text_address+0xdd/0x180
[ 75.881974] ? __bpf_address_lookup+0x310/0x310
[ 75.881977] ? ___ratelimit.cold.2+0x60/0x60
[ 75.881980] ? __kernel_text_address+0xd/0x40
[ 75.881984] ? unwind_get_return_address+0x61/0xb0
[ 75.881986] ? graph_lock+0x270/0x270
[ 75.881990] ? __save_stack_trace+0x8d/0xf0
[ 75.881992] ? find_held_lock+0x36/0x1d0
[ 75.881996] ? __bpf_trace_xdp_cpumap_enqueue+0x60/0x60
[ 75.881999] ? is_bpf_text_address+0xb4/0x180
[ 75.882002] ? lock_downgrade+0x900/0x900
[ 75.882005] ? kasan_check_read+0x11/0x20
[ 75.882008] ? rcu_is_watching+0x9d/0x160
[ 75.882011] ? rcu_cleanup_dead_rnp+0x230/0x230
[ 75.882014] ? rcu_is_watching+0x9d/0x160
[ 75.882017] ? create_object+0x5e8/0xca0
[ 75.882020] ? is_bpf_text_address+0xdd/0x180
[ 75.882024] ? __bpf_address_lookup+0x310/0x310
[ 75.882027] ? kasan_check_read+0x11/0x20
[ 75.882030] ? do_raw_write_lock+0x14f/0x310
[ 75.882033] ? do_raw_read_unlock+0x80/0x80
[ 75.882036] ? __save_stack_trace+0x8d/0xf0
[ 75.882039] create_object+0x785/0xca0
[ 75.882042] ? kmemleak_seq_show+0x190/0x190
[ 75.882045] ? kasan_check_read+0x11/0x20
[ 75.882048] ? do_raw_spin_unlock+0xa7/0x340
[ 75.882051] ? kmem_cache_alloc+0x21a/0x3c0
[ 75.882054] ? kmem_cache_alloc+0x21a/0x3c0
[ 75.882057] ? lockdep_hardirqs_on+0x421/0x610
[ 75.882060] ? trace_hardirqs_on+0xce/0x310
[ 75.882063] ? cache_grow_end+0xb1/0x1b0
[ 75.882066] ? getname_flags+0xdb/0x5d0
[ 75.882070] ? __bpf_trace_preemptirq_template+0x30/0x30
[ 75.882073] ? cache_alloc_refill+0x323/0x360
[ 75.882076] kmemleak_alloc+0x2f/0x50
[ 75.882079] kmem_cache_alloc+0x1b9/0x3c0
[ 75.882081] getname_flags+0xdb/0x5d0
[ 75.882085] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 75.882088] getname+0x1e/0x20
[ 75.882090] do_sys_open+0x3a1/0x7d0
[ 75.882093] ? filp_open+0x90/0x90
[ 75.882096] __x64_sys_open+0x7e/0xc0
[ 75.882099] do_syscall_64+0x1b3/0x820
[ 75.882102] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[ 75.882106] ? syscall_return_slowpath+0x630/0x630
[ 75.882109] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 75.882112] ? trace_hardirqs_on_caller+0x300/0x300
[ 75.882115] ? prepare_exit_to_usermode+0x2
[ 75.882120] Lost 11 message(s)!
[ 76.084233] ---[ end trace 66c6a3b7a8d84213 ]---
[ 76.085119] RIP: 0010:rb_insert_color+0x189/0x1480
[ 76.086045] Code: 09 00 00 4d 8b 65 00 41 f6 c4 01 0f 85 01 02 00 00 48 ba 00 00 00 00 00 fc ff df 49 8d 4c 24 08 4d 89 e0 48 89 c8 48 c1 e8 03 <80> 3c 10 00 0f 85 e5 08 00 00 49 8b 44 24 08 4c 30
[ 76.089566] RSP: 0018:ffff88805d4876c8 EFLAGS: 00010012
[ 76.090586] RAX: 0000000000000001 RBX: 1ffff1100ba90edf RCX: 0000000000000008
[ 76.091969] RDX: dffffc0000000000 RSI: ffffffff8c694c20 RDI: ffff88805ce0fc78
[ 76.093319] RBP: ffff88805d487ac0 R08: 0000000000000000 R09: ffff88805b46f3b0
[ 76.094684] R10: ffffed100ba90f46 R11: 0000000000000003 R12: 0000000000000000
[ 76.096052] R13: ffff88805b46f3b0 R14: ffff88805d487a98 R15: ffff88805ce0fc78
[ 76.097440] FS: 00007f26b66568c0(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000
[ 76.098998] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 76.100122] CR2: 00007f26b33b2000 CR3: 000000006b5c8000 CR4: 00000000000006f0
[ 76.101566] Kernel panic - not syncing: Fatal exception
[ 76.104691] Kernel Offset: disabled
[ 76.105407] Rebooting in 86400 seconds..

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Thursday, January 10, 2019 5:33 PM, Qian Cai <cai@lca.pw> wrote:

> On Thu, 2019-01-10 at 21:35 +0000, Esme wrote:
>
> > The repro.report is from a different test system, I pulled the attached config
> > from proc (attached);
>
> So, if the report is not right one. Where is the right crash stack trace then
> that using the exact same config.?