module: BUG in copy_module_from_fd

module: BUG in copy_module_from_fd

[Sasha Levin]

Hi all,

While fuzzing with trinity inside a KVM tools guest running latest -next kernel, I've stumbled on 
the following spew.

This reproduced twice with the same call trace, so I suspect it's something specific with the way
the module subsystem calls vfs_getattr rather than something odd in vfs.

[ 1694.568277] BUG: unable to handle kernel paging request at ffff88022adf8010
[ 1694.570053] IP: [<ffffffff812d77ed>] generic_fillattr+0xd/0xa0
[ 1694.570053] PGD 8577067 PUD 42effb067 PMD 42eea4067 PTE 800000022adf8060
[ 1694.570053] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 1694.570053] Dumping ftrace buffer:
[ 1694.570053]    (ftrace buffer empty)
[ 1694.570053] Modules linked in:
[ 1694.570053] CPU: 60 PID: 35977 Comm: trinity-child60 Tainted: G        W    3.13.0-r
c4-next-20131219-sasha-00014-g94c0243-dirty #4166
[ 1694.570053] task: ffff8801064b8000 ti: ffff88013b56a000 task.ti: ffff88013b56a000
[ 1694.570053] waiting module removal not supported: please upgrade
[ 1694.570053] RIP: 0010:[<ffffffff812d77ed>]  [<ffffffff812d77ed>] generic_fillattr+0x
d/0xa0
[ 1694.570053] RSP: 0018:ffff88013b56bdd8  EFLAGS: 00010246
[ 1694.570053] RAX: ffff88022adf8000 RBX: ffff88018d5202d0 RCX: ffff8801584537b0
[ 1694.570053] RDX: 0000000000000001 RSI: ffff88013b56be28 RDI: ffff88022c450550
[ 1694.570053] RBP: ffff88013b56bdd8 R08: ffff88022c450550 R09: 0000000000000000
[ 1694.570053] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88013b56be28
[ 1694.570053] R13: ffff88013b56bee8 R14: 0000000000000000 R15: 0000000000000193
[ 1694.570053] FS:  00007f9d4b25f700(0000) GS:ffff880066000000(0000) knlGS:000000000000
0000
[ 1694.570053] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1694.570053] CR2: ffff88022adf8010 CR3: 000000013b565000 CR4: 00000000000006e0
[ 1694.570053] Stack:
[ 1694.570053]  ffff88013b56bde8 ffffffff812d78b8 ffff88013b56be08 ffffffff812d7ea7
[ 1694.570053]  ffff88018d5202c0 0000000000000000 ffff88013b56bec8 ffffffff811d76e5
[ 1694.570053]  0000000000000001 ffffffff811759a6 ffff88013b56be58 ffffffff81194e1a
[ 1694.570053] Call Trace:
[ 1694.570053]  [<ffffffff812d78b8>] vfs_getattr_nosec+0x38/0x40
[ 1694.570053]  [<ffffffff812d7ea7>] vfs_getattr+0x37/0x50
[ 1694.570053]  [<ffffffff811d76e5>] copy_module_from_fd+0x65/0x150
[ 1694.570053]  [<ffffffff811759a6>] ? vtime_account_user+0x96/0xb0
[ 1694.570053]  [<ffffffff81194e1a>] ? __lock_release+0x1da/0x1f0
[ 1694.570053]  [<ffffffff811759a6>] ? vtime_account_user+0x96/0xb0
[ 1694.570053]  [<ffffffff81249358>] ? context_tracking_user_exit+0xb8/0x1d0
[ 1694.570053]  [<ffffffff819dfc88>] ? security_capable+0x18/0x20
[ 1694.570053]  [<ffffffff811dd443>] SyS_finit_module+0xa3/0x100
[ 1694.570053]  [<ffffffff843a6fd0>] tracesys+0xdd/0xe2
[ 1694.570053] Code: 89 c8 48 8b 5d d8 4c 8b 65 e0 4c 8b 6d e8 4c 8b 75 f0 4c 8b 7d f8 c9 c3 90 90 
90 90 90 90 55 48 89 e5 66 66 66 66 90 48 8b 47 28 <8b> 40 10 89 46 08 48 8b 47 40 48 89 06 0f b7 07 
66 89 46 0c 8b
[ 1694.570053] RIP  [<ffffffff812d77ed>] generic_fillattr+0xd/0xa0
[ 1694.570053]  RSP <ffff88013b56bdd8>
[ 1694.570053] CR2: ffff88022adf8010


Thanks,
Sasha

Re: module: BUG in copy_module_from_fd

[Sasha Levin]

On 12/20/2013 06:40 PM, Sasha Levin wrote:
> Hi all,
>
> While fuzzing with trinity inside a KVM tools guest running latest -next kernel, I've stumbled on
> the following spew.
>
> This reproduced twice with the same call trace, so I suspect it's something specific with the way
> the module subsystem calls vfs_getattr rather than something odd in vfs.

Sorry, forget that. Just got one that has nothing to do with modules:

BUG: unable to handle kernel paging request at ffff880429d40010
[ 2935.385056] IP: [<ffffffff812d792d>] generic_fillattr+0xd/0xa0
[ 2935.386268] PGD 857a067 PUD 857d067 PMD 42fe93067 PTE 8000000429d40060
[ 2935.387998] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 2935.389936] Dumping ftrace buffer:
[ 2935.390321]    (ftrace buffer empty)
[ 2935.390321] Modules linked in:
[ 2935.390321] CPU: 22 PID: 57475 Comm: trinity-c598 Tainted: G        W    3.13.0-rc4-
next-20131220-sasha-00014-gd62f590-dirty #2
[ 2935.390321] task: ffff88005d880000 ti: ffff88004e3be000 task.ti: ffff88004e3be000
[ 2935.390321] RIP: 0010:[<ffffffff812d792d>]  [<ffffffff812d792d>] generic_fillattr+0x
d/0xa0
[ 2935.390321] RSP: 0018:ffff88004e3bfe58  EFLAGS: 00010246
[ 2935.390321] RAX: ffff880429d40000 RBX: ffff88015bf9e5d0 RCX: ffff88015b700a20
[ 2935.390321] RDX: 0000000000000000 RSI: ffff88004e3bfee8 RDI: ffff88042a078550
[ 2935.390321] RBP: ffff88004e3bfe58 R08: ffff88042a078550 R09: 0000000000000000
[ 2935.390321] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88004e3bfee8
[ 2935.390321] R13: ffff88004e3bfee8 R14: 0000000000000000 R15: 0000000000000010
[ 2935.390321] FS:  00007ff7f4855700(0000) GS:ffff880161a00000(0000) knlGS:000000000000
0000
[ 2935.390321] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2935.390321] CR2: ffff880429d40010 CR3: 0000000035487000 CR4: 00000000000006e0
[ 2935.390321] Stack:
[ 2935.390321]  ffff88004e3bfe68 ffffffff812d79f8 ffff88004e3bfe88 ffffffff812d7fe7
[ 2935.390321]  ffff88015bf9e5c0 0000000000000000 ffff88004e3bfed8 ffffffff812d81f2
[ 2935.390321]  ffff88004e3bfeb8 ffff88005d880000 ffffffff81249435 0000000000000256
[ 2935.390321] Call Trace:
[ 2935.390321]  [<ffffffff812d79f8>] vfs_getattr_nosec+0x38/0x40
[ 2935.390321]  [<ffffffff812d7fe7>] vfs_getattr+0x37/0x50
[ 2935.390321]  [<ffffffff812d81f2>] vfs_fstat+0x42/0x70
[ 2935.390321]  [<ffffffff81249435>] ? context_tracking_user_exit+0x195/0x1d0
[ 2935.390321]  [<ffffffff812d852f>] SYSC_newfstat+0x1f/0x40
[ 2935.390321]  [<ffffffff8119302d>] ? trace_hardirqs_on+0xd/0x10
[ 2935.390321]  [<ffffffff8107a852>] ? syscall_trace_enter+0x32/0x290
[ 2935.390321]  [<ffffffff843b5ef1>] ? tracesys+0x7e/0xe2
[ 2935.390321]  [<ffffffff812d855e>] SyS_newfstat+0xe/0x10
[ 2935.390321]  [<ffffffff843b5f50>] tracesys+0xdd/0xe2

Thanks,
Sasha