* KASAN: stack-out-of-bounds Read in __remove_hrtimer
@ 2023-06-03 9:42 Palash Oswal
2023-06-03 19:14 ` Thomas Gleixner
0 siblings, 1 reply; 2+ messages in thread
From: Palash Oswal @ 2023-06-03 9:42 UTC (permalink / raw)
To: Thomas Gleixner, LKML, syzkaller-bugs
Hello,
I found the following issue using syzkaller with enriched corpus[1] on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux
C Reproducer : I do not have a C reproducer yet. I will update this
thread when I get one.
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f
Link:
1. https://github.com/cmu-pasta/linux-kernel-enriched-corpus
Console log :
==================================================================
BUG: KASAN: stack-out-of-bounds in __remove_hrtimer+0x250/0x2a0
Read of size 1 at addr ffffc9000358fdd0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11c/0x130
__remove_hrtimer+0x250/0x2a0
__hrtimer_run_queues+0x4e0/0xbe0
hrtimer_interrupt+0x320/0x7b0
__sysvec_apic_timer_interrupt+0x14a/0x430
sysvec_apic_timer_interrupt+0x92/0xc0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:default_idle+0xf/0x20
Code: 89 07 49 c7 c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 76 ff
ff ff cc cc cc cc f3 0f 1e fa eb 07 0f 00 2d 13 38 49 00 fb f4 <fa> c3
66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 65
RSP: 0018:ffffffff8c407e30 EFLAGS: 00000202
RAX: 000000000033b773 RBX: 0000000000000000 RCX: ffffffff89fd3ef5
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff8c495800 R08: 0000000000000001 R09: ffff888063a36cab
R10: ffffed100c746d95 R11: 0000000000000000 R12: fffffbfff1892b00
R13: 0000000000000000 R14: ffffffff8e769510 R15: 0000000000000000
default_idle_call+0x67/0xa0
do_idle+0x31e/0x3e0
[31/73]
cpu_startup_entry+0x18/0x20
rest_init+0x16d/0x2b0
arch_call_rest_init+0x13/0x30
start_kernel+0x35a/0x4d0
secondary_startup_64_no_verify+0xce/0xdb
</TASK>
The buggy address belongs to the virtual mapping at
[ffffc90003588000, ffffc90003591000) created by:
kernel_clone+0xeb/0x890
The buggy address belongs to the physical page:
page:ffffea0004a0fa00 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x1283e8
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 8032,
tgid 8032 (syz-executor.1), ts 75313358350, free_ts 0
get_page_from_freelist+0x1190/0x2e20
__alloc_pages+0x1cb/0x4a0
alloc_pages+0x1aa/0x270
__vmalloc_node_range+0xb1c/0x14a0
copy_process+0x1320/0x7590
kernel_clone+0xeb/0x890
__do_sys_clone+0xba/0x100
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page_owner free stack trace missing
Memory state around the buggy address:
ffffc9000358fc80: f3 f3 f3 00 f1 f1 f1 00 00 f2 f2 00 00 00 f3 f3
ffffc9000358fd00: f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
>ffffc9000358fd80: f3 f3 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
^
ffffc9000358fe00: f3 f3 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3
ffffc9000358fe80: f3 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3
==================================================================
----------------
Code disassembly (best guess):
0: 89 07 mov %eax,(%rdi)
2: 49 c7 c0 08 00 00 00 mov $0x8,%r8
9: 4d 29 c8 sub %r9,%r8
c: 4c 01 c7 add %r8,%rdi
f: 4c 29 c2 sub %r8,%rdx
12: e9 76 ff ff ff jmpq 0xffffff8d
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: f3 0f 1e fa endbr64
1f: eb 07 jmp 0x28
21: 0f 00 2d 13 38 49 00 verw 0x493813(%rip) # 0x49383b
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: c3 retq
2c: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
33: 00 00 00 00
37: 0f 1f 40 00 nopl 0x0(%rax)
3b: f3 0f 1e fa endbr64
3f: 65 gs
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: KASAN: stack-out-of-bounds Read in __remove_hrtimer
2023-06-03 9:42 KASAN: stack-out-of-bounds Read in __remove_hrtimer Palash Oswal
@ 2023-06-03 19:14 ` Thomas Gleixner
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Gleixner @ 2023-06-03 19:14 UTC (permalink / raw)
To: Palash Oswal, LKML, syzkaller-bugs
On Sat, Jun 03 2023 at 02:42, Palash Oswal wrote:
> Hello,
> I found the following issue using syzkaller with enriched corpus[1] on:
> HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
> git tree: linux
> C Reproducer : I do not have a C reproducer yet. I will update this
> thread when I get one.
> Kernel .config :
> https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f
That's not really helpful without knowing which compiler version.
> ==================================================================
> BUG: KASAN: stack-out-of-bounds in __remove_hrtimer+0x250/0x2a0
Can you please enable full decoding so it looks like this:
BUG: KASAN: stack-out-of-bounds in i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:546 [inline]
BUG: KASAN: stack-out-of-bounds in i801_isr drivers/i2c/busses/i2c-i801.c:613 [inline]
and the stack trace has the proper line number decoding too.
> Read of size 1 at addr ffffc9000358fdd0 by task swapper/0/0
>
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted
> 6.3.0-rc6-pasta-00035-g0bcc40255504 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
> <IRQ>
> dump_stack_lvl+0xd9/0x150
> print_address_description.constprop.0+0x2c/0x3c0
> kasan_report+0x11c/0x130
> __remove_hrtimer+0x250/0x2a0
> __hrtimer_run_queues+0x4e0/0xbe0
> hrtimer_interrupt+0x320/0x7b0
> __sysvec_apic_timer_interrupt+0x14a/0x430
> sysvec_apic_timer_interrupt+0x92/0xc0
> </IRQ>
> <TASK>
> asm_sysvec_apic_timer_interrupt+0x1a/0x20
> RIP: 0010:default_idle+0xf/0x20
> Code: 89 07 49 c7 c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 76 ff
> ff ff cc cc cc cc f3 0f 1e fa eb 07 0f 00 2d 13 38 49 00 fb f4 <fa> c3
> 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 65
Please don't wrap the output.
Also where is the RIP/Code/Register dump for the faulting context?
This one is the interrupted task context which is completely uninteresting.
> RSP: 0018:ffffffff8c407e30 EFLAGS: 00000202
> RAX: 000000000033b773 RBX: 0000000000000000 RCX: ffffffff89fd3ef5
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: ffffffff8c495800 R08: 0000000000000001 R09: ffff888063a36cab
> R10: ffffed100c746d95 R11: 0000000000000000 R12: fffffbfff1892b00
> R13: 0000000000000000 R14: ffffffff8e769510 R15: 0000000000000000
> default_idle_call+0x67/0xa0
>
> do_idle+0x31e/0x3e0
>
> [31/73]
Interesting output. Can you please reconrd the full console output and
provide a link to it so that we can look at the complete info and not at
something which was trimmed by some tool?
> ----------------
> Code disassembly (best guess):
> 0: 89 07 mov %eax,(%rdi)
> 2: 49 c7 c0 08 00 00 00 mov $0x8,%r8
> 9: 4d 29 c8 sub %r9,%r8
> c: 4c 01 c7 add %r8,%rdi
> f: 4c 29 c2 sub %r8,%rdx
> 12: e9 76 ff ff ff jmpq 0xffffff8d
> 17: cc int3
> 18: cc int3
> 19: cc int3
> 1a: cc int3
> 1b: f3 0f 1e fa endbr64
> 1f: eb 07 jmp 0x28
> 21: 0f 00 2d 13 38 49 00 verw 0x493813(%rip) # 0x49383b
> 28: fb sti
> 29: f4 hlt
> * 2a: fa cli <-- trapping instruction
That's useless because thats the disassembly of idle() which got
interrupted.
Thanks,
tglx
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-06-03 19:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-03 9:42 KASAN: stack-out-of-bounds Read in __remove_hrtimer Palash Oswal
2023-06-03 19:14 ` Thomas Gleixner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox