From: Dave Jones <davej@codemonkey.org.uk>
To: netdev@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>,
Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: out of bounds in pptp_connect.
Date: Wed, 20 Jan 2016 18:08:09 -0500 [thread overview]
Message-ID: <20160120230809.GA23182@codemonkey.org.uk> (raw)
In-Reply-To: <20160117170658.GA9973@codemonkey.org.uk>
On Sun, Jan 17, 2016 at 12:06:58PM -0500, Dave Jones wrote:
> I've managed to trigger this a few times the last few days, on Linus' tree.
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in pptp_connect+0xb7b/0xc70 [pptp] at addr ffff8800242da0d0
> Read of size 2 by task trinity-c14/13664
> =============================================================================
> BUG kmalloc-8192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in copy_thread_tls+0x6b3/0x8d0 age=5483091 cpu=1 pid=18329
> ___slab_alloc.constprop.66+0x4de/0x580
> __slab_alloc.isra.63.constprop.65+0x48/0x80
> __kmalloc_track_caller+0x2a2/0x2f0
> kmemdup+0x20/0x50
> copy_thread_tls+0x6b3/0x8d0
> copy_process.part.40+0x3679/0x57b0
> _do_fork+0x16c/0xba0
> SyS_clone+0x19/0x20
> tracesys_phase2+0x84/0x89
> INFO: Freed in x86_pmu_event_init+0x477/0x550 age=5483145 cpu=1 pid=18329
> __slab_free+0x18b/0x2b0
> kfree+0x272/0x290
> x86_pmu_event_init+0x477/0x550
> perf_try_init_event+0x164/0x1c0
> perf_event_alloc+0x1235/0x18c0
> inherit_event.isra.88+0xd4/0x6c0
> inherit_task_group.isra.90.part.91+0x68/0x200
> perf_event_init_task+0x41f/0x830
> copy_process.part.40+0x15d6/0x57b0
> _do_fork+0x16c/0xba0
> SyS_clone+0x19/0x20
> tracesys_phase2+0x84/0x89
I'm now seeing different bug type, with similar traces.
Instead of an out of bounds, it's now a use-after-free, but
it's interesting that it's complaining about memory that used
to belong to perf again. Could the bug be in perf ?
Dave
BUG: KASAN: use-after-free in pptp_connect+0x19f/0x5e0 [pptp] at addr ffff8804632ba0d0
Read of size 2 by task trinity-c4/18013
=============================================================================
BUG kmalloc-2048 (Tainted: G W ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in perf_event_alloc+0x72/0xd60 age=5653 cpu=0 pid=17555
___slab_alloc.constprop.71+0x523/0x5c0
__slab_alloc.isra.67.constprop.70+0x48/0x80
kmem_cache_alloc_trace+0x24c/0x2e0
perf_event_alloc+0x72/0xd60
inherit_event.isra.90+0x82/0x3a0
inherit_task_group.isra.92.part.93+0x55/0x120
perf_event_init_task+0x35a/0x530
copy_process.part.40+0xb3d/0x2db0
_do_fork+0x164/0x880
SyS_clone+0x19/0x20
tracesys_phase2+0x84/0x89
INFO: Freed in free_event_rcu+0x38/0x40 age=5635 cpu=0 pid=17555
__slab_free+0x19e/0x2d0
kfree+0x25c/0x280
free_event_rcu+0x38/0x40
rcu_process_callbacks+0xbac/0x1200
__do_softirq+0x1a4/0x590
irq_exit+0xf5/0x100
smp_apic_timer_interrupt+0x5c/0x70
apic_timer_interrupt+0x90/0xa0
context_tracking_exit+0x1d/0x20
enter_from_user_mode+0x1f/0x50
syscall_trace_enter_phase1+0x1cb/0x260
tracesys+0xd/0x44
INFO: Slab 0xffffea00118cae00 objects=13 used=9 fp=0xffff8804632bae68 flags=0x8000000000004080
INFO: Object 0xffff8804632b9bd8 @offset=7128 fp=0xffff8804632be618
prev parent reply other threads:[~2016-01-20 23:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-17 17:06 out of bounds in pptp_connect Dave Jones
2016-01-20 23:08 ` Dave Jones [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160120230809.GA23182@codemonkey.org.uk \
--to=davej@codemonkey.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).