* Out of bounds access in get_wchan
@ 2015-09-13 20:44 Sasha Levin
2015-09-14 14:12 ` Andrey Ryabinin
0 siblings, 1 reply; 2+ messages in thread
From: Sasha Levin @ 2015-09-13 20:44 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, H. Peter Anvin, Andy Lutomirski
Cc: Andrey Ryabinin, Andrey Konovalov, x86@kernel.org, LKML
Hi all,
I've stumbled on the following while fuzzing with trinity inside a KVM tools guest
running the latest -next:
[635339.148553] BUG: KASan: out of bounds access in get_wchan+0x155/0x190 at addr ffff88032c0c7cc0
[635339.151199] Read of size 8 by task killall/31040
[635339.152690] page:ffffea000cb031c0 count:0 mapcount:0 mapping: (null) index:0x0
[635339.155124] flags: 0x1afffff80000000()
[635339.155740] page dumped because: kasan: bad access detected
[635339.156603] CPU: 9 PID: 31040 Comm: killall Not tainted 4.2.0-next-20150908-sasha-00043-g5af04dd #2534
[635339.158068] 0000000000010000 ffff8804590677c0 ffffffffaafc306a ffff880459067848
[635339.159293] ffff880459067838 ffffffffa97dacbe ffff8802f69d8d18 0000000000000001
[635339.160509] 0000000000000282 ffff8802f69d8000 0000000000000000 0000000000000007
[635339.161744] Call Trace:
[635339.162235] dump_stack (lib/dump_stack.c:52)
[635339.163061] kasan_report_error (mm/kasan/report.c:132 mm/kasan/report.c:193)
[635339.163975] __asan_report_load8_noabort (mm/kasan/report.c:251)
[635339.164965] ? get_wchan (arch/x86/kernel/process_64.c:513)
[635339.165784] get_wchan (arch/x86/kernel/process_64.c:513)
[635339.166615] do_task_stat (fs/proc/array.c:458)
[635339.167646] ? children_seq_stop (fs/proc/array.c:377)
[635339.168575] ? lockdep_init (kernel/locking/lockdep.c:3298)
[635339.169423] ? lockdep_init (kernel/locking/lockdep.c:3298)
[635339.170272] ? get_parent_ip (kernel/sched/core.c:2850)
[635339.171106] ? lock_release (kernel/locking/lockdep.c:3641)
[635339.171981] ? __lock_is_held (kernel/locking/lockdep.c:3491)
[635339.172846] ? lock_is_held (kernel/locking/lockdep.c:3661)
[635339.173722] ? get_pid_task (include/linux/rcupdate.h:914 kernel/pid.c:483)
[635339.174578] proc_tgid_stat (fs/proc/array.c:553)
[635339.175414] proc_single_show (./arch/x86/include/asm/atomic.h:118 include/linux/sched.h:2014 fs/proc/base.c:792)
[635339.176297] seq_read (fs/seq_file.c:232)
[635339.177229] ? seq_lseek (fs/seq_file.c:163)
[635339.178085] ? vma_merge (mm/mmap.c:1112)
[635339.178914] ? lockdep_init (kernel/locking/lockdep.c:3298)
[635339.179757] ? get_parent_ip (kernel/sched/core.c:2850)
[635339.180604] __vfs_read (fs/read_write.c:430)
[635339.181394] ? lock_release (kernel/locking/lockdep.c:3641)
[635339.182266] ? default_llseek (fs/read_write.c:430)
[635339.183163] ? __fsnotify_inode_delete (fs/notify/fsnotify.c:192)
[635339.184150] ? vm_mmap_pgoff (mm/util.c:330)
[635339.185026] ? up_write (kernel/locking/rwsem.h:9 kernel/locking/rwsem.c:93)
[635339.185845] ? security_file_permission (include/linux/fsnotify.h:60 security/security.c:737)
[635339.186912] ? rw_verify_area (fs/read_write.c:406 (discriminator 4))
[635339.188753] vfs_read (fs/read_write.c:454)
[635339.190331] ? __fget_light (fs/file.c:719)
[635339.192068] SyS_read (fs/read_write.c:570 fs/read_write.c:562)
[635339.193647] ? do_sendfile (fs/read_write.c:562)
[635339.195420] ? lockdep_sys_exit_thunk (arch/x86/entry/thunk_64.S:44)
[635339.196893] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
[635339.197836] Memory state around the buggy address:
[635339.198565] ffff88032c0c7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[635339.199626] ffff88032c0c7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[635339.200704] >ffff88032c0c7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[635339.201770] ^
[635339.202594] ffff88032c0c7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[635339.203665] ffff88032c0c7d80: 00 00 00 00 f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2
Thanks,
Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Out of bounds access in get_wchan
2015-09-13 20:44 Out of bounds access in get_wchan Sasha Levin
@ 2015-09-14 14:12 ` Andrey Ryabinin
0 siblings, 0 replies; 2+ messages in thread
From: Andrey Ryabinin @ 2015-09-14 14:12 UTC (permalink / raw)
To: Sasha Levin
Cc: Thomas Gleixner, Ingo Molnar, H. Peter Anvin, Andy Lutomirski,
Andrey Konovalov, x86@kernel.org, LKML, Dmitry Vyukov
2015-09-13 23:44 GMT+03:00 Sasha Levin <sasha.levin@oracle.com>:
> Hi all,
>
> I've stumbled on the following while fuzzing with trinity inside a KVM tools guest
> running the latest -next:
>
> [635339.148553] BUG: KASan: out of bounds access in get_wchan+0x155/0x190 at addr ffff88032c0c7cc0
AFAIK get_wchan() is racy by design, it may access to volatile stack
of another task and in the worst case
we will see some garbage.
So I think we could just disable kasan reports here.
But, there is a real bug in get_wchan(), reported a long ago, and
still not fixed: http://www.spinics.net/lists/kernel/msg1596173.html
I guess that eventually nobody sent the patch for it.
> [635339.151199] Read of size 8 by task killall/31040
> [635339.152690] page:ffffea000cb031c0 count:0 mapcount:0 mapping: (null) index:0x0
> [635339.155124] flags: 0x1afffff80000000()
> [635339.155740] page dumped because: kasan: bad access detected
> [635339.156603] CPU: 9 PID: 31040 Comm: killall Not tainted 4.2.0-next-20150908-sasha-00043-g5af04dd #2534
> [635339.158068] 0000000000010000 ffff8804590677c0 ffffffffaafc306a ffff880459067848
> [635339.159293] ffff880459067838 ffffffffa97dacbe ffff8802f69d8d18 0000000000000001
> [635339.160509] 0000000000000282 ffff8802f69d8000 0000000000000000 0000000000000007
> [635339.161744] Call Trace:
> [635339.162235] dump_stack (lib/dump_stack.c:52)
> [635339.163061] kasan_report_error (mm/kasan/report.c:132 mm/kasan/report.c:193)
> [635339.163975] __asan_report_load8_noabort (mm/kasan/report.c:251)
> [635339.164965] ? get_wchan (arch/x86/kernel/process_64.c:513)
> [635339.165784] get_wchan (arch/x86/kernel/process_64.c:513)
> [635339.166615] do_task_stat (fs/proc/array.c:458)
> [635339.167646] ? children_seq_stop (fs/proc/array.c:377)
> [635339.168575] ? lockdep_init (kernel/locking/lockdep.c:3298)
> [635339.169423] ? lockdep_init (kernel/locking/lockdep.c:3298)
> [635339.170272] ? get_parent_ip (kernel/sched/core.c:2850)
> [635339.171106] ? lock_release (kernel/locking/lockdep.c:3641)
> [635339.171981] ? __lock_is_held (kernel/locking/lockdep.c:3491)
> [635339.172846] ? lock_is_held (kernel/locking/lockdep.c:3661)
> [635339.173722] ? get_pid_task (include/linux/rcupdate.h:914 kernel/pid.c:483)
> [635339.174578] proc_tgid_stat (fs/proc/array.c:553)
> [635339.175414] proc_single_show (./arch/x86/include/asm/atomic.h:118 include/linux/sched.h:2014 fs/proc/base.c:792)
> [635339.176297] seq_read (fs/seq_file.c:232)
> [635339.177229] ? seq_lseek (fs/seq_file.c:163)
> [635339.178085] ? vma_merge (mm/mmap.c:1112)
> [635339.178914] ? lockdep_init (kernel/locking/lockdep.c:3298)
> [635339.179757] ? get_parent_ip (kernel/sched/core.c:2850)
> [635339.180604] __vfs_read (fs/read_write.c:430)
> [635339.181394] ? lock_release (kernel/locking/lockdep.c:3641)
> [635339.182266] ? default_llseek (fs/read_write.c:430)
> [635339.183163] ? __fsnotify_inode_delete (fs/notify/fsnotify.c:192)
> [635339.184150] ? vm_mmap_pgoff (mm/util.c:330)
> [635339.185026] ? up_write (kernel/locking/rwsem.h:9 kernel/locking/rwsem.c:93)
> [635339.185845] ? security_file_permission (include/linux/fsnotify.h:60 security/security.c:737)
> [635339.186912] ? rw_verify_area (fs/read_write.c:406 (discriminator 4))
> [635339.188753] vfs_read (fs/read_write.c:454)
> [635339.190331] ? __fget_light (fs/file.c:719)
> [635339.192068] SyS_read (fs/read_write.c:570 fs/read_write.c:562)
> [635339.193647] ? do_sendfile (fs/read_write.c:562)
> [635339.195420] ? lockdep_sys_exit_thunk (arch/x86/entry/thunk_64.S:44)
> [635339.196893] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
> [635339.197836] Memory state around the buggy address:
> [635339.198565] ffff88032c0c7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [635339.199626] ffff88032c0c7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [635339.200704] >ffff88032c0c7c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [635339.201770] ^
> [635339.202594] ffff88032c0c7d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [635339.203665] ffff88032c0c7d80: 00 00 00 00 f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2
>
>
> Thanks,
> Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-09-14 14:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-09-13 20:44 Out of bounds access in get_wchan Sasha Levin
2015-09-14 14:12 ` Andrey Ryabinin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.