linux-kernel - perf: fuzzer BUG: KASAN: stack-out-of-bounds in __unwind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 24 Nov 2016 12:33:48 -0500 (EST)
From:   Vince Weaver <vincent.weaver@...ne.edu>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
cc:     Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        "dvyukov@...gle.com" <dvyukov@...gle.com>
Subject: perf: fuzzer BUG: KASAN: stack-out-of-bounds in __unwind_start


This is on a skylake machine, linus git as of yesterday after the various 
kasan-related fixes went in.  Not sure if there were any that hadn't hit 
upstream yet.

Anyway I can't tell from this one what the actual trigger is.  After this 
mess the fuzzer process was locked, udev started complaining, and it 
eventually died completely after a few hours of repeated messages like 
this.

[38898.373183] INFO: rcu_sched self-detected stall on CPU
[38898.378452]  7-...: (5249 ticks this GP) idle=727/140000000000001/0 softirq=3141908/3141908 fqs=2625 
[38898.381211] INFO: rcu_sched detected stalls on CPUs/tasks:
[38898.381214]  0-...: (1 GPs behind) idle=05f/140000000000001/2 softirq=3285458/3285459 fqs=2625 
[38898.381217]  7-...: (5249 ticks this GP) idle=727/140000000000001/0 softirq=3141908/3141908 fqs=2625 
[38898.381218]  (detected by 1, t=5252 jiffies, g=3685053, c=3685052, q=32)
[38898.381244] ==================================================================
[38898.381247] BUG: KASAN: stack-out-of-bounds in __unwind_start+0x1a2/0x1c0 at addr ffff8801e9727c28
[38898.381248] Read of size 8 by task swapper/1/0
[38898.381250] page:ffffea0007a5c9c0 count:0 mapcount:0 mapping:          (null) index:0x0
[38898.381251] flags: 0x2ffff8000000000()
[38898.381251] page dumped because: kasan: bad access detected
[38898.381328] Memory state around the buggy address:
[38898.381330]  ffff8801e9727b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[38898.381331]  ffff8801e9727b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[38898.381332] >ffff8801e9727c00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3
[38898.381333]                                   ^
[38898.381334]  ffff8801e9727c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1
[38898.381335]  ffff8801e9727d00: f1 f1 f1 00 00 00 f4 f2 f2 f2 f2 00 00 00 00 f3
[38898.381335] ==================================================================
[38898.510702]   (t=5284 jiffies g=3685053 c=3685052 q=32)

(That's all, the report above repeats but no useful things like a 
backtrace are ever printed)