| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 25 Feb 2018 16:23:10 +0800
From: kernel test robot <fengguang.wu@...el.com>
To: David Woodhouse <dwmw@...zon.co.uk>
Cc: Ingo Molnar <mingo@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Peter Zijlstra <peterz@...radead.org>,
LKML <linux-kernel@...r.kernel.org>,
"H. Peter Anvin" <hpa@...or.com>, tipbuild@...or.com, lkp@...org
Subject: [x86/retpoline] d1c99108af: BUG:KASAN:stack-out-of-bounds_in_u
FYI, we noticed the following commit (built with gcc-7):
commit: d1c99108af3c5992640aa2afa7d2e88c3775c06e ("Revert "x86/retpoline: Simplify vmexit_fill_RSB()"")
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git x86/pti
in testcase: trinity
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu host -smp 2 -m 1G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+------------------------------------+------------+------------+
| | 8554004a02 | d1c99108af |
+------------------------------------+------------+------------+
| boot_successes | 214 | 187 |
| boot_failures | 0 | 27 |
| BUG:KASAN:stack-out-of-bounds_in_u | 0 | 25 |
| RIP:__x86_indirect_thunk_rdx | 0 | 27 |
+------------------------------------+------------+------------+
[ 85.516480] BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0xc2c/0xebe
[ 85.518482] Read of size 8 at addr ffff880028997868 by task trinity-main/571
[ 85.520465]
[ 85.521104] CPU: 0 PID: 571 Comm: trinity-main Not tainted 4.16.0-rc1-00089-gd1c9910 #1
[ 85.523462] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 85.525890] Call Trace:
[ 85.526743] <IRQ>
[ 85.527486] print_address_description+0x55/0x1f8
[ 85.528908] ? unwind_next_frame+0xc2c/0xebe
[ 85.530211] kasan_report+0x244/0x282
[ 85.531363] unwind_next_frame+0xc2c/0xebe
[ 85.532649] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.534187] ? unwind_get_return_address_ptr+0x9a/0x9a
[ 85.535711] ? is_ftrace_trampoline+0x5/0xc
[ 85.537002] ? kernel_text_address+0x16/0x47
[ 85.538307] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.539852] __save_stack_trace+0x99/0xe7
[ 85.541098] ? rcu_process_callbacks+0x960/0xd80
[ 85.542487] save_stack+0x32/0xa3
[ 85.543593] ? __kasan_slab_free+0xd7/0xfa
[ 85.544843] ? kmem_cache_free+0x5f/0xf4
[ 85.546072] ? rcu_process_callbacks+0x960/0xd80
[ 85.547461] ? __do_softirq+0x2c6/0x5a7
[ 85.548667] ? irq_exit+0xaa/0xf7
[ 85.549724] ? smp_apic_timer_interrupt+0x233/0x243
[ 85.551168] ? apic_timer_interrupt+0x84/0x90
[ 85.552490] ? __x86_indirect_thunk_rcx+0x20/0x20
[ 85.553920] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.556133] ? check_chain_key+0x192/0x25a
[ 85.558305] ? lock_release+0x63c/0x677
[ 85.560348] ? lock_downgrade+0x4a3/0x4a3
[ 85.562199] ? lock_downgrade+0x4a3/0x4a3
[ 85.563449] ? lock_unpin_lock+0x277/0x298
[ 85.564708] ? check_chain_key+0x192/0x25a
[ 85.565964] ? __lock_acquire+0xb73/0xc79
[ 85.567373] ? debug_check_no_locks_freed+0x212/0x24f
[ 85.568877] __kasan_slab_free+0xd7/0xfa
[ 85.570096] ? rcu_process_callbacks+0x960/0xd80
[ 85.571478] ? vfs_dedupe_file_range+0x63a/0x63a
[ 85.572875] kmem_cache_free+0x5f/0xf4
[ 85.574058] rcu_process_callbacks+0x960/0xd80
[ 85.575398] ? wait_rcu_exp_gp+0x99/0x99
[ 85.576621] ? kvm_clock_read+0x12/0x20
[ 85.577803] ? timekeeping_get_ns+0xd7/0x1e3
[ 85.579115] __do_softirq+0x2c6/0x5a7
[ 85.580268] irq_exit+0xaa/0xf7
[ 85.581306] smp_apic_timer_interrupt+0x233/0x243
[ 85.582726] apic_timer_interrupt+0x84/0x90
[ 85.584019] </IRQ>
[ 85.584789] RIP: 0010:__x86_indirect_thunk_rdx+0x0/0x20
[ 85.586329] RSP: 0000:ffff880028997840 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff12
[ 85.588591] RAX: dffffc0000000000 RBX: ffff880028997900 RCX: ffffffff83400001
[ 85.590578] RDX: ffffffff81094401 RSI: 0000000000000005 RDI: ffffffff85665050
[ 85.592588] RBP: ffffffff859ea9fe R08: 000000000008f035 R09: ffff880028997900
[ 85.594607] R10: 0000000000000001 R11: ffff880028997957 R12: ffff880028997950
[ 85.596594] R13: ffff880028997935 R14: ffffffff859eaa02 R15: 00000000000000b8
[ 85.598614] ? native_usergs_sysret64+0x1/0x10
[ 85.599955] ? unwind_next_frame+0x294/0xebe
[ 85.601266] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.602760] RIP: 28997980:0xffff880028997990
[ 85.604063] RSP: b188480:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 32023e70b7472f00
[ 85.606378] RAX: 0000000000000000 RBX: ffffffff8436fce5 RCX: ffffffff81176d70
[ 85.608393] RDX: ffff8800289978d0 RSI: ffffffff81176d31 RDI: ffffffff83400083
[ 85.610415] RBP: 0000000041b58ab3 R08: ffff880028997918 R09: ffff880028997f58
[ 85.612437] R10: ffffffff81176d4e R11: ffffffff8109416d R12: ffff880028997f58
[ 85.614462] R13: ffff880028997f58 R14: 1ffff10005132f0d R15: 0000000105132f0d
[ 85.616507] ? unwind_get_return_address_ptr+0x9a/0x9a
[ 85.618043] ? kernel_text_address+0x33/0x47
[ 85.619349] ? __kernel_text_address+0xe/0x30
[ 85.620684] ? kernel_text_address+0x16/0x47
[ 85.621986] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.625263] ? __save_stack_trace+0x99/0xe7
[ 85.626535] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.628069] ? save_stack+0x32/0xa3
[ 85.629185] ? kasan_kmalloc+0x86/0x94
[ 85.630352] ? kmem_cache_alloc+0xd8/0x165
[ 85.631623] ? copy_process+0x22b9/0x4386
[ 85.632873] ? _do_fork+0x10c/0x4c6
[ 85.633985] ? do_syscall_64+0x1bc/0x1f6
[ 85.635214] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 85.636773] ? lock_release+0x63c/0x677
[ 85.638105] ? lock_downgrade+0x4a3/0x4a3
[ 85.639403] ? check_chain_key+0x192/0x25a
[ 85.640727] ? check_chain_key+0x192/0x25a
[ 85.642033] ? lock_release+0x63c/0x677
[ 85.643288] ? kasan_unpoison_shadow+0xf/0x2e
[ 85.644696] ? kasan_kmalloc+0x86/0x94
[ 85.645918] ? kmem_cache_alloc+0xd8/0x165
[ 85.647237] ? copy_process+0x22b9/0x4386
[ 85.648533] ? __cleanup_sighand+0x24/0x24
[ 85.649843] ? SyS_waitid+0xa/0xa
[ 85.650966] ? fcntl_setlk+0x751/0x751
[ 85.652197] ? check_chain_key+0x192/0x25a
[ 85.653531] ? _do_fork+0x10c/0x4c6
[ 85.654714] ? fork_idle+0x1e7/0x1e7
[ 85.655896] ? lock_downgrade+0x4a3/0x4a3
[ 85.657190] ? do_sys_open+0x1a3/0x1dd
[ 85.658410] ? preempt_latency_stop+0x20/0x3e
[ 85.659789] ? trace_preempt_on+0x5/0x18
[ 85.661059] ? sys_vfork+0x1b/0x1b
[ 85.662195] ? do_syscall_64+0x1bc/0x1f6
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
lkp
View attachment "config-4.16.0-rc1-00089-gd1c9910" of type "text/plain" (119594 bytes)
View attachment "job-script" of type "text/plain" (3884 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (31452 bytes)
Powered by blists - more mailing lists