| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 26 Jul 2023 21:52:45 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, syzkaller
<syzkaller@...glegroups.com>, Kees Cook <keescook@...omium.org>,
<netdev@...r.kernel.org>, "David S. Miller" <davem@...emloft.net>, "Eric
Dumazet" <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>, Willem de Bruijn <willemdebruijn.kernel@...il.com>,
"Gustavo A. R. Silva" <gustavoars@...nel.org>, Breno Leitao
<leitao@...ian.org>, Kuniyuki Iwashima <kuniyu@...zon.com>, Kuniyuki Iwashima
<kuni1840@...il.com>, <oliver.sang@...el.com>
Subject: Re: [PATCH v3 net 1/2] af_unix: Fix fortify_panic() in
unix_bind_bsd().
Hello,
kernel test robot noticed "BUG:KASAN:slab-out-of-bounds_in_strlen" on:
commit: 33652e138afbe3f7c814567c4ffdf57492664220 ("[PATCH v3 net 1/2] af_unix: Fix fortify_panic() in unix_bind_bsd().")
url: https://github.com/intel-lab-lkp/linux/commits/Kuniyuki-Iwashima/af_unix-Fix-fortify_panic-in-unix_bind_bsd/20230725-053836
base: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git 22117b3ae6e37d07225653d9ae5ae86b3a54f99c
patch link: https://lore.kernel.org/all/20230724213425.22920-2-kuniyu@amazon.com/
patch subject: [PATCH v3 net 1/2] af_unix: Fix fortify_panic() in unix_bind_bsd().
in testcase: boot
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
[ 33.452659][ T68] ==================================================================
[ 33.453726][ T68] BUG: KASAN: slab-out-of-bounds in strlen+0x35/0x4f
[ 33.454515][ T68] Read of size 1 at addr ffff88812ff65577 by task udevd/68
[ 33.455352][ T68]
[ 33.455644][ T68] CPU: 0 PID: 68 Comm: udevd Not tainted 6.5.0-rc2-00197-g33652e138afb #1
[ 33.456627][ T68] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 33.457802][ T68] Call Trace:
[ 33.458184][ T68] <TASK>
[ 33.458521][ T68] print_address_description+0x4d/0x2dd
[ 33.459259][ T68] print_report+0x139/0x241
[ 33.459783][ T68] ? __phys_addr+0x91/0xa3
[ 33.460290][ T68] ? virt_to_folio+0x5/0x27
[ 33.460800][ T68] ? strlen+0x35/0x4f
[ 33.461241][ T68] kasan_report+0xaf/0xda
[ 33.461756][ T68] ? strlen+0x35/0x4f
[ 33.462218][ T68] strlen+0x35/0x4f
[ 33.462657][ T68] getname_kernel+0xe/0x234
[ 33.463190][ T68] kern_path_create+0x18/0x4d
[ 33.463727][ T68] unix_bind_bsd+0x180/0x5a4
[ 33.464367][ T68] ? unix_create_addr+0xdd/0xdd
[ 33.464929][ T68] __sys_bind+0xf2/0x15f
[ 33.465437][ T68] ? __ia32_sys_socketpair+0xb3/0xb3
[ 33.466046][ T68] __x64_sys_bind+0x79/0x87
[ 33.466575][ T68] do_syscall_64+0x6b/0x87
[ 33.467094][ T68] ? lockdep_hardirqs_on_prepare+0x326/0x350
[ 33.467780][ T68] ? do_syscall_64+0x78/0x87
[ 33.468305][ T68] ? lockdep_hardirqs_on_prepare+0x326/0x350
[ 33.468989][ T68] ? do_syscall_64+0x78/0x87
[ 33.469538][ T68] ? do_syscall_64+0x78/0x87
[ 33.470051][ T68] ? do_syscall_64+0x78/0x87
[ 33.470576][ T68] ? lockdep_hardirqs_on_prepare+0x326/0x350
[ 33.471268][ T68] entry_SYSCALL_64_after_hwframe+0x5d/0xc7
[ 33.471917][ T68] RIP: 0033:0x7fd5b1091b77
[ 33.472426][ T68] Code: ff ff ff ff c3 48 8b 15 17 b3 0b 00 f7 d8 64 89 02 b8 ff ff ff ff eb ba 66 2e 0f 1f 84 00 00 00 00 00 90 b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 b2 0b 00 f7 d8 64 89 01 48
[ 33.474908][ T68] RSP: 002b:00007ffddf8bb5c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
[ 33.475878][ T68] RAX: ffffffffffffffda RBX: 000055dcbcd8e8c0 RCX: 00007fd5b1091b77
[ 33.476785][ T68] RDX: 0000000000000013 RSI: 000055dcbcd8e8d8 RDI: 0000000000000003
[ 33.477697][ T68] RBP: 000055dcbcd8e8d8 R08: 0000000000000004 R09: 000055dcbcd8ed50
[ 33.478561][ T68] R10: 00007ffddf8bb5d4 R11: 0000000000000246 R12: 00007ffddf8bbe18
[ 33.479431][ T68] R13: 00007ffddf8bbe10 R14: 0000000000000000 R15: 000055dcbcd8e260
[ 33.480352][ T68] </TASK>
[ 33.480723][ T68]
[ 33.481014][ T68] Allocated by task 68:
[ 33.481537][ T68] stack_trace_save+0x77/0x98
[ 33.482086][ T68] kasan_save_stack+0x2e/0x53
[ 33.482644][ T68] kasan_set_track+0x20/0x2c
[ 33.483188][ T68] ____kasan_kmalloc+0x68/0x7b
[ 33.483761][ T68] __kmalloc+0xac/0xe5
[ 33.484260][ T68] unix_create_addr+0x1f/0xdd
[ 33.484821][ T68] unix_bind_bsd+0x161/0x5a4
[ 33.485512][ T68] __sys_bind+0xf2/0x15f
[ 33.486024][ T68] __x64_sys_bind+0x79/0x87
[ 33.486559][ T68] do_syscall_64+0x6b/0x87
[ 33.487066][ T68] entry_SYSCALL_64_after_hwframe+0x5d/0xc7
[ 33.487761][ T68]
[ 33.488048][ T68] The buggy address belongs to the object at ffff88812ff65500
[ 33.488048][ T68] which belongs to the cache kmalloc-128 of size 128
[ 33.489631][ T68] The buggy address is located 0 bytes to the right of
[ 33.489631][ T68] allocated 119-byte region [ffff88812ff65500, ffff88812ff65577)
[ 33.491272][ T68]
[ 33.491571][ T68] The buggy address belongs to the physical page:
[ 33.492321][ T68] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ff65
[ 33.493503][ T68] flags: 0x8000000000000200(slab|zone=2)
[ 33.494120][ T68] page_type: 0xffffffff()
[ 33.494610][ T68] raw: 8000000000000200 ffff8881000418c0 dead000000000122 0000000000000000
[ 33.495560][ T68] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 33.496528][ T68] page dumped because: kasan: bad access detected
[ 33.497265][ T68] page_owner tracks the page as allocated
[ 33.497959][ T68] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper), ts 31189252946, free_ts 0
[ 33.499819][ T68] __set_page_owner+0x15/0x59
[ 33.500391][ T68] prep_new_page+0x17/0x70
[ 33.500931][ T68] get_page_from_freelist+0x1ca/0x3d2
[ 33.501972][ T68] __alloc_pages+0x159/0x25f
[ 33.502494][ T68] alloc_slab_page+0x1a/0x4c
[ 33.503011][ T68] allocate_slab+0x59/0x1b6
[ 33.503517][ T68] ___slab_alloc+0x348/0x510
[ 33.504034][ T68] __slab_alloc+0x11/0x27
[ 33.504641][ T68] __kmem_cache_alloc_node+0x63/0x10d
[ 33.505246][ T68] __kmalloc+0x9b/0xe5
[ 33.505736][ T68] pci_create_attr+0x33/0x3c4
[ 33.506282][ T68] pci_create_resource_files+0x9c/0x126
[ 33.506907][ T68] pci_sysfs_init+0x66/0xf1
[ 33.507434][ T68] do_one_initcall+0xc3/0x274
[ 33.507955][ T68] do_initcalls+0x308/0x366
[ 33.508479][ T68] kernel_init_freeable+0x2b1/0x315
[ 33.509081][ T68] page_owner free stack trace missing
[ 33.509687][ T68]
[ 33.509974][ T68] Memory state around the buggy address:
[ 33.510640][ T68] ffff88812ff65400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 33.511564][ T68] ffff88812ff65480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 33.512499][ T68] >ffff88812ff65500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc
[ 33.513453][ T68] ^
[ 33.514393][ T68] ffff88812ff65580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 33.515328][ T68] ffff88812ff65600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 33.516257][ T68] ==================================================================
[ 33.517245][ T68] Disabling lock debugging due to kernel taint
[ 33.518764][ T68] udevd[68]: starting version 3.2.7
To reproduce:
# build kernel
cd linux
cp config-6.5.0-rc2-00197-g33652e138afb .config
make HOSTCC=gcc-12 CC=gcc-12 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-12 CC=gcc-12 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
View attachment "config-6.5.0-rc2-00197-g33652e138afb" of type "text/plain" (155219 bytes)
View attachment "job-script" of type "text/plain" (4959 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (13544 bytes)
Powered by blists - more mailing lists