lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 25 Jul 2014 22:34:11 -0400
From:	Sasha Levin <sasha.levin@...cle.com>
To:	Ingo Molnar <mingo@...nel.org>, acme@...stprotocols.net,
	Peter Zijlstra <peterz@...radead.org>
CC:	Dave Jones <davej@...hat.com>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: perf: invalid memory access in perf_swevent_del

On 05/10/2014 07:34 PM, Sasha Levin wrote:
> Hi all,
> 
> While fuzzing with trinity inside a KVM tools guest running the latest -next
> kernel I've stumbled on the following spew:

Ping? I'm still seeing corruption on perf_swevent_del and perf_swevent_init:

[  488.092839] AddressSanitizer: use after free in perf_swevent_del+0x33/0x70 at addr ffff8805f430ea48
[  488.094444] page:ffffea0017d0c380 count:0 mapcount:0 mapping:          (null) index:0x0
[  488.095681] page flags: 0x6fffff80008000(tail)
[  488.096407] page dumped because: kasan error
[  488.097116] CPU: 17 PID: 9306 Comm: trinity-main Not tainted 3.16.0-rc6-next-20140725-sasha-00048-ga713fc0-dirty #937
[  488.098736]  00000000000000fb 0000000000000000 ffffea0017d0c380 ffff8805f444b740
[  488.099933]  ffffffffb6dc96f3 ffff8805f444b810 ffff8805f444b800 ffffffffb242d17c
[  488.100020]  ffff880be215f448 ffff880be215f45d ffff8805ff7e2dc0 ffff8805ff7e2dd0
[  488.100020] Call Trace:
[  488.100020] dump_stack (lib/dump_stack.c:52)
[  488.100020] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
[  488.100020] ? kvm_clock_read (./arch/x86/include/asm/preempt.h:90 arch/x86/kernel/kvmclock.c:86)
[  488.100020] ? sched_clock (./arch/x86/include/asm/paravirt.h:192 arch/x86/kernel/tsc.c:304)
[  488.100020] ? sched_clock_local (kernel/sched/clock.c:214)
[  488.100020] __asan_store8 (mm/kasan/kasan.c:400)
[  488.100020] ? perf_swevent_del (include/linux/list.h:618 include/linux/rculist.h:345 kernel/events/core.c:5758)
[  488.100020] perf_swevent_del (include/linux/list.h:618 include/linux/rculist.h:345 kernel/events/core.c:5758)
[  488.100020] event_sched_out.isra.49 (kernel/events/core.c:1416)
[  488.100020] group_sched_out (kernel/events/core.c:1442)
[  488.100020] ctx_sched_out (kernel/events/core.c:2185 (discriminator 3))
[  488.100020] __perf_event_task_sched_out (kernel/events/core.c:2360 kernel/events/core.c:2385)
[  488.100020] ? __perf_event_task_sched_out (include/linux/rcupdate.h:806 kernel/events/core.c:2314 kernel/events/core.c:2385)
[  488.100020] ? update_stats_wait_end (kernel/sched/fair.c:760)
[  488.100020] perf_event_task_sched_out (include/linux/perf_event.h:702)
[  488.100020] ? __schedule (kernel/sched/core.c:2773)
[  488.100020] ? __schedule (kernel/sched/core.c:2773)
[  488.100020] __schedule (kernel/sched/core.c:2146 kernel/sched/core.c:2184 kernel/sched/core.c:2308 kernel/sched/core.c:2810)
[  488.100020] preempt_schedule_irq (./arch/x86/include/asm/paravirt.h:814 kernel/sched/core.c:2927)
[  488.100020] retint_kernel (arch/x86/kernel/entry_64.S:935)
[  488.100020] ? __asan_load4 (mm/kasan/kasan.c:358)
[  488.100020] ? debug_lockdep_rcu_enabled (kernel/rcu/update.c:134)
[  488.100020] __fget_light (include/linux/fdtable.h:77 fs/file.c:684)
[  488.100020] __fdget_raw (fs/file.c:704)
[  488.100020] path_init (include/linux/file.h:60 fs/namei.c:1873)
[  488.100020] ? path_lookupat (fs/namei.c:1937)
[  488.100020] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
[  488.100020] path_lookupat (fs/namei.c:1937)
[  488.100020] ? poison_shadow (mm/kasan/kasan.c:76)
[  488.100020] ? unpoison_shadow (mm/kasan/kasan.c:82)
[  488.100020] ? kasan_slab_alloc (mm/kasan/kasan.c:206)
[  488.100020] ? strncpy_from_user (./arch/x86/include/asm/word-at-a-time.h:48 lib/strncpy_from_user.c:44 lib/strncpy_from_user.c:109)
[  488.100020] filename_lookup (fs/namei.c:1984)
[  488.100020] user_path_at_empty (fs/namei.c:2135)
[  488.100020] ? check_chain_key (kernel/locking/lockdep.c:2188)
[  488.100020] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[  488.100020] ? get_parent_ip (kernel/sched/core.c:2561)
[  488.100020] user_path_at (fs/namei.c:2146)
[  488.100020] vfs_fstatat (fs/stat.c:107)
[  488.100020] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
[  488.100020] SYSC_newfstatat (fs/stat.c:298)
[  488.100020] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2))
[  488.100020] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
[  488.100020] ? tracesys (arch/x86/kernel/entry_64.S:530)
[  488.100020] SyS_newfstatat (fs/stat.c:291)
[  488.100020] tracesys (arch/x86/kernel/entry_64.S:541)
[  488.100020] Write of size 8 by thread T9306:
[  488.100020] Memory state around the buggy address:
[  488.100020]  ffff8805f430e780: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430e800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020] >ffff8805f430ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]                                               ^
[  488.100020]  ffff8805f430ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430eb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  488.100020]  ffff8805f430ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

[  517.616094] =============================================================================
[  517.619549] BUG kmalloc-4096 (Not tainted): Poison overwritten
[  517.621321] -----------------------------------------------------------------------------
[  517.621321]
[  517.621321] Disabling lock debugging due to kernel taint
[  517.621321] INFO: 0xffff8805f430ea48-0xffff8805f430eb77. First byte 0x0 instead of 0x6b
[  517.621321] INFO: Allocated in perf_swevent_init+0x29f/0x440 age=14082 cpu=17 pid=9306
[  517.621321]  __slab_alloc+0x65e/0x740
[  517.621321]  kmem_cache_alloc_trace+0x17c/0x3a0
[  517.621321]  perf_swevent_init+0x29f/0x440
[  517.621321]  perf_init_event+0x293/0x340
[  517.621321]  perf_event_alloc+0x5b8/0x6e0
[  517.621321]  SYSC_perf_event_open+0x39b/0xf50
[  517.621321]  SyS_perf_event_open+0x9/0x10
[  517.621321]  tracesys+0xe1/0xe6
[  517.621321] INFO: Freed in rcu_nocb_kthread+0x911/0x13f0 age=2958 cpu=3 pid=25
[  517.621321]  __slab_free+0x276/0x3e0
[  517.621321]  kfree+0x31a/0x390
[  517.621321]  rcu_nocb_kthread+0x911/0x13f0
[  517.621321]  kthread+0x144/0x170
[  517.621321]  ret_from_fork+0x7c/0xb0
[  517.621321] INFO: Slab 0xffffea0017d0c200 objects=7 used=7 fp=0x          (null) flags=0x6fffff80004080
[  517.621321] INFO: Object 0xffff8805f430e7b0 @offset=26544 fp=0xffff8805f4308000
[...]


Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists