linux-kernel - Re: perf: fuzzer KASAN unwind_get_return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+Ytqzyrob+6p1-eQAagKJDMw-kNvm89uP+5podaKzC_jQ@mail.gmail.com>
Date:   Tue, 15 Nov 2016 11:04:45 -0800
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Vince Weaver <vincent.weaver@...ne.edu>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        "davej@...emonkey.org.uk" <davej@...emonkey.org.uk>,
        Stephane Eranian <eranian@...il.com>, jpoimboe@...hat.com
Subject: Re: perf: fuzzer KASAN unwind_get_return_address

On Tue, Nov 15, 2016 at 10:57 AM, Peter Zijlstra <peterz@...radead.org> wrote:
> On Tue, Nov 15, 2016 at 12:43:56PM -0500, Vince Weaver wrote:
>>
>> Running on my haswell machine with the imc/uncore patch applied, the
>> perf_fuzzer next tripped over this issue.
>>
>> [  202.034495] BAD LUCK: lost 371 message(s) from NMI context!
>> [  202.034496] ==================================================================
>> [  202.048327] BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x35/0x80 at addr ffff8800cff0bd90
>> [  202.058826] Read of size 8 by task perf_fuzzer/16254
>> [  202.064186] page:ffffea00033fc2c0 count:1 mapcount:0 mapping:          (null) index:0x0^Ac
>> [  202.073068] flags: 0x1ffff8000000400(reserved)
>> [  202.077885] page dumped because: kasan: bad access detected
>> [  202.083880] CPU: 4 PID: 16254 Comm: perf_fuzzer Not tainted 4.9.0-rc5+ #5
>> [  202.091204] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
>> [  202.099181]  ffff8800cff0b1d8^Ac ffffffff816bb796^Ac ffff8800cff0b270^Ac ffff8800cff0bd90^Ac
>> [  202.107896]  ffff8800cff0b260^Ac ffffffff812fbe95^Ac 00007ffc9d1ab480^Ac 0000000000000000^Ac
>> [  202.116638]  ffffffff8125117d^Ac 0000000000000092^Ac 0000000000000000^Ac ffff8800cff0b7c0^Ac
>> [  202.125339] Call Trace:
>> [  202.127994]  <NMI>  [<ffffffff816bb796>] dump_stack+0x63/0x8d
>> [  202.134184]  [<ffffffff812fbe95>] kasan_report_error+0x495/0x4c0
>> [  202.140680]  [<ffffffff8125117d>] ? perf_output_begin+0x28d/0x4c0
>> [  202.147228]  [<ffffffff812fc319>] kasan_report+0x39/0x40
>> [  202.152987]  [<ffffffff81095ce5>] ? unwind_get_return_address+0x35/0x80
>> [  202.160094]  [<ffffffff812fa8fe>] __asan_load8+0x5e/0x70
>> [  202.165859]  [<ffffffff81095ce5>] unwind_get_return_address+0x35/0x80
>
> Josh, any ideas?

I think this is a false positive due to imprecise unwind that hits a
stack redzone.
We probably need to use READ_ONCE_NOCHECK as in get_wchan.