linux-kernel - Re: x86: warning in unwind_get_return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Dec 2016 15:01:44 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Andrey Konovalov <andreyknvl@...gle.com>
Cc:     Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        kasan-dev <kasan-dev@...glegroups.com>, linux-mm@...ck.org,
        LKML <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: x86: warning in unwind_get_return_address

On Tue, Dec 20, 2016 at 03:43:27PM +0100, Andrey Konovalov wrote:
> Hi,
> 
> I've got the following warning while running the syzkaller fuzzer:
> 
> WARNING: unrecognized kernel stack return address ffffffffa0000001 at
> ffff88006377fa18 in a.out:4467
> 
> By adding a BUG() to unwind_get_return_address() I was able to capture
> the stack trace (see below). Looks like unwind_get_return_address()
> gets called when KASAN tries to unwind the stack to save the stack
> trace.
> 
> A reproducer is attached. CONFIG_KASAN=y is most likely needed for it to work.

Hi Andrey,

I've tried with your reproducer but it didn't recreate.  Can you try
again with the following patch from the tip tree, instead of your BUG()
patch?

  http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/patch/?id=8b5e99f02264130782a10ba5c0c759797fb064ee

That will dump the stack data, which should give more clues about what
went wrong.

-- 
Josh