linux-kernel - WARNING in per_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAASgV=tBcZSimShu3VE7QfHuaD1V0Zbsc5g83uroD0qgHCSKDQ@mail.gmail.com>
Date:   Sun, 15 Oct 2017 08:28:55 -0400
From:   Shankara Pailoor <sp3485@...umbia.edu>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     syzkaller <syzkaller@...glegroups.com>,
        Andrew Zhu Aday <andrew.aday@...umbia.edu>
Subject: WARNING in per_cpu_alloc

Hi,

We found the warning when fuzzing with Syzkaller on Linux 4-14-rc4.

illegal size (32776) or align (8) for percpu allocation
------------[ cut here ]------------
WARNING: CPU: 0 PID: 22596 at mm/percpu.c:1365 pcpu_alloc+0x140/0x10f0
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 22596 Comm: syz-executor1 Not tainted 4.14.0-rc4 #1
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Call Trace:
 dump_stack+0x115/0x1da
 panic+0x1b4/0x3a7
 __warn+0x1c4/0x1d9
 report_bug+0x211/0x2d0
 fixup_bug+0x40/0x90
 do_trap+0x260/0x390
 do_error_trap+0x11c/0x350
 do_invalid_op+0x1b/0x20
 invalid_op+0x18/0x20
RIP: 0010:pcpu_alloc+0x140/0x10f0
RSP: 0018:ffff8800a752f6a8 EFLAGS: 00010286
RAX: 0000000000000037 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000037 RSI: ffffc90001a32000 RDI: ffffed0014ea5ec9
RBP: ffff8800a752f920 R08: ffff8800a752ed98 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000008007
R13: 0000000000000000 R14: ffff8800a752fec0 R15: 0000000000000008
 __alloc_percpu+0x24/0x30
 dev_map_alloc+0x68e/0xb70
 SyS_bpf+0xd25/0x4500
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x452349
RSP: 002b:00007f8c38897be8 EFLAGS: 00000212 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000968000 RCX: 0000000000452349
RDX: 000000000000001c RSI: 0000000020038000 RDI: 0000000000000000
RBP: 0000000000000046 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f25a8
R13: 00000000ffffffff R14: 0000000000968070 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: 0x23800000 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffffbfffffff)
Rebooting in 86400 seconds..

Here is the reproducer program: https://pastebin.com/TdSTCu5E