linux-kernel - [lkp-robot] [printk] 7f7c60e066: BUG:KASAN:slab-out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171025162213.GH3294@yexl-desktop>
Date:   Thu, 26 Oct 2017 00:22:13 +0800
From:   kernel test robot <xiaolong.ye@...el.com>
To:     "Tobin C. Harding" <me@...in.cc>
Cc:     kernel-hardening@...ts.openwall.com,
        "Tobin C. Harding" <me@...in.cc>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Theodore Ts'o <tytso@....edu>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Kees Cook <keescook@...omium.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Tycho Andersen <tycho@...ker.com>,
        "Roberts, William C" <william.c.roberts@...el.com>,
        Tejun Heo <tj@...nel.org>,
        Jordan Glover <Golden_Miller83@...tonmail.ch>,
        Greg KH <gregkh@...uxfoundation.org>,
        Petr Mladek <pmladek@...e.com>, Joe Perches <joe@...ches.com>,
        Ian Campbell <ijc@...lion.org.uk>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <wilal.deacon@....com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Chris Fries <cfries@...gle.com>,
        Dave Weinstein <olorin@...gle.com>,
        Daniel Micay <danielmicay@...il.com>,
        Djalal Harouni <tixxdz@...il.com>,
        linux-kernel@...r.kernel.org, lkp@...org
Subject: [lkp-robot] [printk]  7f7c60e066: BUG:KASAN:slab-out-of-bounds


FYI, we noticed the following commit (built with gcc-4.9):

commit: 7f7c60e0663645e757e520245606fde9c6e326bb ("printk: hash addresses printed with %p")
url: https://github.com/0day-ci/linux/commits/Tobin-C-Harding/printk-hash-addresses-printed-with-p/20171024-231922


in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -smp 2 -m 512M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------------+------------+------------+
|                                                | 6cff0a118f | 7f7c60e066 |
+------------------------------------------------+------------+------------+
| boot_successes                                 | 26         | 0          |
| boot_failures                                  | 16         | 49         |
| BUG:soft_lockup-CPU##stuck_for#s               | 16         |            |
| Kernel_panic-not_syncing:softlockup:hung_tasks | 16         |            |
| BUG:KASAN:slab-out-of-bounds                   | 0          | 49         |
+------------------------------------------------+------------+------------+



[   39.757461] BUG: KASAN: slab-out-of-bounds in __test+0xee/0x13f
[   39.757461] Read of size 34 at addr 22cb34bb by task swapper/0/1
[   39.757461] 
[   39.757461] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.0-rc6-00013-g7f7c60e #1
[   39.757461] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   39.757461] Call Trace:
[   39.757461]  dump_stack+0xb0/0xf2
[   39.757461]  print_address_description+0x63/0x2b0
[   39.757461]  kasan_report+0x1fb/0x320
[   39.757461]  ? __test+0xee/0x13f
[   39.757461]  check_memory_region+0x142/0x1a0
[   39.757461]  __asan_loadN+0xf/0x20
[   39.757461]  __test+0xee/0x13f
[   39.757461]  test_printf_init+0x657/0x1378
[   39.757461]  ? test_sort_init+0xff/0x10d
[   39.757461]  ? kfree+0x8b/0x200
[   39.757461]  ? test_sort_init+0xff/0x10d
[   39.757461]  ? __test+0x13f/0x13f
[   39.757461]  do_one_initcall+0x9d/0x19a
[   39.757461]  kernel_init_freeable+0x1be/0x24b
[   39.757461]  ? rest_init+0xe0/0xe0
[   39.757461]  kernel_init+0x13/0x120
[   39.757461]  ? rest_init+0xe0/0xe0
[   39.757461]  ret_from_fork+0x25/0x30
[   39.757461] 
[   39.757461] Allocated by task 1:
[   39.757461]  save_stack_trace+0x1b/0x20
[   39.757461]  kasan_kmalloc+0xd7/0x180
[   39.757461]  kasan_slab_alloc+0x12/0x20
[   39.757461]  __kmalloc_track_caller+0x107/0x260
[   39.757461]  kvasprintf+0x55/0xb0
[   39.757461]  __test+0xd2/0x13f
[   39.757461]  test_printf_init+0x657/0x1378
[   39.757461]  do_one_initcall+0x9d/0x19a
[   39.757461]  kernel_init_freeable+0x1be/0x24b
[   39.757461]  kernel_init+0x13/0x120
[   39.757461]  ret_from_fork+0x25/0x30
[   39.757461] 
[   39.757461] Freed by task 1:
[   39.757461]  save_stack_trace+0x1b/0x20
[   39.757461]  kasan_slab_free+0xb9/0x190
[   39.757461]  kfree+0x8b/0x200
[   39.757461]  do_copy+0x6e/0xe0
[   39.757461]  write_buffer+0x37/0x4a
[   39.757461]  flush_buffer+0x38/0xa2
[   39.757461]  __gunzip+0x3b7/0x49e
[   39.757461]  gunzip+0x11/0x13
[   39.757461]  unpack_to_rootfs+0x19a/0x313
[   39.757461]  populate_rootfs+0xa6/0x131
[   39.757461]  do_one_initcall+0x9d/0x19a
[   39.757461]  kernel_init_freeable+0x1be/0x24b
[   39.757461]  kernel_init+0x13/0x120
[   39.757461]  ret_from_fork+0x25/0x30
[   39.757461] 
[   39.757461] The buggy address belongs to the object at 22cb34bb
[   39.757461]  which belongs to the cache kmalloc-32 of size 32
[   39.757461] The buggy address is located 0 bytes inside of
[   39.757461]  32-byte region [22cb34bb, 24ac3a60)
[   39.757461] The buggy address belongs to the page:
[   39.757461] page:a7cc2f90 count:1 mapcount:0 mapping:          (null) index:0x0
[   39.757461] flags: 0x4000000000000100(slab)
[   39.757461] raw: 4000000000000100 0000000000000000 0000000000000000 0000000180550055
[   39.757461] raw: ffffea00005db400 0000000600000006 ffff88001a001a00 0000000000000000
[   39.757461] page dumped because: kasan: bad access detected
[   39.757461] 
[   39.757461] Memory state around the buggy address:
[   39.757461]  1c0e72a5: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[   39.757461]    5e1f6c: fb fb fb fb fc fc fb fb fb fb fc fc 00 00 00 00
[   39.757461] >24ac3a60: fc fc fb fb fb fb fc fc fb fb fb fb fc fc fb fb
[   39.757461]                    ^
[   39.757461]  c354f823: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[   39.757461]  149d6220: fb fb fb fb fc fc fb fb fb fb fc fc fb fb fb fb
[   39.757461] ==================================================================
[   39.757461] Disabling lock debugging due to kernel taint
[   40.275423] test_printf: kvasprintf(..., "%p %p", ...) returned '3cf9adbe eff717bf', expected '0000000001234567 fffffffffedcba98'
[   40.296739] test_printf: vsnprintf(buf, 256, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.322776] test_printf: vsnprintf(buf, 16, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.334834] test_printf: vsnprintf(buf, 0, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.343273] test_printf: kvasprintf(..., "|%-*p|%*p|", ...) returned '|3cf9adbe|3cf9adbe|', expected '|1234567           |           1234567|'
[   40.356067] test_printf: vsnprintf(buf, 256, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.369273] test_printf: vsnprintf(buf, 22, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.380306] test_printf: vsnprintf(buf, 0, "|%-*p|%*p|", ...) returned 19, expected 39
[   40.392978] test_printf: kvasprintf(..., "|%-*p|%*p|", ...) returned '|eff717bf|eff717bf|', expected '|fffffffffedcba98  |  fffffffffedcba98|'
[   40.414478] test_printf: vsnprintf(buf, 256, "|%p0y|", ...) returned 10, expected 18
[   40.428661] test_printf: vsnprintf(buf, 9, "|%p0y|", ...) returned 10, expected 18
[   40.439610] test_printf: vsnprintf(buf, 0, "|%p0y|", ...) returned 10, expected 18
[   40.449516] test_printf: kvasprintf(..., "|%p0y|", ...) returned '|3cf9adbe|', expected '|0000000001234567|'
[   40.461806] test_printf: vsnprintf(buf, 256, "|%p0y|", ...) returned 10, expected 18
[   40.476076] test_printf: vsnprintf(buf, 13, "|%p0y|", ...) returned 10, expected 18
[   40.485627] test_printf: vsnprintf(buf, 0, "|%p0y|", ...) returned 10, expected 18
[   40.498327] test_printf: kvasprintf(..., "|%p0y|", ...) returned '|eff717bf|', expected '|fffffffffedcba98|'
[   40.517481] test_printf: failed 20 out of 260 tests
[   41.174874] test_bitmap: test 13: input is '0-2047:128/256' OK, Time: 2658
[   41.243847] test_bitmap: all 460506 tests passed
[   41.251270] test_uuid: all 18 tests passed
[   41.261713] xz_dec_test: module loaded
[   41.267646] xz_dec_test: Create a device node with 'mknod xz_dec_test c 247 0' and write .xz files to it.
[   41.294800] rbtree testing
[   47.622880]  -> test 1 (latency of nnodes insert+delete): 143065 cycles

Elapsed time: 60


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
Xiaolong

View attachment "config-4.14.0-rc6-00013-g7f7c60e" of type "text/plain" (108751 bytes)

View attachment "job-script" of type "text/plain" (3728 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (10008 bytes)