linux-kernel - Re: WARNING in bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5e3a3f0c-7981-c3a3-b4ab-c7d65470d392@solarflare.com>
Date:   Thu, 15 Nov 2018 19:50:17 +0000
From:   Edward Cree <ecree@...arflare.com>
To:     syzbot <syzbot+4fc427c7af994b0948be@...kaller.appspotmail.com>,
        <ast@...nel.org>, <daniel@...earbox.net>,
        <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>,
        <syzkaller-bugs@...glegroups.com>
Subject: Re: WARNING in bpf_check (2)

On 15/11/18 07:49, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    ccda4af0f4b9 Linux 4.20-rc2
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=129edfbd400000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4a0a89f12ca9b0f5
> dashboard link: https://syzkaller.appspot.com/bug?extid=4fc427c7af994b0948be
> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=172b626d400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=148dcb0b400000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+4fc427c7af994b0948be@...kaller.appspotmail.com
I'm investigating this.  So far I have disassembled the prog and reproduced
 the failure by adding the following to test_verifier.c:
    {
        "syz found: explosion",
        .insns = {
            BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
            BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
            BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
            BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
            BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
            BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
            BPF_EXIT_INSN(),
            BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
            BPF_MOV64_IMM(BPF_REG_0, 0),
            BPF_EXIT_INSN(),
        },
        .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
        .result = ACCEPT,
    },
A subprog _does_ start at insn 7, and the verifier was happy with it until
 jit_subprogs, suggesting that something has mangled env->subprog_info[].start
 or else insns have been inserted but the call insns not adjusted.
The obvious suspect would be adjust_subprog_starts() and/or
 bpf_patch_insn_data().

-Ed