| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 06 Jun 2019 12:09:46 -0400
From: Qian Cai <cai@....pw>
To: Yuri Norov <ynorov@...vell.com>
Cc: Andrey Konovalov <andreyknvl@...gle.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
Andrew Morton <akpm@...ux-foundation.org>,
"linux-mm@...ck.org" <linux-mm@...ck.org>,
Yury Norov <yury.norov@...il.com>
Subject: Re: "lib: rework bitmap_parse()" triggers invalid access errors
On Wed, 2019-06-05 at 08:01 +0000, Yuri Norov wrote:
> (Sorry for top-posting)
>
> I can reproduce this on next-20190604. Is it new trace, or like one you've
> posted before?
Same thing, "nbits" causes an invalid access.
# ./scripts/faddr2line vmlinux bitmap_parse+0x20c/0x2d8
bitmap_parse+0x20c/0x2d8:
__bitmap_clear at lib/bitmap.c:280
(inlined by) bitmap_clear at include/linux/bitmap.h:390
(inlined by) bitmap_parse at lib/bitmap.c:662
This line,
while (len - bits_to_clear >= 0) {
[ 151.025490][ T3745]
==================================================================
[ 151.033437][ T3745] BUG: KASAN: invalid-access in bitmap_parse+0x20c/0x2d8
[ 151.040313][ T3745] Write of size 8 at addr 88ff80961f5637a0 by task
irqbalance/3745
[ 151.048052][ T3745] Pointer tag: [88], memory tag: [fe]
[ 151.053272][ T3745]
[ 151.055462][ T3745] CPU: 191 PID: 3745 Comm: irqbalance Tainted:
G W 5.2.0-rc3-next-20190606+ #2
[ 151.065548][ T3745] Hardware name: HPE Apollo
70 /C01_APACHE_MB , BIOS L50_5.13_1.0.9 03/01/2019
[ 151.076064][ T3745] Call trace:
[ 151.079218][ T3745] dump_backtrace+0x0/0x268
[ 151.083574][ T3745] show_stack+0x20/0x2c
[ 151.087589][ T3745] dump_stack+0xb4/0x108
[ 151.091691][ T3745] print_address_description+0x7c/0x330
[ 151.097088][ T3745] __kasan_report+0x194/0x1dc
[ 151.101616][ T3745] kasan_report+0x10/0x18
[ 151.105799][ T3745] __hwasan_store8_noabort+0x74/0x7c
[ 151.110935][ T3745] bitmap_parse+0x20c/0x2d8
[ 151.115291][ T3745] bitmap_parse_user+0x40/0x64
[ 151.119910][ T3745] write_irq_affinity+0x118/0x1a8
[ 151.124786][ T3745] irq_affinity_proc_write+0x34/0x44
[ 151.129925][ T3745] proc_reg_write+0xf4/0x130
[ 151.134376][ T3745] __vfs_write+0x88/0x33c
[ 151.138561][ T3745] vfs_write+0x118/0x208
[ 151.142656][ T3745] ksys_write+0xa0/0x110
[ 151.146752][ T3745] __arm64_sys_write+0x54/0x88
[ 151.151377][ T3745] el0_svc_handler+0x198/0x260
[ 151.155992][ T3745] el0_svc+0x8/0xc
[ 151.159566][ T3745]
[ 151.161751][ T3745] Allocated by task 3745:
[ 151.165933][ T3745] __kasan_kmalloc+0x114/0x1d0
[ 151.170553][ T3745] kasan_kmalloc+0x10/0x18
[ 151.174830][ T3745] __kmalloc_node+0x1e0/0x788
[ 151.179358][ T3745] alloc_cpumask_var_node+0x48/0x94
[ 151.184407][ T3745] alloc_cpumask_var+0x10/0x1c
[ 151.189022][ T3745] write_irq_affinity+0xa8/0x1a8
[ 151.193811][ T3745] irq_affinity_proc_write+0x34/0x44
[ 151.198947][ T3745] proc_reg_write+0xf4/0x130
[ 151.203389][ T3745] __vfs_write+0x88/0x33c
[ 151.207573][ T3745] vfs_write+0x118/0x208
[ 151.211668][ T3745] ksys_write+0xa0/0x110
[ 151.215764][ T3745] __arm64_sys_write+0x54/0x88
[ 151.220380][ T3745] el0_svc_handler+0x198/0x260
[ 151.224996][ T3745] el0_svc+0x8/0xc
[ 151.228566][ T3745]
[ 151.230749][ T3745] Freed by task 3745:
[ 151.234585][ T3745] __kasan_slab_free+0x154/0x228
[ 151.239374][ T3745] kasan_slab_free+0xc/0x18
[ 151.243729][ T3745] kfree+0x268/0xb70
[ 151.247484][ T3745] free_cpumask_var+0xc/0x14
[ 151.251932][ T3745] write_irq_affinity+0x19c/0x1a8
[ 151.256807][ T3745] irq_affinity_proc_write+0x34/0x44
[ 151.261943][ T3745] proc_reg_write+0xf4/0x130
[ 151.266386][ T3745] __vfs_write+0x88/0x33c
[ 151.270567][ T3745] vfs_write+0x118/0x208
[ 151.274661][ T3745] ksys_write+0xa0/0x110
[ 151.278756][ T3745] __arm64_sys_write+0x54/0x88
[ 151.283371][ T3745] el0_svc_handler+0x198/0x260
[ 151.287986][ T3745] el0_svc+0x8/0xc
[ 151.291556][ T3745]
[ 151.293742][ T3745] The buggy address belongs to the object at
ffff80961f563780
[ 151.293742][ T3745] which belongs to the cache kmalloc-128 of size 128
[ 151.307647][ T3745] The buggy address is located 32 bytes inside of
[ 151.307647][ T3745] 128-byte region [ffff80961f563780, ffff80961f563800)
[ 151.320681][ T3745] The buggy address belongs to the page:
[ 151.326167][ T3745] page:ffff7fe02587d580 refcount:1 mapcount:0
mapping:fdff800800010480 index:0x8aff80961f56dc80
[ 151.336429][ T3745] flags: 0x17ffffffc000200(slab)
[ 151.341222][ T3745] raw: 017ffffffc000200 ffff7fe025843788 e3ff808b7d00fd40
fdff800800010480
[ 151.349659][ T3745] raw: 8aff80961f56dc80 000000000066001d 00000001ffffffff
0000000000000000
[ 151.358092][ T3745] page dumped because: kasan: bad access detected
[ 151.364361][ T3745] page allocated via order 0, migratetype Unmovable,
gfp_mask 0x12800(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY)
[ 151.375757][ T3745] prep_new_page+0x2f4/0x378
[ 151.380201][ T3745] get_page_from_freelist+0x253c/0x2868
[ 151.385598][ T3745] __alloc_pages_nodemask+0x360/0x1c60
[ 151.390908][ T3745] alloc_pages_current+0xd0/0xe0
[ 151.395699][ T3745] new_slab+0x15c/0x9d4
[ 151.399707][ T3745] ___slab_alloc+0x57c/0x9e4
[ 151.404148][ T3745] __kmalloc+0x58c/0x5e0
[ 151.408247][ T3745] memcg_kmem_get_cache+0x150/0x65c
[ 151.413296][ T3745] kmem_cache_alloc+0x208/0x568
[ 151.418010][ T3745] __anon_vma_prepare+0x60/0x210
[ 151.422799][ T3745] do_fault+0xc64/0xf80
[ 151.426807][ T3745] handle_pte_fault+0x4e4/0x15e8
[ 151.431597][ T3745] handle_mm_fault+0x6a4/0x95c
[ 151.436216][ T3745] do_page_fault+0x4a0/0x770
[ 151.440657][ T3745] do_translation_fault+0x60/0xa0
[ 151.445537][ T3745] do_mem_abort+0x58/0xf4
[ 151.449715][ T3745]
[ 151.451897][ T3745] Memory state around the buggy address:
[ 151.457381][ T3745] ffff80961f563500: 93 93 93 93 93 93 93 93 fe fe fe fe fe
fe fe fe
[ 151.465295][ T3745] ffff80961f563600: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ 151.473209][ T3745] >ffff80961f563700: fe fe fe fe fe fe fe fe 88 88 fe fe fe
fe fe fe
[ 151.481120][ T3745] ^
[ 151.487645][ T3745] ffff80961f563800: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ 151.495562][ T3745] ffff80961f563900: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ 151.503481][ T3745]
==================================================================
[ 151.511399][ T3745] Disabling lock debugging due to kernel taint
Powered by blists - more mailing lists