lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list] 
Message-ID: <1559837386.6132.47.camel@lca.pw>
Date:   Thu, 06 Jun 2019 12:09:46 -0400
From:   Qian Cai <cai@....pw>
To:     Yuri Norov <ynorov@...vell.com>
Cc:     Andrey Konovalov <andreyknvl@...gle.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        Yury Norov <yury.norov@...il.com>
Subject: Re: "lib: rework bitmap_parse()" triggers invalid access errors

On Wed, 2019-06-05 at 08:01 +0000, Yuri Norov wrote:
> (Sorry for top-posting)
> 
> I can reproduce this on next-20190604. Is it new trace, or like one you've
> posted before?

Same thing, "nbits" causes an invalid access.

# ./scripts/faddr2line vmlinux bitmap_parse+0x20c/0x2d8
bitmap_parse+0x20c/0x2d8:
__bitmap_clear at lib/bitmap.c:280
(inlined by) bitmap_clear at include/linux/bitmap.h:390
(inlined by) bitmap_parse at lib/bitmap.c:662

This line,

while (len - bits_to_clear >= 0) {

[  151.025490][ T3745]
==================================================================
[  151.033437][ T3745] BUG: KASAN: invalid-access in bitmap_parse+0x20c/0x2d8
[  151.040313][ T3745] Write of size 8 at addr 88ff80961f5637a0 by task
irqbalance/3745
[  151.048052][ T3745] Pointer tag: [88], memory tag: [fe]
[  151.053272][ T3745] 
[  151.055462][ T3745] CPU: 191 PID: 3745 Comm: irqbalance Tainted:
G        W         5.2.0-rc3-next-20190606+ #2
[  151.065548][ T3745] Hardware name: HPE Apollo
70             /C01_APACHE_MB         , BIOS L50_5.13_1.0.9 03/01/2019
[  151.076064][ T3745] Call trace:
[  151.079218][ T3745]  dump_backtrace+0x0/0x268
[  151.083574][ T3745]  show_stack+0x20/0x2c
[  151.087589][ T3745]  dump_stack+0xb4/0x108
[  151.091691][ T3745]  print_address_description+0x7c/0x330
[  151.097088][ T3745]  __kasan_report+0x194/0x1dc
[  151.101616][ T3745]  kasan_report+0x10/0x18
[  151.105799][ T3745]  __hwasan_store8_noabort+0x74/0x7c
[  151.110935][ T3745]  bitmap_parse+0x20c/0x2d8
[  151.115291][ T3745]  bitmap_parse_user+0x40/0x64
[  151.119910][ T3745]  write_irq_affinity+0x118/0x1a8
[  151.124786][ T3745]  irq_affinity_proc_write+0x34/0x44
[  151.129925][ T3745]  proc_reg_write+0xf4/0x130
[  151.134376][ T3745]  __vfs_write+0x88/0x33c
[  151.138561][ T3745]  vfs_write+0x118/0x208
[  151.142656][ T3745]  ksys_write+0xa0/0x110
[  151.146752][ T3745]  __arm64_sys_write+0x54/0x88
[  151.151377][ T3745]  el0_svc_handler+0x198/0x260
[  151.155992][ T3745]  el0_svc+0x8/0xc
[  151.159566][ T3745] 
[  151.161751][ T3745] Allocated by task 3745:
[  151.165933][ T3745]  __kasan_kmalloc+0x114/0x1d0
[  151.170553][ T3745]  kasan_kmalloc+0x10/0x18
[  151.174830][ T3745]  __kmalloc_node+0x1e0/0x788
[  151.179358][ T3745]  alloc_cpumask_var_node+0x48/0x94
[  151.184407][ T3745]  alloc_cpumask_var+0x10/0x1c
[  151.189022][ T3745]  write_irq_affinity+0xa8/0x1a8
[  151.193811][ T3745]  irq_affinity_proc_write+0x34/0x44
[  151.198947][ T3745]  proc_reg_write+0xf4/0x130
[  151.203389][ T3745]  __vfs_write+0x88/0x33c
[  151.207573][ T3745]  vfs_write+0x118/0x208
[  151.211668][ T3745]  ksys_write+0xa0/0x110
[  151.215764][ T3745]  __arm64_sys_write+0x54/0x88
[  151.220380][ T3745]  el0_svc_handler+0x198/0x260
[  151.224996][ T3745]  el0_svc+0x8/0xc
[  151.228566][ T3745] 
[  151.230749][ T3745] Freed by task 3745:
[  151.234585][ T3745]  __kasan_slab_free+0x154/0x228
[  151.239374][ T3745]  kasan_slab_free+0xc/0x18
[  151.243729][ T3745]  kfree+0x268/0xb70
[  151.247484][ T3745]  free_cpumask_var+0xc/0x14
[  151.251932][ T3745]  write_irq_affinity+0x19c/0x1a8
[  151.256807][ T3745]  irq_affinity_proc_write+0x34/0x44
[  151.261943][ T3745]  proc_reg_write+0xf4/0x130
[  151.266386][ T3745]  __vfs_write+0x88/0x33c
[  151.270567][ T3745]  vfs_write+0x118/0x208
[  151.274661][ T3745]  ksys_write+0xa0/0x110
[  151.278756][ T3745]  __arm64_sys_write+0x54/0x88
[  151.283371][ T3745]  el0_svc_handler+0x198/0x260
[  151.287986][ T3745]  el0_svc+0x8/0xc
[  151.291556][ T3745] 
[  151.293742][ T3745] The buggy address belongs to the object at
ffff80961f563780
[  151.293742][ T3745]  which belongs to the cache kmalloc-128 of size 128
[  151.307647][ T3745] The buggy address is located 32 bytes inside of
[  151.307647][ T3745]  128-byte region [ffff80961f563780, ffff80961f563800)
[  151.320681][ T3745] The buggy address belongs to the page:
[  151.326167][ T3745] page:ffff7fe02587d580 refcount:1 mapcount:0
mapping:fdff800800010480 index:0x8aff80961f56dc80
[  151.336429][ T3745] flags: 0x17ffffffc000200(slab)
[  151.341222][ T3745] raw: 017ffffffc000200 ffff7fe025843788 e3ff808b7d00fd40
fdff800800010480
[  151.349659][ T3745] raw: 8aff80961f56dc80 000000000066001d 00000001ffffffff
0000000000000000
[  151.358092][ T3745] page dumped because: kasan: bad access detected
[  151.364361][ T3745] page allocated via order 0, migratetype Unmovable,
gfp_mask 0x12800(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY)
[  151.375757][ T3745]  prep_new_page+0x2f4/0x378
[  151.380201][ T3745]  get_page_from_freelist+0x253c/0x2868
[  151.385598][ T3745]  __alloc_pages_nodemask+0x360/0x1c60
[  151.390908][ T3745]  alloc_pages_current+0xd0/0xe0
[  151.395699][ T3745]  new_slab+0x15c/0x9d4
[  151.399707][ T3745]  ___slab_alloc+0x57c/0x9e4
[  151.404148][ T3745]  __kmalloc+0x58c/0x5e0
[  151.408247][ T3745]  memcg_kmem_get_cache+0x150/0x65c
[  151.413296][ T3745]  kmem_cache_alloc+0x208/0x568
[  151.418010][ T3745]  __anon_vma_prepare+0x60/0x210
[  151.422799][ T3745]  do_fault+0xc64/0xf80
[  151.426807][ T3745]  handle_pte_fault+0x4e4/0x15e8
[  151.431597][ T3745]  handle_mm_fault+0x6a4/0x95c
[  151.436216][ T3745]  do_page_fault+0x4a0/0x770
[  151.440657][ T3745]  do_translation_fault+0x60/0xa0
[  151.445537][ T3745]  do_mem_abort+0x58/0xf4
[  151.449715][ T3745] 
[  151.451897][ T3745] Memory state around the buggy address:
[  151.457381][ T3745]  ffff80961f563500: 93 93 93 93 93 93 93 93 fe fe fe fe fe
fe fe fe
[  151.465295][ T3745]  ffff80961f563600: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[  151.473209][ T3745] >ffff80961f563700: fe fe fe fe fe fe fe fe 88 88 fe fe fe
fe fe fe
[  151.481120][ T3745]                                                  ^
[  151.487645][ T3745]  ffff80961f563800: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[  151.495562][ T3745]  ffff80961f563900: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[  151.503481][ T3745]
==================================================================
[  151.511399][ T3745] Disabling lock debugging due to kernel taint

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ