linux-kernel - Re: [PATCH 5/9] XArray: entry in last level is not expected to be a node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200405110743.bzpvz4jzwr4kharr@master>
Date:   Sun, 5 Apr 2020 11:07:43 +0000
From:   Wei Yang <richard.weiyang@...il.com>
To:     Matthew Wilcox <willy@...radead.org>
Cc:     Wei Yang <richard.weiyang@...il.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5/9] XArray: entry in last level is not expected to be a
 node

On Wed, Apr 01, 2020 at 03:20:00PM -0700, Matthew Wilcox wrote:
>On Wed, Apr 01, 2020 at 10:10:21PM +0000, Wei Yang wrote:
>> On Tue, Mar 31, 2020 at 04:59:12PM -0700, Matthew Wilcox wrote:
>> >On Tue, Mar 31, 2020 at 10:04:40PM +0000, Wei Yang wrote:
>> >> cc -I. -I../../include -g -Og -Wall -D_LGPL_SOURCE -fsanitize=address -fsanitize=undefined   -c -o main.o main.c
>> >> In file included from ./linux/../../../../include/linux/radix-tree.h:15,
>> >>                  from ./linux/radix-tree.h:5,
>> >>                  from main.c:10:
>> >> ./linux/rcupdate.h:5:10: fatal error: urcu.h: No such file or directory
>> >>     5 | #include <urcu.h>
>> >>       |          ^~~~~~~~
>> >> compilation terminated.
>> >> make: *** [<builtin>: main.o] Error 1
>> >
>> >Oh, you need liburcu installed.  On Debian, that's liburcu-dev ... probably
>> >liburcu-devel on Red Hat style distros.
>> 
>> The bad news is I didn't find the package on Fedora.
>
>Really?  https://www.google.com/search?q=fedora+liburcu has the -devel
>package as the second hit from https://pkgs.org/search/?q=liburcu

Occasionally, I see this error message without my change on 5.6.


random seed 1586068185
running tests
XArray: 21151201 of 21151201 tests passed
=================================================================
==6040==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0031bce81 at pc 0x00000040b4b3 bp 0x7f95e87f9bb0 sp 0x7f95e87f9ba0
READ of size 1 at 0x60c0031bce81 thread T11
    #0 0x40b4b2 in xas_find_marked ../../../lib/xarray.c:1182
    #1 0x45318e in tagged_iteration_fn /root/git/linux/tools/testing/radix-tree/iteration_check.c:77
    #2 0x7f95ef2464e1 in start_thread (/lib64/libpthread.so.0+0x94e1)
    #3 0x7f95ee8026d2 in clone (/lib64/libc.so.6+0x1016d2)

0x60c0031bce81 is located 1 bytes inside of 128-byte region [0x60c0031bce80,0x60c0031bcf00)
freed by thread T1 here:
    #0 0x7f95ef36c91f in __interceptor_free (/lib64/libasan.so.5+0x10d91f)
    #1 0x43e4ba in kmem_cache_free /root/git/linux/tools/testing/radix-tree/linux.c:64

previously allocated by thread T13 here:
    #0 0x7f95ef36cd18 in __interceptor_malloc (/lib64/libasan.so.5+0x10dd18)
    #1 0x43e1af in kmem_cache_alloc /root/git/linux/tools/testing/radix-tree/linux.c:44

Thread T11 created by T0 here:
    #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
    #1 0x454862 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:178

Thread T1 created by T0 here:
    #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
    #1 0x7f95ef235b89  (/lib64/liburcu.so.6+0x3b89)

Thread T13 created by T0 here:
    #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
    #1 0x4548a4 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:186

SUMMARY: AddressSanitizer: heap-use-after-free ../../../lib/xarray.c:1182 in xas_find_marked
Shadow bytes around the buggy address:
  0x0c188062f980: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c188062f990: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c188062f9a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c188062f9b0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c188062f9c0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
=>0x0c188062f9d0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c188062f9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c188062f9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c188062fa00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c188062fa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c188062fa20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==6040==ABORTING

This is not always like this. Didn't figure out the reason yet. Hope you many
have some point.

-- 
Wei Yang
Help you, Help me