linux-kernel - Re: [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2AB2B7C8-5F07-4D41-8CC3-04BE7C74DCCC@fb.com>
Date:   Thu, 17 Feb 2022 20:05:11 +0000
From:   Song Liu <songliubraving@...com>
To:     Aleksandr Nogikh <nogikh@...gle.com>
CC:     Song Liu <song@...nel.org>, Daniel Borkmann <daniel@...earbox.net>,
        syzbot <syzbot+2f649ec6d2eea1495a8f@...kaller.appspotmail.com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>,
        "David S . Miller" <davem@...emloft.net>,
        "Jesper Dangaard Brouer" <hawk@...nel.org>,
        John Fastabend <john.fastabend@...il.com>,
        Martin Lau <kafai@...com>, KP Singh <kpsingh@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>,
        Yonghong Song <yhs@...com>
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit_free

Hi Aleksandr,

> On Feb 17, 2022, at 10:32 AM, Aleksandr Nogikh <nogikh@...gle.com> wrote:
> 
> Hi Song,
> 
> On Wed, Feb 16, 2022 at 5:27 PM Song Liu <song@...nel.org> wrote:
>> 
>> Hi Aleksandr,
>> 
>> Thanks for your kind reply!
>> 
>> On Wed, Feb 16, 2022 at 1:38 AM Aleksandr Nogikh <nogikh@...gle.com> wrote:
>>> 
>>> Hi Song,
>>> 
>>> Is syzkaller not doing something you expect it to do with this config?
>> 
>> I fixed sshkey in the config, and added a suppression for hsr_node_get_first.
>> However, I haven't got a repro overnight.
> 
> Oh, that's unfortunately not a very reliable thing. The bug has so far
> happened only once on syzbot, so it must be pretty rare. Maybe you'll
> have more luck with your local setup :)
> 
> You can try to run syz-repro on the log file that is available on the
> syzbot dashboard:
> https://github.com/google/syzkaller/blob/master/tools/syz-repro/repro.go
> Syzbot has already done it and apparently failed to succeed, but this
> is also somewhat probabilistic, especially when the bug is due to some
> rare race condition. So trying it several times might help.
> 
> Also you might want to hack your local syzkaller copy a bit:
> https://github.com/google/syzkaller/blob/master/syz-manager/manager.go#L804
> Here you can drop the limit on the maximum number of repro attempts
> and make needLocalRepro only return true if crash.Title matches the
> title of this particular bug. With this change your local syzkaller
> instance won't waste time reproducing other bugs.
> 
> There's also a way to focus syzkaller on some specific kernel
> functions/source files:
> https://github.com/google/syzkaller/blob/master/pkg/mgrconfig/config.go#L125

Thanks for these tips!

After fixing some other things. I was able to reproduce one of the three
failures modes overnight and some related issues from fault injection. 
These errors gave me clue to fix the bug (or at least one of the bugs). 

I have a suggestions on the bug dashboard, like:

https://syzkaller.appspot.com/bug?id=86fa0212fb895a0d41fd1f1eecbeaee67191a4c9

It isn't obvious to me which image was used in the test. Maybe we can add
a link to the image or instructions to build the image? In this case, I
think the bug only triggers on some images, so testing with the exact image
is important.

Thanks again,
Song