lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <6CB9B5C9-63C6-49CD-A538-AB2288FE352C@gmail.com>
Date: Wed, 15 May 2024 21:02:01 -0400
From: Shuangpeng Bai <shuangpengbai@...il.com>
To: linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org,
 syzkaller@...glegroups.com
Subject: KASAN: slab-use-after-free in hfsplus_bnode_read

Hi Kernel Maintainers,

Our tool found a kernel bug KASAN: slab-use-after-free in hfsplus_bnode_read. Please see the details below.

Kernel commit: v6.9 (Commits on May 12, 2024)
Kernel config: attachment
C/Syz reproducer: attachment

Please let me know for anything I can help.

Best,
Shuangpeng


[   64.430573][ T8067] ==================================================================
[ 64.437558][ T8067] BUG: KASAN: slab-use-after-free in hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[   64.440771][ T8067] Read of size 8 at addr ffff88814a21e208 by task a.out/8067
[   64.441604][ T8067]
[   64.441876][ T8067] CPU: 1 PID: 8067 Comm: a.out Not tainted 6.9.0 #7
[   64.443191][ T8067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[   64.445530][ T8067] Call Trace:
[   64.446372][ T8067]  <TASK>
[ 64.447125][ T8067] dump_stack_lvl (lib/dump_stack.c:117) 
[ 64.448268][ T8067] print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) 
[ 64.449345][ T8067] ? __phys_addr (arch/x86/mm/physaddr.c:32 (discriminator 4)) 
[ 64.450449][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.451713][ T8067] kasan_report (mm/kasan/report.c:603) 
[ 64.454026][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.455161][ T8067] hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.456458][ T8067] hfsplus_bnode_dump (fs/hfsplus/bnode.c:322) 
[ 64.457542][ T8067] ? __pfx_hfsplus_bnode_dump (fs/hfsplus/bnode.c:292) 
[ 64.458768][ T8067] ? hfsplus_bnode_write_u16 (fs/hfsplus/bnode.c:95) 
[ 64.459964][ T8067] ? hfsplus_bnode_move (fs/hfsplus/bnode.c:182) 
[ 64.461109][ T8067] ? __pfx___hfsplus_brec_find (fs/hfsplus/bfind.c:116) 
[ 64.462370][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) 
[ 64.463512][ T8067] hfsplus_brec_remove (fs/hfsplus/brec.c:230) 
[ 64.464631][ T8067] __hfsplus_delete_attr (fs/hfsplus/attributes.c:300) 
[ 64.465941][ T8067] ? __pfx_hfs_find_1st_rec_by_cnid (fs/hfsplus/bfind.c:59) 
[ 64.467596][ T8067] ? __pfx___hfsplus_delete_attr (fs/hfsplus/attributes.c:268) 
[ 64.469176][ T8067] ? __sanitizer_cov_trace_switch (kernel/kcov.c:340 (discriminator 3)) 
[ 64.470515][ T8067] hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:379) 
[ 64.471810][ T8067] ? __pfx_hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:355) 
[ 64.473199][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) 
[ 64.474417][ T8067] hfsplus_delete_cat (fs/hfsplus/catalog.c:425) 
[ 64.475594][ T8067] ? __pfx_hfsplus_delete_cat (fs/hfsplus/catalog.c:331) 
[ 64.477195][ T8067] ? avc_lookup (security/selinux/avc.c:567) 
[ 64.478203][ T8067] ? __pfx_mutex_lock (kernel/locking/mutex.c:282) 
[ 64.479313][ T8067] ? __pfx_selinux_inode_permission (security/selinux/hooks.c:3096) 
[ 64.480721][ T8067] hfsplus_unlink (fs/hfsplus/dir.c:386) 
[ 64.481697][ T8067] ? __pfx_hfsplus_unlink (fs/hfsplus/dir.c:359) 
[ 64.482655][ T8067] ? __pfx_selinux_inode_rename (security/selinux/hooks.c:3052) 
[ 64.483719][ T8067] ? down_write (./arch/x86/include/asm/preempt.h:103 kernel/locking/rwsem.c:1309 kernel/locking/rwsem.c:1315 kernel/locking/rwsem.c:1580) 
[ 64.484549][ T8067] ? __pfx_down_write (kernel/locking/rwsem.c:1577) 
[ 64.485462][ T8067] hfsplus_rename (fs/hfsplus/dir.c:547) 
[ 64.486340][ T8067] ? __pfx_hfsplus_rename (fs/hfsplus/dir.c:536) 
[ 64.487306][ T8067] vfs_rename (fs/namei.c:4882) 
[ 64.488171][ T8067] ? __pfx_vfs_rename (fs/namei.c:4760) 
[ 64.489092][ T8067] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:103 /include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) 
[ 64.489989][ T8067] ? security_path_rename (security/security.c:1920) 
[ 64.490991][ T8067] do_renameat2 (fs/namei.c:5037) 
[ 64.491839][ T8067] ? __pfx_do_renameat2 (fs/namei.c:4921) 
[ 64.492745][ T8067] ? security_file_free (security/security.c:2747) 
[ 64.493662][ T8067] ? preempt_count_add (./include/linux/ftrace.h:974 kernel/sched/core.c:5852 kernel/sched/core.c:5849 kernel/sched/core.c:5877) 
[ 64.494514][ T8067] ? __phys_addr_symbol (arch/x86/mm/physaddr.c:42 (discriminator 2)) 
[ 64.495369][ T8067] ? strncpy_from_user (lib/strncpy_from_user.c:145) 
[ 64.496307][ T8067] __x64_sys_rename (fs/namei.c:5082) 
[ 64.497234][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 64.498156][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[   64.499321][ T8067] RIP: 0033:0x7f9b7d26e73d
[ 64.500284][ T8067] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 78
All code
========
   0:	00 c3                	add    %al,%bl
   2:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
   9:	00 00 00 
   c:	90                   	nop
   d:	f3 0f 1e fa          	endbr64 
  11:	48 89 f8             	mov    %rdi,%rax
  14:	48 89 f7             	mov    %rsi,%rdi
  17:	48 89 d6             	mov    %rdx,%rsi
  1a:	48 89 ca             	mov    %rcx,%rdx
  1d:	4d 89 c2             	mov    %r8,%r10
  20:	4d 89 c8             	mov    %r9,%r8
  23:	4c 8b 4c 24 08       	mov    0x8(%rsp),%r9
  28:	0f 05                	syscall 
  2a:*	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax		<-- trapping instruction
  30:	78                   	.byte 0x78

Code starting with the faulting instruction
===========================================
   0:	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax
   6:	78                   	.byte 0x78
[   64.504419][ T8067] RSP: 002b:00007ffc6ae0d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
[   64.506221][ T8067] RAX: ffffffffffffffda RBX: 000056463a55c410 RCX: 00007f9b7d26e73d
[   64.507926][ T8067] RDX: 0031656c69662f2e RSI: 00000000200001c0 RDI: 0000000020000180
[   64.509611][ T8067] RBP: 00007ffc6ae0d940 R08: 0000000000000000 R09: 00007ffc6ae0d970
[   64.511078][ T8067] R10: 00007ffc6ae0d810 R11: 0000000000000246 R12: 000056463a55a480
[   64.512509][ T8067] R13: 00007ffc6ae0da70 R14: 0000000000000000 R15: 0000000000000000
[   64.513878][ T8067]  </TASK>
[   64.514442][ T8067]
[   64.514875][ T8067] Allocated by task 6003:
[ 64.515673][ T8067] kasan_save_stack (mm/kasan/common.c:48) 
[ 64.516553][ T8067] kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) 
[ 64.517421][ T8067] __kasan_kmalloc (mm/kasan/common.c:370 mm/kasan/common.c:387) 
[ 64.518285][ T8067] kernfs_fop_open (fs/kernfs/file.c:526 fs/kernfs/file.c:700) 
[ 64.519166][ T8067] do_dentry_open (fs/open.c:956) 
[ 64.520075][ T8067] path_openat (fs/namei.c:3643 fs/namei.c:3799) 
[ 64.520933][ T8067] do_filp_open (fs/namei.c:3827) 
[ 64.521761][ T8067] do_sys_openat2 (fs/open.c:1407) 
[ 64.522631][ T8067] __x64_sys_openat (fs/open.c:1432) 
[ 64.523518][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 64.524462][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[   64.525814][ T8067]
[   64.526347][ T8067] Freed by task 773:
[ 64.527195][ T8067] kasan_save_stack (mm/kasan/common.c:48) 
[ 64.528155][ T8067] kasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) 
[ 64.529066][ T8067] kasan_save_free_info (mm/kasan/generic.c:582) 
[ 64.530143][ T8067] poison_slab_object (mm/kasan/common.c:240 mm/kasan/common.c:211) 
[ 64.531271][ T8067] __kasan_slab_free (mm/kasan/common.c:256) 
[ 64.532332][ T8067] kmem_cache_free_bulk (mm/slub.c:2140 mm/slub.c:4299 mm/slub.c:4513 mm/slub.c:4501) 
[ 64.533668][ T8067] kvfree_rcu_bulk (./include/linux/slab.h:546 kernel/rcu/tree.c:3033) 
[ 64.534708][ T8067] kfree_rcu_work (kernel/rcu/tree.c:3111) 
[ 64.535665][ T8067] process_one_work (kernel/workqueue.c:3272) 
[ 64.536600][ T8067] worker_thread (kernel/workqueue.c:3342 kernel/workqueue.c:3429) 
[ 64.537446][ T8067] kthread (kernel/kthread.c:388) 
[ 64.538188][ T8067] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 64.538982][ T8067] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) 
[   64.539877][ T8067]
[   64.540300][ T8067] Last potentially related work creation:
[ 64.541329][ T8067] kasan_save_stack (mm/kasan/common.c:48) 
[ 64.542070][ T8067] __kasan_record_aux_stack (mm/kasan/generic.c:541) 
[ 64.542847][ T8067] kvfree_call_rcu (./arch/x86/include/asm/irqflags.h:26 /arch/x86/include/asm/irqflags.h:67 /arch/x86/include/asm/irqflags.h:103 kernel/rcu/tree.c:2958 kernel/rcu/tree.c:3359 kernel/rcu/tree.c:3444) 
[ 64.543517][ T8067] kernfs_unlink_open_file (fs/kernfs/file.c:586 (discriminator 4)) 
[ 64.544311][ T8067] kernfs_fop_release (fs/kernfs/file.c:766) 
[ 64.545016][ T8067] __fput (fs/file_table.c:423) 
[ 64.545595][ T8067] __fput_sync (fs/file_table.c:508) 
[ 64.546205][ T8067] __x64_sys_close (fs/open.c:1559 fs/open.c:1541 fs/open.c:1541) 
[ 64.546880][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 64.547547][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[   64.548439][ T8067]
[   64.548771][ T8067] The buggy address belongs to the object at ffff88814a21e200
[   64.548771][ T8067]  which belongs to the cache kmalloc-96 of size 96
[   64.550693][ T8067] The buggy address is located 8 bytes inside of
[   64.550693][ T8067]  freed 96-byte region [ffff88814a21e200, ffff88814a21e260)
[   64.552572][ T8067]
[   64.552894][ T8067] The buggy address belongs to the physical page:
[   64.553785][ T8067] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a21e
[   64.554992][ T8067] anon flags: 0x57ff00000000800(slab|node=1|zone=2|lastcpupid=0x7ff)
[   64.556305][ T8067] page_type: 0xffffffff()
[   64.557209][ T8067] raw: 057ff00000000800 ffff888011c41780 ffffea00052f6340 dead000000000005
[   64.559204][ T8067] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[   64.560953][ T8067] page dumped because: kasan: bad access detected
[   64.562281][ T8067] page_owner tracks the page as allocated
[   64.563443][ T8067] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 20193864540
[ 64.566911][ T8067] post_alloc_hook (./include/linux/page_owner.h:32 mm/page_alloc.c:1534) 
[ 64.567974][ T8067] get_page_from_freelist (mm/page_alloc.c:1543 mm/page_alloc.c:3317) 
[ 64.569143][ T8067] __alloc_pages (mm/page_alloc.c:4576) 
[ 64.570134][ T8067] allocate_slab (mm/slub.c:2181 mm/slub.c:2343) 
[ 64.571066][ T8067] ___slab_alloc (mm/slub.c:3531) 
[ 64.572051][ T8067] __slab_alloc.constprop.0 (mm/slub.c:3615) 
[ 64.573174][ T8067] kmalloc_trace (mm/slub.c:3668 mm/slub.c:3841 mm/slub.c:3998) 
[ 64.574120][ T8067] get_device_parent (drivers/base/core.c:3255 drivers/base/core.c:3314) 
[ 64.575207][ T8067] device_add (drivers/base/core.c:3645) 
[ 64.576185][ T8067] device_create_groups_vargs (drivers/base/core.c:4413) 
[ 64.577391][ T8067] device_create (drivers/base/core.c:4454) 
[ 64.578345][ T8067] mon_bin_add (drivers/usb/mon/mon_bin.c:1374 (discriminator 4)) 
[ 64.579280][ T8067] mon_bus_init (drivers/usb/mon/mon_main.c:291) 
[ 64.580257][ T8067] mon_notify (drivers/usb/mon/mon_main.c:189 drivers/usb/mon/mon_main.c:219) 
[ 64.581198][ T8067] notifier_call_chain (kernel/notifier.c:95) 
[ 64.582285][ T8067] blocking_notifier_call_chain (kernel/notifier.c:389 kernel/notifier.c:376) 
[   64.583480][ T8067] page_owner free stack trace missing
[   64.584652][ T8067]
[   64.585149][ T8067] Memory state around the buggy address:
[   64.586318][ T8067]  ffff88814a21e100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
[   64.587984][ T8067]  ffff88814a21e180: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
[   64.589761][ T8067] >ffff88814a21e200: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   64.591498][ T8067]                       ^
[   64.592455][ T8067]  ffff88814a21e280: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[   64.594123][ T8067]  ffff88814a21e300: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[   64.595879][ T8067] ==================================================================
[   64.611805][ T8067] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   64.613464][ T8067] CPU: 1 PID: 8067 Comm: a.out Not tainted 6.9.0 #7
[   64.614916][ T8067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[   64.616894][ T8067] Call Trace:
[   64.617606][ T8067]  <TASK>
[ 64.618238][ T8067] dump_stack_lvl (lib/dump_stack.c:118 (discriminator 4)) 
[ 64.619263][ T8067] panic (kernel/panic.c:348) 
[ 64.620170][ T8067] ? __pfx_panic (kernel/panic.c:282) 
[ 64.621147][ T8067] ? preempt_schedule_thunk (arch/x86/entry/thunk_64.S:12) 
[ 64.622329][ T8067] ? preempt_schedule_common (./arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6927) 
[ 64.623551][ T8067] ? check_panic_on_warn (kernel/panic.c:240) 
[ 64.624663][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.625777][ T8067] check_panic_on_warn (kernel/panic.c:241) 
[ 64.626850][ T8067] end_report (mm/kasan/report.c:226) 
[ 64.627815][ T8067] kasan_report (./arch/x86/include/asm/smap.h:56 mm/kasan/report.c:606) 
[ 64.628749][ T8067] ? hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.629838][ T8067] hfsplus_bnode_read (fs/hfsplus/bnode.c:32) 
[ 64.630907][ T8067] hfsplus_bnode_dump (fs/hfsplus/bnode.c:322) 
[ 64.632056][ T8067] ? __pfx_hfsplus_bnode_dump (fs/hfsplus/bnode.c:292) 
[ 64.633228][ T8067] ? hfsplus_bnode_write_u16 (fs/hfsplus/bnode.c:95) 
[ 64.634372][ T8067] ? hfsplus_bnode_move (fs/hfsplus/bnode.c:182) 
[ 64.635470][ T8067] ? __pfx___hfsplus_brec_find (fs/hfsplus/bfind.c:116) 
[ 64.636722][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) 
[ 64.637863][ T8067] hfsplus_brec_remove (fs/hfsplus/brec.c:230) 
[ 64.638970][ T8067] __hfsplus_delete_attr (fs/hfsplus/attributes.c:300) 
[ 64.640185][ T8067] ? __pfx_hfs_find_1st_rec_by_cnid (fs/hfsplus/bfind.c:59) 
[ 64.641540][ T8067] ? __pfx___hfsplus_delete_attr (fs/hfsplus/attributes.c:268) 
[ 64.642821][ T8067] ? __sanitizer_cov_trace_switch (kernel/kcov.c:340 (discriminator 3)) 
[ 64.644083][ T8067] hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:379) 
[ 64.645289][ T8067] ? __pfx_hfsplus_delete_all_attrs (fs/hfsplus/attributes.c:355) 
[ 64.646670][ T8067] ? __mark_inode_dirty (fs/fs-writeback.c:2499) 
[ 64.647805][ T8067] hfsplus_delete_cat (fs/hfsplus/catalog.c:425) 
[ 64.648842][ T8067] ? __pfx_hfsplus_delete_cat (fs/hfsplus/catalog.c:331) 
[ 64.650020][ T8067] ? avc_lookup (security/selinux/avc.c:567) 
[ 64.650980][ T8067] ? __pfx_mutex_lock (kernel/locking/mutex.c:282) 
[ 64.652044][ T8067] ? __pfx_selinux_inode_permission (security/selinux/hooks.c:3096) 
[ 64.653331][ T8067] hfsplus_unlink (fs/hfsplus/dir.c:386) 
[ 64.654323][ T8067] ? __pfx_hfsplus_unlink (fs/hfsplus/dir.c:359) 
[ 64.655423][ T8067] ? __pfx_selinux_inode_rename (security/selinux/hooks.c:3052) 
[ 64.656647][ T8067] ? down_write (./arch/x86/include/asm/preempt.h:103 kernel/locking/rwsem.c:1309 kernel/locking/rwsem.c:1315 kernel/locking/rwsem.c:1580) 
[ 64.657573][ T8067] ? __pfx_down_write (kernel/locking/rwsem.c:1577) 
[ 64.658605][ T8067] hfsplus_rename (fs/hfsplus/dir.c:547) 
[ 64.659602][ T8067] ? __pfx_hfsplus_rename (fs/hfsplus/dir.c:536) 
[ 64.660787][ T8067] vfs_rename (fs/namei.c:4882) 
[ 64.661798][ T8067] ? __pfx_vfs_rename (fs/namei.c:4760) 
[ 64.662812][ T8067] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:103 /include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186) 
[ 64.663875][ T8067] ? security_path_rename (security/security.c:1920) 
[ 64.664966][ T8067] do_renameat2 (fs/namei.c:5037) 
[ 64.665897][ T8067] ? __pfx_do_renameat2 (fs/namei.c:4921) 
[ 64.666924][ T8067] ? security_file_free (security/security.c:2747) 
[ 64.667996][ T8067] ? preempt_count_add (./include/linux/ftrace.h:974 kernel/sched/core.c:5852 kernel/sched/core.c:5849 kernel/sched/core.c:5877) 
[ 64.669040][ T8067] ? __phys_addr_symbol (arch/x86/mm/physaddr.c:42 (discriminator 2)) 
[ 64.670105][ T8067] ? strncpy_from_user (lib/strncpy_from_user.c:145) 
[ 64.671224][ T8067] __x64_sys_rename (fs/namei.c:5082) 
[ 64.672191][ T8067] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) 
[ 64.673124][ T8067] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[   64.674368][ T8067] RIP: 0033:0x7f9b7d26e73d
[ 64.675354][ T8067] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 78
All code
========
   0:	00 c3                	add    %al,%bl
   2:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
   9:	00 00 00 
   c:	90                   	nop
   d:	f3 0f 1e fa          	endbr64 
  11:	48 89 f8             	mov    %rdi,%rax
  14:	48 89 f7             	mov    %rsi,%rdi
  17:	48 89 d6             	mov    %rdx,%rsi
  1a:	48 89 ca             	mov    %rcx,%rdx
  1d:	4d 89 c2             	mov    %r8,%r10
  20:	4d 89 c8             	mov    %r9,%r8
  23:	4c 8b 4c 24 08       	mov    0x8(%rsp),%r9
  28:	0f 05                	syscall 
  2a:*	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax		<-- trapping instruction
  30:	78                   	.byte 0x78

Code starting with the faulting instruction
===========================================
   0:	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax
   6:	78                   	.byte 0x78
[   64.679398][ T8067] RSP: 002b:00007ffc6ae0d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
[   64.681121][ T8067] RAX: ffffffffffffffda RBX: 000056463a55c410 RCX: 00007f9b7d26e73d
[   64.682737][ T8067] RDX: 0031656c69662f2e RSI: 00000000200001c0 RDI: 0000000020000180
[   64.684367][ T8067] RBP: 00007ffc6ae0d940 R08: 0000000000000000 R09: 00007ffc6ae0d970
[   64.685970][ T8067] R10: 00007ffc6ae0d810 R11: 0000000000000246 R12: 000056463a55a480
[   64.687638][ T8067] R13: 00007ffc6ae0da70 R14: 0000000000000000 R15: 0000000000000000
[   64.689293][ T8067]  </TASK>
[   64.690111][ T8067] Kernel Offset: disabled
[   64.691070][ T8067] Rebooting in 86400 seconds..


Download attachment "repro.c" of type "application/octet-stream" (24558 bytes)

Download attachment ".config" of type "application/octet-stream" (247338 bytes)





Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ