netdev - Re: KASAN: vmalloc-out-of-bounds Read in bpf_trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d967ff2d-e272-b966-407c-82dca9a08e04@fb.com>
Date:   Sat, 23 Jan 2021 11:35:53 -0800
From:   Yonghong Song <yhs@...com>
To:     syzbot <syzbot+fad5d91c7158ce568634@...kaller.appspotmail.com>,
        <andrii@...nel.org>, <andriin@...com>, <ast@...nel.org>,
        <bpf@...r.kernel.org>, <daniel@...earbox.net>,
        <davem@...emloft.net>, <hawk@...nel.org>,
        <jakub.kicinski@...ronome.com>, <john.fastabend@...il.com>,
        <kafai@...com>, <kpsingh@...nel.org>, <kuba@...nel.org>,
        <linux-kernel@...r.kernel.org>, <mingo@...hat.com>,
        <netdev@...r.kernel.org>, <rostedt@...dmis.org>,
        <songliubraving@...com>, <syzkaller-bugs@...glegroups.com>,
        <xdp-newbies@...r.kernel.org>
Subject: Re: KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7


I can reproduce the issue with C reproducer. This is an old known issue 
though and the failure is due to memory allocation failure in 
tracepoint_probe_unregister().

[   40.807849][ T8287] Call Trace:
[   40.808201][ T8287]  dump_stack+0x77/0x97
[   40.808695][ T8287]  should_fail.cold.6+0x32/0x4c
[   40.809238][ T8287]  should_failslab+0x5/0x10
[   40.809709][ T8287]  slab_pre_alloc_hook.constprop.97+0xa0/0xd0
[   40.810365][ T8287]  ? tracepoint_probe_unregister+0xc7/0x2b0
[   40.810998][ T8287]  __kmalloc+0x64/0x210
[   40.811442][ T8287]  ? trace_raw_output_percpu_destroy_chunk+0x40/0x40
[   40.812158][ T8287]  tracepoint_probe_unregister+0xc7/0x2b0
[   40.812766][ T8287]  bpf_raw_tp_link_release+0x11/0x20
[   40.813328][ T8287]  bpf_link_free+0x20/0x40
[   40.813802][ T8287]  bpf_link_release+0xc/0x10
[   40.814242][ T8287]  __fput+0xa1/0x250
[   40.814606][ T8287]  task_work_run+0x68/0xb0
[   40.815030][ T8287]  exit_to_user_mode_prepare+0x22c/0x250

Steven Rostedt has the following pending patch
   https://lore.kernel.org/bpf/20201118093405.7a6d2290@gandalf.local.home/
trying to solve this exact problem.

On 1/20/21 11:14 PM, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit 8b401f9ed2441ad9e219953927a842d24ed051fc
> Author: Yonghong Song <yhs@...com>
> Date:   Thu May 23 21:47:45 2019 +0000
> 
>      bpf: implement bpf_send_signal() helper
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=123408e7500000
> start commit:   7d68e382 bpf: Permit size-0 datasec
> git tree:       bpf-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=113408e7500000
> console output: https://syzkaller.appspot.com/x/log.txt?x=163408e7500000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e0c7843b8af99dff
> dashboard link: https://syzkaller.appspot.com/bug?extid=fad5d91c7158ce568634
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1224daa4d00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13dfabd0d00000
> 
> Reported-by: syzbot+fad5d91c7158ce568634@...kaller.appspotmail.com
> Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper")
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>