netdev - Re: [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPhsuW6YOv_xjvknt_FPGwDhuCuG5s=7Xt1t-xL2+F6UKsJf-w@mail.gmail.com>
Date:   Wed, 16 Feb 2022 08:27:26 -0800
From:   Song Liu <song@...nel.org>
To:     Aleksandr Nogikh <nogikh@...gle.com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        syzbot <syzbot+2f649ec6d2eea1495a8f@...kaller.appspotmail.com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>,
        "David S . Miller" <davem@...emloft.net>,
        Jesper Dangaard Brouer <hawk@...nel.org>,
        John Fastabend <john.fastabend@...il.com>,
        Martin KaFai Lau <kafai@...com>,
        KP Singh <kpsingh@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Song Liu <songliubraving@...com>,
        syzkaller-bugs@...glegroups.com, Yonghong Song <yhs@...com>
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Read in bpf_jit_free

Hi Aleksandr,

Thanks for your kind reply!

On Wed, Feb 16, 2022 at 1:38 AM Aleksandr Nogikh <nogikh@...gle.com> wrote:
>
> Hi Song,
>
> Is syzkaller not doing something you expect it to do with this config?

I fixed sshkey in the config, and added a suppression for hsr_node_get_first.
However, I haven't got a repro overnight.

>
> On Wed, Feb 16, 2022 at 2:38 AM Song Liu <song@...nel.org> wrote:
> >
> > On Mon, Feb 14, 2022 at 10:41 PM Song Liu <song@...nel.org> wrote:
> > >
> > > On Mon, Feb 14, 2022 at 3:52 PM Daniel Borkmann <daniel@...earbox.net> wrote:
> > > >
> > > > Song, ptal.
> > > >
> > > > On 2/14/22 7:45 PM, syzbot wrote:
> > > > > Hello,
> > > > >
> > > > > syzbot found the following issue on:
> > > > >
> > > > > HEAD commit:    e5313968c41b Merge branch 'Split bpf_sk_lookup remote_port..
> > > > > git tree:       bpf-next
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=10baced8700000
> > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=c40b67275bfe2a58
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f
> >
> > How do I run the exact same syzkaller? I am doing something like
> >
> > ./bin/syz-manager -config qemu.cfg
> >
> > with the cfg file like:
> >
> > {
> >         "target": "linux/amd64",
> >         "http": ":56741",
> >         "workdir": "workdir",
> >         "kernel_obj": "linux",
> >         "image": "./pkg/mgrconfig/testdata/stretch.img",
>
> This image location looks suspicious - we store some dummy data for
> tests in that folder.
> Instances now run on buildroot-based images, generated with
> https://github.com/google/syzkaller/blob/master/tools/create-buildroot-image.sh

Thanks for the information. I will give it a try.

>
> >         "syzkaller": ".",
> >         "disable_syscalls": ["keyctl", "add_key", "request_key"],
>
> For our bpf instances, instead of disable_syscalls we use enable_syscalls:
>
> "enable_syscalls": [
> "bpf", "mkdir", "mount$bpf", "unlink", "close",
> "perf_event_open*", "ioctl$PERF*", "getpid", "gettid",
> "socketpair", "sendmsg", "recvmsg", "setsockopt$sock_attach_bpf",
> "socket$kcm", "ioctl$sock_kcm*", "syz_clone",
> "mkdirat$cgroup*", "openat$cgroup*", "write$cgroup*",
> "openat$tun", "write$tun", "ioctl$TUN*", "ioctl$SIOCSIFHWADDR",
> "openat$ppp", "syz_open_procfs$namespace"
> ]

I will try with the same list. Thanks!

Song

>
> >         "suppressions": ["some known bug"],
> >         "procs": 8,
>
> We usually run with "procs": 6, but it's not that important.
>
> >         "type": "qemu",
> >         "vm": {
> >                 "count": 16,
> >                 "cpu": 2,
> >                 "mem": 2048,
> >                 "kernel": "linux/arch/x86/boot/bzImage"
> >         }
> > }
>
> Otherwise I don't see any really significant differences.
>
> --
> Best Regards
> Aleksandr
>
> >
> > Is this correct? I am using stretch.img from syzkaller site, and the
> > .config from
> > the link above.
> >
> > Thanks,
> > Song
> >