| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202211240933.16187fcc-yujie.liu@intel.com>
Date: Thu, 24 Nov 2022 10:23:53 +0800
From: kernel test robot <yujie.liu@...el.com>
To: Stanislav Fomichev <sdf@...gle.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
John Fastabend <john.fastabend@...il.com>,
David Ahern <dsahern@...il.com>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Jakub Kicinski <kuba@...nel.org>,
Willem de Bruijn <willemb@...gle.com>,
Jesper Dangaard Brouer <brouer@...hat.com>,
"Anatoly Burakov" <anatoly.burakov@...el.com>,
Alexander Lobakin <alexandr.lobakin@...el.com>,
Magnus Karlsson <magnus.karlsson@...il.com>,
Maryam Tahhan <mtahhan@...hat.com>, <bpf@...r.kernel.org>,
<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<ast@...nel.org>, <daniel@...earbox.net>, <andrii@...nel.org>,
<song@...nel.org>, <yhs@...com>, <kpsingh@...nel.org>,
<sdf@...gle.com>, <haoluo@...gle.com>, <jolsa@...nel.org>,
<xdp-hints@...-project.net>
Subject: Re: [PATCH bpf-next v2 2/8] bpf: XDP metadata RX kfuncs
Greeting,
FYI, we noticed BUG:KASAN:use-after-free_in_bpf_prog_free_deferred due to commit (built with gcc-11):
commit: f402227f5d69dc73c19606ed3fdba8f48267e1ad ("[PATCH bpf-next v2 2/8] bpf: XDP metadata RX kfuncs")
url: https://github.com/intel-lab-lkp/linux/commits/Stanislav-Fomichev/xdp-hints-via-kfuncs/20221122-022956
base: https://git.kernel.org/cgit/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/all/20221121182552.2152891-3-sdf@google.com/
patch subject: [PATCH bpf-next v2 2/8] bpf: XDP metadata RX kfuncs
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
[ 42.841965][ T17] BUG: KASAN: use-after-free in bpf_prog_free_deferred (kernel/bpf/core.c:2579)
[ 42.843211][ T17] Read of size 8 at addr ffff8881002e5410 by task kworker/0:1/17
[ 42.844335][ T17]
[ 42.844771][ T17] CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.1.0-rc4-01143-gf402227f5d69 #1
[ 42.846058][ T17] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
[ 42.847558][ T17] Workqueue: events bpf_prog_free_deferred
[ 42.848450][ T17] Call Trace:
[ 42.849040][ T17] <TASK>
[ 42.849563][ T17] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1))
[ 42.850287][ T17] print_address_description+0x87/0x2a1
[ 42.851258][ T17] print_report (mm/kasan/report.c:396)
[ 42.851967][ T17] ? kasan_addr_to_slab (mm/kasan/common.c:35)
[ 42.854814][ T17] ? bpf_prog_free_deferred (kernel/bpf/core.c:2579)
[ 42.855692][ T17] kasan_report (mm/kasan/report.c:497)
[ 42.856360][ T17] ? bpf_prog_free_deferred (kernel/bpf/core.c:2579)
[ 42.857170][ T17] bpf_prog_free_deferred (kernel/bpf/core.c:2579)
[ 42.857967][ T17] process_one_work (kernel/workqueue.c:2294)
[ 42.866880][ T17] worker_thread (include/linux/list.h:292 kernel/workqueue.c:2437)
[ 42.867647][ T17] ? __kthread_parkme (arch/x86/include/asm/bitops.h:207 (discriminator 4) arch/x86/include/asm/bitops.h:239 (discriminator 4) include/asm-generic/bitops/instrumented-non-atomic.h:142 (discriminator 4) kernel/kthread.c:270 (discriminator 4))
[ 42.868405][ T17] ? schedule (arch/x86/include/asm/bitops.h:207 (discriminator 1) arch/x86/include/asm/bitops.h:239 (discriminator 1) include/asm-generic/bitops/instrumented-non-atomic.h:142 (discriminator 1) include/linux/thread_info.h:118 (discriminator 1) include/linux/sched.h:2229 (discriminator 1) kernel/sched/core.c:6581 (discriminator 1))
[ 42.869095][ T17] ? process_one_work (kernel/workqueue.c:2379)
[ 42.869866][ T17] ? process_one_work (kernel/workqueue.c:2379)
[ 42.870679][ T17] kthread (kernel/kthread.c:376)
[ 42.871324][ T17] ? kthread_complete_and_exit (kernel/kthread.c:331)
[ 42.872159][ T17] ret_from_fork (arch/x86/entry/entry_64.S:312)
[ 42.872862][ T17] </TASK>
[ 42.873401][ T17]
[ 42.873867][ T17] Allocated by task 1:
[ 42.874602][ T17] kasan_save_stack (mm/kasan/common.c:46)
[ 42.875331][ T17] kasan_set_track (mm/kasan/common.c:52)
[ 42.876065][ T17] __kasan_kmalloc (mm/kasan/common.c:381)
[ 42.876777][ T17] bpf_prog_alloc_no_stats (include/linux/slab.h:553 include/linux/slab.h:689 kernel/bpf/core.c:99)
[ 42.877596][ T17] bpf_prog_alloc (kernel/bpf/core.c:133)
[ 42.878328][ T17] bpf_prog_load (kernel/bpf/syscall.c:2567)
[ 42.879092][ T17] __sys_bpf (kernel/bpf/syscall.c:4994)
[ 42.879761][ T17] __x64_sys_bpf (kernel/bpf/syscall.c:5096)
[ 42.880471][ T17] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 42.881158][ T17] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[ 42.882031][ T17]
[ 42.882528][ T17] Freed by task 17:
[ 42.883145][ T17] kasan_save_stack (mm/kasan/common.c:46)
[ 42.883877][ T17] kasan_set_track (mm/kasan/common.c:52)
[ 42.884574][ T17] kasan_save_free_info (mm/kasan/generic.c:513)
[ 42.885327][ T17] __kasan_slab_free (mm/kasan/common.c:238 mm/kasan/common.c:200 mm/kasan/common.c:244)
[ 42.886074][ T17] __kmem_cache_free (mm/slub.c:1750 mm/slub.c:3661 mm/slub.c:3674)
[ 42.886819][ T17] __bpf_prog_free (kernel/bpf/core.c:272)
[ 42.887525][ T17] bpf_prog_free_deferred (kernel/bpf/core.c:2577)
[ 42.888327][ T17] process_one_work (kernel/workqueue.c:2294)
[ 42.889092][ T17] worker_thread (include/linux/list.h:292 kernel/workqueue.c:2437)
[ 42.889802][ T17] kthread (kernel/kthread.c:376)
[ 42.890457][ T17] ret_from_fork (arch/x86/entry/entry_64.S:312)
[ 42.891165][ T17]
[ 42.891614][ T17] Last potentially related work creation:
[ 42.892460][ T17] kasan_save_stack (mm/kasan/common.c:46)
[ 42.893212][ T17] __kasan_record_aux_stack (mm/kasan/generic.c:481)
[ 42.894011][ T17] insert_work (include/linux/instrumented.h:72 include/asm-generic/bitops/instrumented-non-atomic.h:141 kernel/workqueue.c:635 kernel/workqueue.c:642 kernel/workqueue.c:1361)
[ 42.894701][ T17] __queue_work (kernel/workqueue.c:1520)
[ 42.895376][ T17] queue_work_on (kernel/workqueue.c:1546)
[ 42.896062][ T17] bpf_prog_load (kernel/bpf/syscall.c:2683)
[ 42.896801][ T17] __sys_bpf (kernel/bpf/syscall.c:4994)
[ 42.897502][ T17] __x64_sys_bpf (kernel/bpf/syscall.c:5096)
[ 42.898196][ T17] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 42.898916][ T17] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[ 42.899771][ T17]
[ 42.900228][ T17] The buggy address belongs to the object at ffff8881002e5000
[ 42.900228][ T17] which belongs to the cache kmalloc-cg-2k of size 2048
[ 42.902205][ T17] The buggy address is located 1040 bytes inside of
[ 42.902205][ T17] 2048-byte region [ffff8881002e5000, ffff8881002e5800)
[ 42.904017][ T17]
[ 42.904437][ T17] The buggy address belongs to the physical page:
[ 42.905361][ T17] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1002e0
[ 42.906841][ T17] head:(____ptrval____) order:3 compound_mapcount:0 compound_pincount:0
[ 42.908071][ T17] flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
[ 42.909306][ T17] raw: 0017ffffc0010200 0000000000000000 dead000000000122 ffff888100043140
[ 42.910563][ T17] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000
[ 42.911802][ T17] page dumped because: kasan: bad access detected
[ 42.912705][ T17] page_owner tracks the page as allocated
[ 42.913547][ T17] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 2112793528, free_ts 0
[ 42.915312][ T17] register_early_stack (mm/page_owner.c:68 mm/page_owner.c:83)
[ 42.916103][ T17] init_page_owner (mm/page_owner.c:94)
[ 42.916785][ T17] kernel_init_freeable (init/main.c:1407 init/main.c:1631)
[ 42.917577][ T17] kernel_init (init/main.c:1521)
[ 42.918253][ T17] page_owner free stack trace missing
[ 42.919095][ T17]
[ 42.919529][ T17] Memory state around the buggy address:
[ 42.920384][ T17] ffff8881002e5300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.921566][ T17] ffff8881002e5380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.922808][ T17] >ffff8881002e5400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.923965][ T17] ^
[ 42.924664][ T17] ffff8881002e5480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.925867][ T17] ffff8881002e5500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.927140][ T17] ==================================================================
[ 42.928610][ T17] Disabling lock debugging due to kernel taint
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202211240933.16187fcc-yujie.liu@intel.com
To reproduce:
# build kernel
cd linux
cp config-6.1.0-rc4-01143-gf402227f5d69 .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-6.1.0-rc4-01143-gf402227f5d69" of type "text/plain" (170354 bytes)
View attachment "job-script" of type "text/plain" (4910 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (30408 bytes)
Powered by blists - more mailing lists