KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7

Status: auto-obsoleted due to no activity on 2022/09/03 18:37
Subsystems: bpf trace
[Documentation on labels]
Reported-by: syzbot+fad5d91c7158ce568634@syzkaller.appspotmail.com
First crash: 2043d, last: 1999d
Cause bisection: introduced by (bisect log) :
commit 8b401f9ed2441ad9e219953927a842d24ed051fc
Author: Yonghong Song <yhs@fb.com>
Date: Thu May 23 21:47:45 2019 +0000

  bpf: implement bpf_send_signal() helper

Crash: BUG: unable to handle kernel paging request in bpf_trace_run7 (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7 1 (4) 2021/01/23 19:35
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 BUG: unable to handle kernel paging request in bpf_trace_run7 8 syz, C 3 1992d 2028d 0/2 auto-obsoleted due to no activity on 2023/04/17 18:57
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2022/09/03 13:27 19m retest repro bpf-next OK log
2021/03/15 04:38 17m ducheng2@gmail.com bpf-next OK

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in __bpf_trace_run kernel/trace/bpf_trace.c:2088 [inline]
BUG: KASAN: vmalloc-out-of-bounds in bpf_trace_run7+0x411/0x420 kernel/trace/bpf_trace.c:2130
Read of size 8 at addr ffffc90000e5c030 by task syz-executor460/8508

CPU: 1 PID: 8508 Comm: syz-executor460 Not tainted 5.11.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5/0x2f8 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413
 __bpf_trace_run kernel/trace/bpf_trace.c:2088 [inline]
 bpf_trace_run7+0x411/0x420 kernel/trace/bpf_trace.c:2130
 __bpf_trace_percpu_alloc_percpu+0x1dc/0x220 include/trace/events/percpu.h:10
 __traceiter_percpu_alloc_percpu+0x97/0xf0 include/trace/events/percpu.h:10
 trace_percpu_alloc_percpu include/trace/events/percpu.h:10 [inline]
 pcpu_alloc+0xba6/0x16f0 mm/percpu.c:1844
 bpf_prog_alloc+0x78/0x250 kernel/bpf/core.c:117
 bpf_prog_load+0x656/0x1f40 kernel/bpf/syscall.c:2152
 __do_sys_bpf+0x1251/0x4f00 kernel/bpf/syscall.c:4380
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x441659
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffebad746f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441659
RDX: 0000000000000078 RSI: 0000000020000200 RDI: 0000000000000005
RBP: 000000000001191b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402470
R13: 0000000000402500 R14: 0000000000000000 R15: 0000000000000000


Memory state around the buggy address:
 ffffc90000e5bf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000e5bf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000e5c000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                     ^
 ffffc90000e5c080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000e5c100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/20 23:08 bpf-next 7d68e3828842 d4f4eca5 .config console log report syz C ci-upstream-bpf-next-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/02/11 07:42 bpf-next cf2d0a5e788b a52ee10a .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/02/11 04:09 net-next-old dc9d87581d46 a52ee10a .config console log report info ci-upstream-net-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/02/11 03:53 bpf-next cf2d0a5e788b a52ee10a .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/02/06 07:07 bpf-next 23a2d70c7a2f 23a562df .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/01/21 20:11 bpf-next b452ee005a91 d4f4eca5 .config console log report info ci-upstream-bpf-next-kasan-gce KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
2021/01/13 11:33 bpf-next 7c7a80ea5e3f a945f0a3 .config console log report info ci-upstream-bpf-next-kasan-gce
2020/12/29 12:45 bpf-next 00a279e42f67 8259d56c .config console log report info ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.