syzbot


KASAN: alloca-out-of-bounds Read in handle_irq

Status: closed as invalid on 2018/04/13 11:18
First crash: 2200d, last: 2200d

Sample crash report:
==================================================================
BUG: KASAN: alloca-out-of-bounds in stack_overflow_check arch/x86/kernel/irq_64.c:43 [inline]
BUG: KASAN: alloca-out-of-bounds in handle_irq+0x306/0x3a0 arch/x86/kernel/irq_64.c:71
Read of size 8 at addr ffff8801d42776c0 by task syz-executor7/14213

CPU: 0 PID: 14213 Comm: syz-executor7 Not tainted 4.9.92-g7cd9561 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db207eb0 ffffffff81d9c489 ffffea0007509dc0 ffff8801d42776c0
 0000000000000000 ffff8801d42776c0 0000000000000000 ffff8801db207ee8
 ffffffff8156556b ffff8801d42776c0 0000000000000008 0000000000000000
Call Trace:
 <IRQ> [  667.172755]  [<ffffffff81d9c489>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [  667.172755]  [<ffffffff81d9c489>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8156556b>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff815657df>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff815657df>] kasan_report.cold.6+0xac/0x2f5 mm/kasan/report.c:412
 [<ffffffff815395f4>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff81059ab6>] stack_overflow_check arch/x86/kernel/irq_64.c:43 [inline]
 [<ffffffff81059ab6>] handle_irq+0x306/0x3a0 arch/x86/kernel/irq_64.c:71
 [<ffffffff838d8139>] do_IRQ+0x89/0x1c0 arch/x86/kernel/irq.c:239
 [<ffffffff838d61e0>] common_interrupt+0xa0/0xa0 arch/x86/entry/entry_64.S:461
 <EOI> [  667.234666]  [<ffffffff8317d250>] ? xt_osf_add_callback+0x310/0x310 include/linux/rculist.h:102
 [<ffffffff830af495>] netlink_rcv_skb+0x145/0x370 net/netlink/af_netlink.c:2353
 [<ffffffff830bd326>] nfnetlink_rcv+0x9c6/0x10f0 net/netfilter/nfnetlink.c:474
 [<ffffffff830ae068>] netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline]
 [<ffffffff830ae068>] netlink_unicast+0x4d8/0x6f0 net/netlink/af_netlink.c:1301
 [<ffffffff830aea0b>] netlink_sendmsg+0x78b/0xc10 net/netlink/af_netlink.c:1847
 [<ffffffff82ef3fcc>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ef3fcc>] sock_sendmsg+0xcc/0x110 net/socket.c:645
 [<ffffffff82ef5a6c>] ___sys_sendmsg+0x6fc/0x840 net/socket.c:1969
 [<ffffffff82ef7ad9>] __sys_sendmsg+0xd9/0x190 net/socket.c:2003
 [<ffffffff82ff937a>] C_SYSC_sendmsg net/compat.c:734 [inline]
 [<ffffffff82ff937a>] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:732
 [<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 [<ffffffff838d6fd0>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the page:
page:ffffea0007509dc0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d4277580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d4277600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d4277680: ca ca ca ca 00 00 00 cb cb cb cb cb 00 00 00 00
                                           ^
 ffff8801d4277700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d4277780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/05 15:01 https://android.googlesource.com/kernel/common android-4.9 7cd956196346 5e1ccffc .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.