syzbot


KASAN: stack-out-of-bounds Read in change_protection

Status: fixed on 2018/08/07 13:43
Subsystems: mm
[Documentation on labels]
Fix commit: 99ba2b5aba24 bpf: sockhash, disallow bpf_tcp_close and update in parallel
First crash: 2278d, last: 2278d

Sample crash report:
PANIC: double fault, error_code: 0x0
==================================================================
CPU: 0 PID: 11146 Comm: syz-executor7 Not tainted 4.18.0-rc3+ #55
BUG: KASAN: stack-out-of-bounds in change_pte_range mm/mprotect.c:72 [inline]
BUG: KASAN: stack-out-of-bounds in change_pmd_range mm/mprotect.c:210 [inline]
BUG: KASAN: stack-out-of-bounds in change_pud_range mm/mprotect.c:238 [inline]
BUG: KASAN: stack-out-of-bounds in change_p4d_range mm/mprotect.c:258 [inline]
BUG: KASAN: stack-out-of-bounds in change_protection_range mm/mprotect.c:283 [inline]
BUG: KASAN: stack-out-of-bounds in change_protection+0x1d84/0x2160 mm/mprotect.c:304
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Read of size 8 at addr ffff88019e8f9000 by task modprobe/11152
RIP: 0010:__lock_acquire+0x2e/0x5020 kernel/locking/lockdep.c:3294

Code: 
CPU: 1 PID: 11152 Comm: modprobe Not tainted 4.18.0-rc3+ #55
41 57 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
41 89 
Call Trace:
cf 41 
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
56 41 
55 49 
89 fd 
41 54 
45 89 
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
cc 53 
65 4c 
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
8b 34 
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
25 40 
 change_pte_range mm/mprotect.c:72 [inline]
 change_pmd_range mm/mprotect.c:210 [inline]
 change_pud_range mm/mprotect.c:238 [inline]
 change_p4d_range mm/mprotect.c:258 [inline]
 change_protection_range mm/mprotect.c:283 [inline]
 change_protection+0x1d84/0x2160 mm/mprotect.c:304
ee 01 
00 48 
83 e4 
f0 48 
81 
ec 60 
03 
00 00 
48 8b 
45 10 
<89> 94 
24 80 
00 
00 00 
48 ba 
 mprotect_fixup+0x2d2/0x700 mm/mprotect.c:382
00 00 
00 00 
 do_mprotect_pkey+0x5d2/0xa60 mm/mprotect.c:506
00 
fc ff 
 __do_sys_mprotect mm/mprotect.c:531 [inline]
 __se_sys_mprotect mm/mprotect.c:528 [inline]
 __x64_sys_mprotect+0x78/0xb0 mm/mprotect.c:528
df 48 
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
89 84 
24 
98 
RSP: 0018:ffff88019e8f4f00 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 1ffff10033d1ea5d RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff88f92620
RBP: ffff88019e8f5290 R08: 0000000000000000 R09: 0000000000000000
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
R10: ffff88019ebffbe0 R11: ffff8801c4a62efb R12: 0000000000000000
RIP: 0033:0x7f7b31dbe447
R13: ffffffff88f92620 R14: ffff8801c4a62780 R15: 0000000000000002
FS:  0000000001dd5940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
Code: 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88019e8f4ef8 CR3: 00000001ae530000 CR4: 00000000001406f0
73 
DR0: 0000000020000000 DR1: 00000000200001c0 DR2: 0000000000000000
01 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
c3 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/16 10:25 bpf-next 13f7432bdd8e 92a49505 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.