syzbot


KASAN: stack-out-of-bounds Read in get_mem_cgroup_from_mm

Status: fixed on 2018/08/07 13:43
Subsystems: cgroups mm
[Documentation on labels]
Fix commit: 99ba2b5aba24 bpf: sockhash, disallow bpf_tcp_close and update in parallel
First crash: 2288d, last: 2288d

Sample crash report:
==================================================================
PANIC: double fault, error_code: 0x0
BUG: KASAN: stack-out-of-bounds in __read_once_size include/linux/compiler.h:188 [inline]
BUG: KASAN: stack-out-of-bounds in get_mem_cgroup_from_mm+0x384/0x410 mm/memcontrol.c:695
CPU: 0 PID: 30118 Comm: syz-executor0 Not tainted 4.18.0-rc3+ #48
Read of size 8 at addr ffff8801b20c9188 by task udevd/4440
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:__lock_acquire+0x2e/0x5020 kernel/locking/lockdep.c:3294
CPU: 1 PID: 4440 Comm: udevd Not tainted 4.18.0-rc3+ #48
Code: 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
41 
Call Trace:
57 
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
41 
89 
cf 41 
56 41 
55 
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
49 89 
fd 
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
41 
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
54 45 
 __read_once_size include/linux/compiler.h:188 [inline]
 get_mem_cgroup_from_mm+0x384/0x410 mm/memcontrol.c:695
89 
cc 
53 65 
4c 8b 
34 
25 
40 
 memcg_kmem_get_cache+0x20b/0x890 mm/memcontrol.c:2264
ee 
01 
00 
48 83 
e4 
f0 48 
81 ec 
60 03 
00 00 
48 
 slab_pre_alloc_hook mm/slab.h:428 [inline]
 slab_alloc mm/slab.c:3378 [inline]
 kmem_cache_alloc+0x18a/0x760 mm/slab.c:3552
8b 
45 
 dup_mmap kernel/fork.c:458 [inline]
 dup_mm kernel/fork.c:1243 [inline]
 copy_mm kernel/fork.c:1297 [inline]
 copy_process.part.40+0x4581/0x7220 kernel/fork.c:1803
10 
<89> 94 
24 80 
00 
00 
00 48 
ba 
00 
00 
00 
00 00 
fc 
ff 
df 48 
89 
84 
24 
98 
RSP: 0018:ffff8801b1bfbe80 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 1ffff1003637f84c RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff88f92620
RBP: ffff8801b1bfc208 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8801b231fbe0 R11: ffff88019d53cb7b R12: 0000000000000000
R13: ffffffff88f92620 R14: ffff88019d53c400 R15: 0000000000000002
FS:  000000000151a940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801b1bfbe78 CR3: 00000001c2c56000 CR4: 00000000001406f0
DR0: 00000000200001c0 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/10 18:30 bpf-next d90c936fb318 9fa03fa5 .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.