syzbot


KASAN: stack-out-of-bounds Read in unmap_page_range (2)

Status: closed as invalid on 2018/07/08 10:08
Subsystems: mm
[Documentation on labels]
First crash: 2132d, last: 2132d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in unmap_page_range mm 1 2132d 2132d 0/26 closed as invalid on 2018/07/07 11:48
upstream KASAN: stack-out-of-bounds Read in unmap_page_range (3) mm 1 2117d 2116d 8/26 fixed on 2018/08/07 13:43

Sample crash report:
EXT4-fs warning (device sda1): ext4_group_add:1636: No reserved GDT blocks, can't resize
EXT4-fs warning (device sda1): ext4_group_add:1636: No reserved GDT blocks, can't resize
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: stack-out-of-bounds in zap_pte_range mm/memory.c:1299 [inline]
BUG: KASAN: stack-out-of-bounds in zap_pmd_range mm/memory.c:1437 [inline]
BUG: KASAN: stack-out-of-bounds in zap_pud_range mm/memory.c:1466 [inline]
BUG: KASAN: stack-out-of-bounds in zap_p4d_range mm/memory.c:1487 [inline]
BUG: KASAN: stack-out-of-bounds in unmap_page_range+0x1da1/0x2220 mm/memory.c:1508
kasan: GPF could be caused by NULL-ptr deref or user memory access
Read of size 8 at addr ffff88019c1cd000 by task syz-executor0/9034
general protection fault: 0000 [#1] SMP KASAN

CPU: 1 PID: 0 Comm:  Not tainted 4.18.0-rc3+ #48
CPU: 0 PID: 9034 Comm: syz-executor0 Not tainted 4.18.0-rc3+ #48
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149 [inline]
RIP: 0010:account_system_index_time+0xef/0x5c0 kernel/sched/cputime.c:168
Call Trace:
Code: ad 04 00 
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
00 
48 8b 
83 b8 
06 00 
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
00 48 
ba 
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
00 
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
00 00 
 zap_pte_range mm/memory.c:1299 [inline]
 zap_pmd_range mm/memory.c:1437 [inline]
 zap_pud_range mm/memory.c:1466 [inline]
 zap_p4d_range mm/memory.c:1487 [inline]
 unmap_page_range+0x1da1/0x2220 mm/memory.c:1508
00 
00 
fc 
ff df 
48 
8d b8 
38 01 
00 00 
48 8d 
88 20 
01 
00 00 
48 89 
fe 48 
c1 ee 
03 
<0f> b6 
14 
16 
48 
89 
fe 
83 e6 
07 
40 38 
f2 7f 
08 
84 
d2 0f 
85 f9 
 unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
03 00 
 unmap_vmas+0x120/0x1f0 mm/memory.c:1583
 exit_mmap+0x2c2/0x5b0 mm/mmap.c:3105
RSP: 0018:ffff8801daf07988 EFLAGS: 00010007
RAX: 1ffff1003371cdd7 RBX: ffff88019b8e6780 RCX: 1ffff1003371cef7
RDX: dffffc0000000000 RSI: 03fffe20066e39e1 RDI: 1ffff1003371cf0f
 __mmput kernel/fork.c:970 [inline]
 mmput+0x265/0x620 kernel/fork.c:991
RBP: ffff8801daf07a68 R08: ffff88019b8e6780 R09: fffffbfff11f424c
R10: fffffbfff11c1b45 R11: ffffffff88fa1263 R12: 00000000000f4240
R13: 00000000000f4240 R14: 1ffff1003b5e0f34 R15: ffff8801daf07a40
FS:  00007f31209e1700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f84b16ebdb8 CR3: 00000001a2089000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 exit_mm kernel/exit.c:544 [inline]
 do_exit+0xea9/0x2750 kernel/exit.c:852
 <IRQ>
 account_system_time+0x7f/0xb0 kernel/sched/cputime.c:199
 account_process_tick+0x76/0x240 kernel/sched/cputime.c:498
 update_process_times+0x21/0x70 kernel/time/timer.c:1634
 tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
 tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x3eb/0x10c0 kernel/time/hrtimer.c:1460
 hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x165/0x730 arch/x86/kernel/apic/apic.c:1050
 do_group_exit+0x177/0x440 kernel/exit.c:968
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 </IRQ>
Modules linked in:
 get_signal+0x88e/0x1970 kernel/signal.c:2468
Dumping ftrace buffer:
   (ftrace buffer empty)
---[ end trace 21147a2a3ba0a8b7 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149 [inline]
RIP: 0010:account_system_index_time+0xef/0x5c0 kernel/sched/cputime.c:168
Code: 
ad 04 
00 
 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
00 
48 
8b 83 
b8 
06 
00 
00 48 
ba 00 
 exit_to_usermode_loop+0x2e0/0x370 arch/x86/entry/common.c:162
00 00 
00 
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
00 fc 
ff 
df 
48 8d 
b8 38 
01 
00 00 
48 8d 
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
88 
RIP: 0033:0x455ba9
20 01 
Code: 
00 00 
1d 
48 89 
ba 
fe 48 
fb 
c1 
ff c3 
ee 03 
66 2e 
<0f> 
0f 1f 
b6 
84 00 
14 
00 
16 48 
00 
89 fe 
00 
83 
00 
e6 
66 
07 
90 
40 38 
48 
f2 
89 f8 
7f 08 
48 
84 d2 
89 f7 
0f 85 
48 
f9 
89 
03 
d6 48 
00 
89 ca 
RSP: 0018:ffff8801daf07988 EFLAGS: 00010007
4d 89 
c2 
RAX: 1ffff1003371cdd7 RBX: ffff88019b8e6780 RCX: 1ffff1003371cef7
4d 
RDX: dffffc0000000000 RSI: 03fffe20066e39e1 RDI: 1ffff1003371cf0f
89 
RBP: ffff8801daf07a68 R08: ffff88019b8e6780 R09: fffffbfff11f424c
c8 
R10: fffffbfff11c1b45 R11: ffffffff88fa1263 R12: 00000000000f4240
4c 8b 
R13: 00000000000f4240 R14: 1ffff1003b5e0f34 R15: ffff8801daf07a40
4c 
FS:  00007f31209e1700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
24 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f84b16ebdb8 CR3: 00000001a2089000 CR4: 00000000001406e0
08 
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
0f 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
05 <48> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/08 06:11 bpf-next d90c936fb318 c9a7a4dc .config console log report ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.