syzbot


KASAN: stack-out-of-bounds Read in vma_interval_tree_insert

Status: closed as invalid on 2018/07/08 10:08
Subsystems: mm
[Documentation on labels]
First crash: 2168d, last: 2168d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: stack-out-of-bounds Read in vma_interval_tree_insert (2) mm 1 2152d 2152d 8/27 fixed on 2018/08/07 13:43

Sample crash report:
==================================================================
BUG: KASAN: stack-out-of-bounds in vma_interval_tree_insert+0x248/0x2a0 mm/interval_tree.c:24
Read of size 8 at addr ffff8801bc118ee0 by task modprobe/6035
PANIC: double fault, error_code: 0x0

CPU: 0 PID: 6036 Comm: syz-executor672 Not tainted 4.18.0-rc3+ #48
CPU: 1 PID: 6035 Comm: modprobe Not tainted 4.18.0-rc3+ #48
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__lock_acquire+0x2e/0x5020 kernel/locking/lockdep.c:3294
Call Trace:
Code: 41 
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
57 41 
89 
cf 
41 
56 41 
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
55 
49 89 
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
fd 41 
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
54 
 vma_interval_tree_insert+0x248/0x2a0 mm/interval_tree.c:24
45 
 __vma_link_file+0xe4/0x1b0 mm/mmap.c:599
89 
 vma_link+0xcd/0x170 mm/mmap.c:625
cc 53 
 mmap_region+0xe69/0x1890 mm/mmap.c:1785
65 
4c 
8b 
34 
25 40 
ee 
01 
00 48 
 do_mmap+0xa06/0x1320 mm/mmap.c:1535
83 
e4 f0 
48 81 
ec 
60 03 
00 
 do_mmap_pgoff include/linux/mm.h:2287 [inline]
 vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357
00 48 
8b 45 
10 <89> 
 vm_mmap+0x90/0xc0 mm/util.c:376
94 
 elf_map+0x18e/0x2b0 fs/binfmt_elf.c:374
24 
 load_elf_interp fs/binfmt_elf.c:587 [inline]
 load_elf_binary+0x1ed6/0x5610 fs/binfmt_elf.c:1087
80 
00 
00 00 
48 
ba 
00 
 search_binary_handler+0x17d/0x570 fs/exec.c:1653
00 
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.36+0x171d/0x2730 fs/exec.c:1819
00 00 
00 fc 
ff df 
48 
89 
84 
24 98 
RSP: 0018:ffff8801ba358de0 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 1ffff1003746b239 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff88f92620
RBP: ffff8801ba359170 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8801bc22f1b8 R11: ffff8801dae236b3 R12: 0000000000000000
R13: ffffffff88f92620 R14: ffff8801b45de3c0 R15: 0000000000000002
FS:  00007fbe6f107700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801ba358dd8 CR3: 00000001be0f4000 CR4: 00000000001406f0
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/07/08 01:49 bpf-next d90c936fb318 ab89aea9 .config console log report syz C ci-upstream-bpf-next-kasan-gce
* Struck through repros no longer work on HEAD.