syzbot

 sign-in | mailing list | source | docs
🐞 Open [1028] ≡ Subsystems 🐞 Fixed [5274] 🐞 Invalid [12596] ⬇ Missing Backports [86] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init

Status: fixed on 2022/03/08 16:11
Subsystems: bpf
[Documentation on labels]
Reported-by: syzbot+e0d81ec552a21d9071aa@syzkaller.appspotmail.com
Fix commit: 9e2ad638ae36 bpf: Extend BTF_ID_LIST_GLOBAL with parameter for number of IDs
First crash: 912d, last: 907d
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH v3 bpf-next 0/2] introduce btf_tracing_ids 6 (6) 2021/11/12 18:24
[PATCH v2 bpf-next 0/2] introduce btf_tracing_ids 5 (5) 2021/11/12 10:41
[PATCH bpf-next] bpf: extend BTF_ID_LIST_GLOBAL with parameter for number of IDs 6 (6) 2021/11/10 22:18
[PATCH bpf-next] bpf: fix btf_task_struct_ids w/o CONFIG_DEBUG_INFO_BTF 4 (4) 2021/11/10 00:08
[syzbot] bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init 0 (1) 2021/11/08 22:55

Sample crash report:
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: CMTP (CAPI Emulation) ver 1.0
Bluetooth: CMTP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
NET: Registered PF_RXRPC protocol family
Key type rxrpc registered
Key type rxrpc_s registered
NET: Registered PF_KCM protocol family
lec:lane_module_init: lec.c: initialized
mpoa:atm_mpoa_init: mpc.c: initialized
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
l2tp_ip: L2TP IP encapsulation support (L2TPv3)
l2tp_netlink: L2TP netlink interface
l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
NET: Registered PF_PHONET protocol family
8021q: 802.1Q VLAN Support v1.8
DCCP: Activated CCID 2 (TCP-like)
DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
sctp: Hash tables configured (bind 32/56)
NET: Registered PF_RDS protocol family
Registered RDS/infiniband transport
Registered RDS/tcp transport
tipc: Activated (version 2.0.0)
NET: Registered PF_TIPC protocol family
tipc: Started in single node mode
NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
NET: Registered PF_CAIF protocol family
NET: Registered PF_IEEE802154 protocol family
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
batman_adv: B.A.T.M.A.N. advanced 2021.3 (compatibility version 15) loaded
openvswitch: Open vSwitch switching datapath
NET: Registered PF_VSOCK protocol family
mpls_gso: MPLS GSO support
IPI shorthand broadcast: enabled
AVX2 version of gcm_enc/dec engaged.
AES CTR mode by8 optimization enabled
sched_clock: Marking stable (13905481154, 28510811)->(13950732200, -16740235)
registered taskstats version 1
==================================================================
BUG: KASAN: global-out-of-bounds in task_iter_init+0x212/0x2e7 kernel/bpf/task_iter.c:661
Read of size 4 at addr ffffffff90298404 by task swapper/0/1

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xf/0x309 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
 task_iter_init+0x212/0x2e7 kernel/bpf/task_iter.c:661
 do_one_initcall+0x103/0x650 init/main.c:1295
 do_initcall_level init/main.c:1368 [inline]
 do_initcalls init/main.c:1384 [inline]
 do_basic_setup init/main.c:1403 [inline]
 kernel_init_freeable+0x6b1/0x73a init/main.c:1606
 kernel_init+0x1a/0x1d0 init/main.c:1497
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

The buggy address belongs to the variable:
 btf_task_struct_ids+0x4/0x40

Memory state around the buggy address:
 ffffffff90298300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff90298380: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
>ffffffff90298400: 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
                   ^
 ffffffff90298480: 00 04 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
 ffffffff90298500: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
==================================================================

Crashes (42):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/11/12 16:22 bpf-next 314f14abdeca 83f5c9b5 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 16:22 bpf-next 314f14abdeca 83f5c9b5 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 02:12 bpf-next 9faaffbe85ed 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 02:12 bpf-next 9faaffbe85ed 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 02:12 bpf-next 9faaffbe85ed 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:42 bpf-next 2326ff8d5c66 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:42 bpf-next 2326ff8d5c66 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:42 bpf-next 2326ff8d5c66 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:12 bpf-next 3a75111d8a43 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:12 bpf-next 3a75111d8a43 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/12 01:12 bpf-next 3a75111d8a43 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/11 01:22 bpf-next 04f8cb6d6b67 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/11 01:22 bpf-next 04f8cb6d6b67 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/11 01:22 bpf-next 04f8cb6d6b67 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 17:32 bpf-next 1a8b597ddabe 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 17:32 bpf-next 1a8b597ddabe 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 17:32 bpf-next 1a8b597ddabe 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 12:41 bpf-next 3a74ac2d1159 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 12:41 bpf-next 3a74ac2d1159 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 12:41 bpf-next 3a74ac2d1159 75b04091 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 00:39 bpf-next 3a74ac2d1159 55fa030c .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 00:39 bpf-next 3a74ac2d1159 55fa030c .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/10 00:39 bpf-next 3a74ac2d1159 55fa030c .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 22:04 bpf-next 3a74ac2d1159 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 22:04 bpf-next 3a74ac2d1159 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 22:04 bpf-next 3a74ac2d1159 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 12:33 bpf-next c23551c9c36a 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 12:33 bpf-next c23551c9c36a 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/09 12:33 bpf-next c23551c9c36a 59bcaf9a .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 23:40 bpf-next c23551c9c36a 8ab17e57 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 23:40 bpf-next c23551c9c36a 8ab17e57 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 23:40 bpf-next c23551c9c36a 8ab17e57 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 21:46 bpf-next c23551c9c36a d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 21:46 bpf-next c23551c9c36a d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 21:46 bpf-next c23551c9c36a d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 11:37 bpf-next 0cc78dcca36d d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 11:37 bpf-next 0cc78dcca36d d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 11:37 bpf-next 0cc78dcca36d d29682f1 .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 06:08 bpf-next 0cc78dcca36d 4c1be0be .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 06:08 bpf-next 0cc78dcca36d 4c1be0be .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
2021/11/08 06:08 bpf-next 0cc78dcca36d 4c1be0be .config console log report ci-upstream-bpf-next-kasan-gce bpf-next boot error: KASAN: global-out-of-bounds Read in task_iter_init
* Struck through repros no longer work on HEAD.