Messages in this thread | | | From | (Eric W. Biederman) | Date | Thu, 24 Jun 2021 00:30:16 -0500 | Subject | Re: [syzbot] KASAN: out-of-bounds Read in do_exit |
| |
syzbot <syzbot+b80bbdcca4c4dfaa189e@syzkaller.appspotmail.com> writes:
> Hello, > > syzbot found the following issue on:
This looks like dueling debug mechanism. At a quick glance stack_no_used is deliberately looking for an uninitialized part of the stack.
Perhaps the fix is to make KASAN and DEBUG_STACK_USAGE impossible to select at the same time in Kconfig?
Eric
> > HEAD commit: 9ed13a17 Merge tag 'net-5.13-rc7' of git://git.kernel.org/.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=116c517bd00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=bf635d6d1c7ebabc > dashboard link: https://syzkaller.appspot.com/bug?extid=b80bbdcca4c4dfaa189e > compiler: Debian clang version 11.0.1-2 > > Unfortunately, I don't have any reproducer for this issue yet. > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+b80bbdcca4c4dfaa189e@syzkaller.appspotmail.com > > ================================================================== > BUG: KASAN: out-of-bounds in stack_not_used include/linux/sched/task_stack.h:101 [inline] > BUG: KASAN: out-of-bounds in check_stack_usage kernel/exit.c:711 [inline] > BUG: KASAN: out-of-bounds in do_exit+0x1c6b/0x23d0 kernel/exit.c:869 > Read of size 8 at addr ffffc90017d60400 by task loop0/31717 > > CPU: 0 PID: 31717 Comm: loop0 Not tainted 5.13.0-rc6-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:79 [inline] > dump_stack+0x202/0x31e lib/dump_stack.c:120 > print_address_description+0x5f/0x3b0 mm/kasan/report.c:233 > __kasan_report mm/kasan/report.c:419 [inline] > kasan_report+0x15c/0x200 mm/kasan/report.c:436 > stack_not_used include/linux/sched/task_stack.h:101 [inline] > check_stack_usage kernel/exit.c:711 [inline] > do_exit+0x1c6b/0x23d0 kernel/exit.c:869 > kthread+0x3b8/0x3c0 kernel/kthread.c:315 > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 > > > Memory state around the buggy address: > ffffc90017d60300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffffc90017d60380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>ffffc90017d60400: 07 07 07 07 07 07 07 07 00 00 00 00 00 00 00 00 > ^ > ffffc90017d60480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffffc90017d60500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ================================================================== > > > --- > This report is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this issue. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
| |