KASAN: stack-out-of-bounds Read in __free_filter

DISCUSSION syzbot 3 participants 5 messages Apr 11, 2018 Tracing

Share & tools

syzbot

author syzbot

2018-04-11 12:02 UTC #0 lore raw

Hello,

syzbot hit the following crash on upstream commit b284d4d5a6785f8cd07eda2646a95782373cd01e (Tue Apr 10 19:25:30 2018 +0000) Merge tag 'ceph-for-4.17-rc1' of git://github.com/ceph/ceph-client
syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=dadcc936587643d7f568

So far this crash happened 6 times on upstream.
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6547381214511104
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5485642750361600
Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5352489637380096
Kernel config: https://syzkaller.appspot.com/x/.config?id=-1223000601505858474
compiler: gcc (GCC) 8.0.1 20180301 (experimental)

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by [email protected]

It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer.

RDX: 000000002099aff9 RSI: 0000000040082406 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000001 R09: 00007ffe76420032
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000
==================================================================

BUG: KASAN: stack-out-of-bounds in __read_once_size include/linux/compiler.h:188 [inline]
BUG: KASAN: stack-out-of-bounds in free_prog kernel/trace/trace_events_filter.c:988 [inline]
BUG: KASAN: stack-out-of-bounds in __free_filter.part.6+0x1ac/0x1d0 kernel/trace/trace_events_filter.c:1012
Read of size 8 at addr ffff8801b2cd7698 by task syzkaller788882/4452

CPU: 0 PID: 4452 Comm: syzkaller788882 Not tainted 4.16.0+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 __read_once_size include/linux/compiler.h:188 [inline]
 free_prog kernel/trace/trace_events_filter.c:988 [inline]
 __free_filter.part.6+0x1ac/0x1d0 kernel/trace/trace_events_filter.c:1012
 __free_filter kernel/trace/trace_events_filter.c:1009 [inline]
 ftrace_profile_set_filter+0x159/0x2b0  
kernel/trace/trace_events_filter.c:2053
 perf_event_set_filter+0x248/0x1230 kernel/events/core.c:9064
 _perf_ioctl+0x84c/0x1650 kernel/events/core.c:5056
 perf_ioctl+0x59/0x80 kernel/events/core.c:5107
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x1cf/0x1650 fs/ioctl.c:684
 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x24/0x30 fs/ioctl.c:706
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x440519
RSP: 002b:00007ffe7642b3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440519
RDX: 000000002099aff9 RSI: 0000000040082406 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000001 R09: 00007ffe76420032
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea0006cb35c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffffea0006cb0101 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801b2cd7580: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f3
 ffff8801b2cd7600: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 f1 f1 f1

Quoted 1 line

ffff8801b2cd7680: f1 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00

ffff8801b2cd7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
ffff8801b2cd7780: f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2
==================================================================

---
This bug is generated by a dumb bot. It may contain errors. See https://goo.gl/tpsmEJ for details.
Direct all questions to [email protected].

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is merged into any tree, please reply to this email with:
#syz fix: exact-commit-title
If you want to test a patch for this bug, please reply with:
#syz test: git://repo/address.git branch
and provide the patch inline or as an attachment.
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug report.
Note: all commands must start from beginning of the line in the email body.

Steven Rostedt

maintainer

2018-04-11 14:47 UTC #1 lore raw

Quoted 18 lines · On Wed, 11 Apr 2018 05:02:02 -0700 syzbot…

Hello,
syzbot hit the following crash on upstream commit b284d4d5a6785f8cd07eda2646a95782373cd01e (Tue Apr 10 19:25:30 2018 +0000) Merge tag 'ceph-for-4.17-rc1' of git://github.com/ceph/ceph-client
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=dadcc936587643d7f568
So far this crash happened 6 times on upstream.
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6547381214511104
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=5485642750361600
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=5352489637380096
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-1223000601505858474
compiler: gcc (GCC) 8.0.1 20180301 (experimental)

Quoted 6 lines

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by [email protected]
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.

Can you try this patch?

-- Steve

kernel/trace/trace_events_filter.c +10 ~~-14~~

index 33b7720e2aa1..5c07ae2ac5d7 100644
@@ -1705,18 +1705,16 @@ static int create_filter(struct trace_event_call *call,
 			 struct event_filter **filterp)
 {
 	struct filter_parse_error *pe = NULL;
-	struct event_filter *filter = NULL;
 	int err;
 
-	err = create_filter_start(filter_string, set_str, &pe, &filter);
+	err = create_filter_start(filter_string, set_str, &pe, filterp);
 	if (err)
 		return err;
 
-	err = process_preds(call, filter_string, filter, pe);
+	err = process_preds(call, filter_string, *filterp, pe);
 	if (err && set_str)
-		append_filter_err(pe, filter);
+		append_filter_err(pe, *filterp);
 
-	*filterp = filter;
 	return err;
 }

@@ -1740,24 +1738,22 @@ static int create_system_filter(struct trace_subsystem_dir *dir,
 				struct trace_array *tr,
 				char *filter_str, struct event_filter **filterp)
 {
-	struct event_filter *filter = NULL;
 	struct filter_parse_error *pe = NULL;
 	int err;
 
-	err = create_filter_start(filter_str, true, &pe, &filter);
+	err = create_filter_start(filter_str, true, &pe, filterp);
 	if (!err) {
 		err = process_system_preds(dir, tr, pe, filter_str);
 		if (!err) {
 			/* System filters just show a default message */
-			kfree(filter->filter_string);
-			filter->filter_string = NULL;
+			kfree((*filterp)->filter_string);
+			(*filterp)->filter_string = NULL;
 		} else {
-			append_filter_err(pe, filter);
+			append_filter_err(pe, *filterp);
 		}
 	}
 	create_filter_finish(pe);
 
-	*filterp = filter;
 	return err;
 }

@@ -1765,7 +1761,7 @@ static int create_system_filter(struct trace_subsystem_dir *dir,
 int apply_event_filter(struct trace_event_file *file, char *filter_string)
 {
 	struct trace_event_call *call = file->event_call;
-	struct event_filter *filter;
+	struct event_filter *filter = NULL;
 	int err;
 
 	if (!strcmp(strstrip(filter_string), "0")) {

@@ -1818,7 +1814,7 @@ int apply_subsystem_event_filter(struct trace_subsystem_dir *dir,
 {
 	struct event_subsystem *system = dir->subsystem;
 	struct trace_array *tr = dir->tr;
-	struct event_filter *filter;
+	struct event_filter *filter = NULL;
 	int err = 0;
 
 	mutex_lock(&event_mutex);

@@ -2025,7 +2021,7 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
 			      char *filter_str)
 {
 	int err;
-	struct event_filter *filter;
+	struct event_filter *filter = NULL;
 	struct trace_event_call *call;
 
 	mutex_lock(&event_mutex);

Dmitry Vyukov

2018-04-11 14:51 UTC #2 lore raw

Quoted 21 lines · Steven Rostedt

Quoted 18 lines · On Wed, 11 Apr 2018 05:02:02 -0700 syzbot…
Hello,
syzbot hit the following crash on upstream commit b284d4d5a6785f8cd07eda2646a95782373cd01e (Tue Apr 10 19:25:30 2018 +0000) Merge tag 'ceph-for-4.17-rc1' of git://github.com/ceph/ceph-client
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=dadcc936587643d7f568
So far this crash happened 6 times on upstream.
C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6547381214511104
syzkaller reproducer:
https://syzkaller.appspot.com/x/repro.syz?id=5485642750361600
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=5352489637380096
Kernel config:
https://syzkaller.appspot.com/x/.config?id=-1223000601505858474
compiler: gcc (GCC) 8.0.1 20180301 (experimental)

Quoted 8 lines

Quoted 6 lines
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by [email protected]
It will help syzbot understand when the bug is fixed. See footer for details.
If you forward the report, please keep this part and the footer.
Can you try this patch?

Hi Steve,

Instructions for asking syzbot to test a patch are here:

https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communication-with-syzbot

Quoted 90 lines

-- Steve

kernel/trace/trace_events_filter.c +10 ~~-15~~

index 33b7720e2aa1..5c07ae2ac5d7 100644
@@ -1705,18 +1705,16 @@ static int create_filter(struct trace_event_call *call,
                         struct event_filter **filterp)
 {
        struct filter_parse_error *pe = NULL;
-       struct event_filter *filter = NULL;
        int err;
 
-       err = create_filter_start(filter_string, set_str, &pe, &filter);
+       err = create_filter_start(filter_string, set_str, &pe, filterp);
        if (err)
                return err;
 
-       err = process_preds(call, filter_string, filter, pe);
+       err = process_preds(call, filter_string, *filterp, pe);
        if (err && set_str)
-               append_filter_err(pe, filter);
+               append_filter_err(pe, *filterp);
 
-       *filterp = filter;
        return err;
 }

@@ -1740,24 +1738,22 @@ static int create_system_filter(struct trace_subsystem_dir *dir,
                                struct trace_array *tr,
                                char *filter_str, struct event_filter **filterp)
 {
-       struct event_filter *filter = NULL;
        struct filter_parse_error *pe = NULL;
        int err;
 
-       err = create_filter_start(filter_str, true, &pe, &filter);
+       err = create_filter_start(filter_str, true, &pe, filterp);
        if (!err) {
                err = process_system_preds(dir, tr, pe, filter_str);
                if (!err) {
                        /* System filters just show a default message */
-                       kfree(filter->filter_string);
-                       filter->filter_string = NULL;
+                       kfree((*filterp)->filter_string);
+                       (*filterp)->filter_string = NULL;
                } else {
-                       append_filter_err(pe, filter);
+                       append_filter_err(pe, *filterp);
                }
        }
        create_filter_finish(pe);
 
-       *filterp = filter;
        return err;
 }

@@ -1765,7 +1761,7 @@ static int create_system_filter(struct trace_subsystem_dir *dir,
 int apply_event_filter(struct trace_event_file *file, char *filter_string)
 {
        struct trace_event_call *call = file->event_call;
-       struct event_filter *filter;
+       struct event_filter *filter = NULL;
        int err;
 
        if (!strcmp(strstrip(filter_string), "0")) {

@@ -1818,7 +1814,7 @@ int apply_subsystem_event_filter(struct trace_subsystem_dir *dir,
 {
        struct event_subsystem *system = dir->subsystem;
        struct trace_array *tr = dir->tr;
-       struct event_filter *filter;
+       struct event_filter *filter = NULL;
        int err = 0;
 
        mutex_lock(&event_mutex);

@@ -2025,7 +2021,7 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
                              char *filter_str)
 {
        int err;
-       struct event_filter *filter;
+       struct event_filter *filter = NULL;
        struct trace_event_call *call;
 
        mutex_lock(&event_mutex);
 
--

You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20180411104702.7f24401f%40gandalf.local.home.
For more options, visit https://groups.google.com/d/optout.

Steven Rostedt

maintainer

2018-04-11 14:58 UTC #3 lore raw

Quoted 5 lines · On Wed, 11 Apr 2018 16:51:02 +0200 Dmitry Vyukov <[email protected]> wrote:

Hi Steve,
Instructions for asking syzbot to test a patch are here:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communication-with-syzbot

I'll just add reported-by and add the patch. It does fix a bug, regardless. I have other things I need to work on to spend any more time on this one.

-- Steve

Dmitry Vyukov

2018-04-11 15:06 UTC #4 lore raw

Quoted 5 lines · Steven Rostedt

Quoted 2 lines · On Wed, 11 Apr 2018 16:51:02 +0200 Dmitry Vyukov <[email protected]> wrote:
Hi Steve,

Quoted 7 lines

Quoted 3 lines
Instructions for asking syzbot to test a patch are here:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communication-with-syzbot
I'll just add reported-by and add the patch. It does fix a bug, regardless. I have other things I need to work on to spend any more time on this one.

This will work too.

Thanks for the quick fix!