Re: KASAN: vmalloc-out-of-bounds Read in bpf_trace_run7
Yonghong Song <[email protected]>
| Newsgroups | org.kernel.vger.xdp-newbies,org.kernel.vger.bpf,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
I can reproduce the issue with C reproducer. This is an old known issue though and the failure is due to memory allocation failure in tracepoint_probe_unregister(). [ 40.807849][ T8287] Call Trace: [ 40.808201][ T8287] dump_stack+0x77/0x97 [ 40.808695][ T8287] should_fail.cold.6+0x32/0x4c [ 40.809238][ T8287] should_failslab+0x5/0x10 [ 40.809709][ T8287] slab_pre_alloc_hook.constprop.97+0xa0/0xd0 [ 40.810365][ T8287] ? tracepoint_probe_unregister+0xc7/0x2b0 [ 40.810998][ T8287] __kmalloc+0x64/0x210 [ 40.811442][ T8287] ? trace_raw_output_percpu_destroy_chunk+0x40/0x40 [ 40.812158][ T8287] tracepoint_probe_unregister+0xc7/0x2b0 [ 40.812766][ T8287] bpf_raw_tp_link_release+0x11/0x20 [ 40.813328][ T8287] bpf_link_free+0x20/0x40 [ 40.813802][ T8287] bpf_link_release+0xc/0x10 [ 40.814242][ T8287] __fput+0xa1/0x250 [ 40.814606][ T8287] task_work_run+0x68/0xb0 [ 40.815030][ T8287] exit_to_user_mode_prepare+0x22c/0x250 Steven Rostedt has the following pending patch https://lore.kernel.org/bpf/[email protected]/ trying to solve this exact problem. On 1/20/21 11:14 PM, syzbot wrote: > syzbot has bisected this issue to: > > commit 8b401f9ed2441ad9e219953927a842d24ed051fc > Author: Yonghong Song <[email protected]> > Date: Thu May 23 21:47:45 2019 +0000 > > bpf: implement bpf_send_signal() helper > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=123408e7500000 > start commit: 7d68e382 bpf: Permit size-0 datasec > git tree: bpf-next > final oops: https://syzkaller.appspot.com/x/report.txt?x=113408e7500000 > console output: https://syzkaller.appspot.com/x/log.txt?x=163408e7500000 > kernel config: https://syzkaller.appspot.com/x/.config?x=e0c7843b8af99dff > dashboard link: https://syzkaller.appspot.com/bug?extid=fad5d91c7158ce568634 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1224daa4d00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13dfabd0d00000 > > Reported-by: [email protected] > Fixes: 8b401f9ed244 ("bpf: implement bpf_send_signal() helper") > > For information about bisection process see: https://goo.gl/tpsmEJ#bisection >