From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6F30C30653 for ; Sun, 7 Jul 2024 10:32:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CE0696B007B; Sun, 7 Jul 2024 06:32:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C8F8B6B0082; Sun, 7 Jul 2024 06:32:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B56B66B0083; Sun, 7 Jul 2024 06:32:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 9779E6B007B for ; Sun, 7 Jul 2024 06:32:40 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 3959340CB2 for ; Sun, 7 Jul 2024 10:32:40 +0000 (UTC) X-FDA: 82312592880.22.3243575 Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) by imf19.hostedemail.com (Postfix) with ESMTP id 588471A0004 for ; Sun, 7 Jul 2024 10:32:37 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of penguin-kernel@I-love.SAKURA.ne.jp designates 202.181.97.72 as permitted sender) smtp.mailfrom=penguin-kernel@I-love.SAKURA.ne.jp ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1720348337; a=rsa-sha256; cv=none; b=JfUZVLcPfwq/FwiwlJg/CreN7+yjiM61/dk9Yf4+WZH2Qs+TfDnzH6Hnr9MABjBCE3xtrZ QNauvzIZtBOjsoK/YQSEfRducALXJsX+Z1RaLrLqub2RU9y58CZjlbZRyGagvYab4yiVcG jDnvjyM3m+wO/vGrhMEGDgeLbrRfCX4= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of penguin-kernel@I-love.SAKURA.ne.jp designates 202.181.97.72 as permitted sender) smtp.mailfrom=penguin-kernel@I-love.SAKURA.ne.jp ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1720348337; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Rh8OjDVSEtxqcOK+7T+/rsIZv+IyqePzR/tqvDLyv5Y=; b=ZtmJM8YUQ515kg74TO4udZAyT4Je17QAm9bk8KNhjMNcvpYbnn0i9FZiKEubB0fyidCqiy 4VENDy9E9J9JSh0eOoqv7Hhf7sF03WWxP1TpYfiAi/cTpEO1EiCp5t/06Nw5eruNv6heyQ 5EhAbgNVBZgZ/VawDnxWhMHshNt3RUc= Received: from fsav413.sakura.ne.jp (fsav413.sakura.ne.jp [133.242.250.112]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 467AW6WL050735; Sun, 7 Jul 2024 19:32:06 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav413.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp); Sun, 07 Jul 2024 19:32:06 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 467AW5mV050731 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Sun, 7 Jul 2024 19:32:05 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <5136bcc7-3db7-4fc2-abde-a3aceeaf17c2@I-love.SAKURA.ne.jp> Date: Sun, 7 Jul 2024 19:32:05 +0900 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [syzbot] [kernel?] KASAN: stack-out-of-bounds Read in __show_regs (2) From: Tetsuo Handa To: Alexander Potapenko , Marco Elver , Dmitry Vyukov Cc: syzbot , linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, kasan-dev , linux-mm , bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, mingo@redhat.com, tglx@linutronix.de, x86@kernel.org, Andrey Konovalov References: <000000000000a8c856061ae85e20@google.com> <82cf2f25-fd3b-40a2-8d2b-a6385a585601@I-love.SAKURA.ne.jp> <1df448bd-7e22-408a-807a-4f4a6c679915@I-love.SAKURA.ne.jp> Content-Language: en-US In-Reply-To: <1df448bd-7e22-408a-807a-4f4a6c679915@I-love.SAKURA.ne.jp> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 588471A0004 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: q1ezkp8ndfe94pqcq5gk9xr18xti95cd X-HE-Tag: 1720348357-979291 X-HE-Meta: U2FsdGVkX18AIeVBGk1G3CbJPwzQxaAV2AIOCV5jS3Iok21fd33ZxvRoeh83+JX2RmyQfarnwLZYXOGhRN8TQh0YJPlAVZigy27fO46pPx01DnJsSLPQxBd9PJa6mFITNridMG1kD8RMBOr4dojJ3zzuUheI8c3H2PhuhsG9SI7Vf5SV3PduPgyjtV6JUxpAymzvpqjPZZN5atCsFX2JtJ3OR0dT2X2j07raxculTDIWeHHMiSZ6tjsMej6/CPjG+2RFce9Q+ASZVLG5UiL2LuhSt6oYfi7rrOPeE9spjUT9yg9vjMDLNHyg1SQFQHi29BRsA7nFStE1mEgKnd7atLuQq3rxUWkdGy14oTB9yCWqzQEvltXX1i/0zFoJMjScjkTfpvbp+IxIXLrWok9TFEmv/OVC/xsaOXp/chowAFsj57vf8KOt+Vjpvyabj00QcDrFAKbcsX2diZuXWlXE8g0ytTTUth1+nhQby3xhMB/RoZlStAl06/8K5RQb/l/IxOCeVBwjxjVj/aNQOTqgNMh76V6817/au2NmIvCafRcjv9q1qfGrVm1j/WUXApUT3FtF2avXcmJlh/zpjrgH1GvrNA3OnZgBfPcG0TsV4bXUT1/ouBuFtRxTDlNI9eBLf93Fj+QnO7dFBBA4uMGxUovmhlQehvPTOISqvBxSkrY6WnJr6M3Snj0i+Mg4fX9pTMWiubcMwt6V1WA6kn2q9c3dK9szLAxkSSsqdPxxWZXu7z1uJZh0VSA/Tp1revbm1qa0UERWH4RTXKxC09rugbcGGqYiIosBEqArOx33a6tZpw0nSBHxslecUjp4SUrg1H9hkk8fP4uzf9ZZhma8YzRp0u6ze8Xu6XJYJ+Or/wVGYDB+zngTkw+Ll7ZonMAQiLk/GZ5LWlR8EzD2iM4owJljB3dqkT28iKSpdMrDyaxthu08NOrca/qECSvZLAcGS8d6b3SvxUG+/RvFCCn G78hUnAW UsqE1ztM3yzIXQCVtitRnhx46/dmk4Y7R1LrLJl0yHPiQMfAi4oAN6f6qZ0oTSDDm9XrnXloJbdv/agYl5a0wawjX/dDV1ZWiBoDu1DpSYQyrcax/HI4gOXZhIKkD0zJK7PxEAFE4x0oPzAzlwz9IgRE9mafKgLsCNKNLwm2ASxgkLwg2KbFVitcD4wWexj9FYKCAZHuW/fbgzyJYCJfz2pqXEwoKW8kqxXm+OobjTltnAr0lJ5Vz6mAR3YjKsZ0rki3pFsjagzO0EAd/vrbDKjWDvh2CjqO9vBklaAUkw//JWZwIwGcB6TR/oXM6H/mMmNUI61Kv5ol+8EUCEE/T8CLJQM3vfoAck2A9O6l8BYPSqclzS4nGe733NSad2rjJjgA6ckTsvfp436UzQHK0mUPFmbOidOpolaxKo03uVoxYBnT6AT96HOPNxpvhGCXPYkX2/ivO5TZ/gM1onltAjCpbaUvM/4YaNmGSnOr44CzhrmWDsUWl16oPEQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Guessing from IRQ entry hint, I found commit 37ad4ee83642 ("x86: kmsan: don't instrument stack walking functions") and commit 6cae637fa26d ("entry: kmsan: introduce kmsan_unpoison_entry_regs()"). I guess that we need to disable KASAN for the same reason as well as KMSAN. Alexander, can you write a patch description for below change? diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c index a7d562697e50..01edff4a9d6b 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -192,6 +192,9 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, int graph_idx = 0; bool partial = false; + /* As with KMSAN, disable KASAN for the same reason. */ + kasan_disable_current(); + printk("%sCall Trace:\n", log_lvl); unwind_start(&state, task, regs, stack); @@ -304,6 +307,8 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, if (stack_name) printk("%s \n", log_lvl, stack_name); } + + kasan_enable_current(); } void show_stack(struct task_struct *task, unsigned long *sp, On 2024/07/03 0:21, Tetsuo Handa wrote: > On 2024/07/02 23:29, Andrey Konovalov wrote: >> One other thing that comes to mind with regards to your patch: if the >> task is still executing, the location of things on its stack might >> change due to CONFIG_RANDOMIZE_KSTACK_OFFSET while you're printing the >> task info. However, if the task is sleeping on a lock, this shouldn't >> happen... But maybe a task can wake up during sched_show_task() and >> start handling a new syscall? Just some guesses. > > https://syzkaller.appspot.com/bug?extid=d7491e9e156404745fbb says that > this bug happens without my patch. It seems that this bug happens when > printing registers of a preempted thread. 5.15 kernel does not have > CONFIG_RANDOMIZE_KSTACK_OFFSET config option, but > > __schedule() > preempt_schedule_irq() > irqentry_exit_cond_resched() > irqentry_exit() > > pattern in 5.15 resembles > > __schedule() > preempt_schedule_irq() > irqentry_exit() > > pattern in linux-next. > > [ 1008.224617][T14487] task:syz-executor.1 state:R running task stack:22256 pid:14483 ppid: 434 flags:0x00004000 > [ 1008.224656][T14487] Call Trace: > [ 1008.224661][T14487] > [ 1008.224669][T14487] __schedule+0xcbe/0x1580 > [ 1008.224689][T14487] ? __sched_text_start+0x8/0x8 > [ 1008.224709][T14487] ? ttwu_do_activate+0x15d/0x280 > [ 1008.224732][T14487] ? _raw_spin_unlock_irqrestore+0x5c/0x80 > [ 1008.224758][T14487] preempt_schedule_irq+0xc7/0x140 > [ 1008.224781][T14487] ? __cond_resched+0x20/0x20 > [ 1008.224802][T14487] ? try_invoke_on_locked_down_task+0x2a0/0x2a0 > [ 1008.224829][T14487] irqentry_exit_cond_resched+0x2a/0x30 > [ 1008.224851][T14487] irqentry_exit+0x30/0x40 > [ 1008.224874][T14487] sysvec_apic_timer_interrupt+0x55/0xc0 > [ 1008.224900][T14487] asm_sysvec_apic_timer_interrupt+0x1b/0x20 > [ 1008.224923][T14487] RIP: 0010:preempt_schedule_thunk+0x5/0x18 > [ 1008.224950][T14487] Code: fd 85 db 0f 84 98 00 00 00 44 8d 73 01 44 89 f6 09 de bf ff ff ff ff e8 47 e4 8f fd 41 09 de 0f 88 88 00 00 00 e8 89 e0 8f fd <4c> 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 > [ 1008.224970][T14487] RSP: 0000:0000000000000001 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 > [ 1008.224991][T14487] RAX: ffff88811532d948 RBX: ffffc900072ef560 RCX: ffffc900077e7680 > [ 1008.225009][T14487] RDX: ffffc900072ef5b0 RSI: ffffffff8100817a RDI: dffffc0000000001 > [ 1008.225027][T14487] RBP: 0000000000000001 R08: ffff88811532d948 R09: ffffc900077e7690 > [ 1008.225043][T14487] R10: 1ffff92000efced2 R11: ffffffff84bfe126 R12: ffffc900077e7680 > [ 1008.225062][T14487] ================================================================== > [ 1008.225071][T14487] BUG: KASAN: stack-out-of-bounds in __show_regs+0x252/0x4d0 > [ 1008.225098][T14487] Read of size 8 at addr ffffc900072ef4f8 by task syz-executor.3/14487 > [ 1008.225117][T14487] > [ 1008.225123][T14487] CPU: 0 PID: 14487 Comm: syz-executor.3 Not tainted 5.15.118-syzkaller-01748-g241da2ad5601 #0 >