* Re: [syzbot] [bpf?] WARNING in push_jmp_history
[not found] <670429f6.050a0220.49194.0517.GAE@google.com>
@ 2024-10-08 8:43 ` syzbot
2024-10-08 9:41 ` Eduard Zingerman
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2024-10-08 8:43 UTC (permalink / raw)
To: 42.hyeyoo, akpm, andrii, ast, bpf, cl, daniel, eddyz87,
feng.tang, haoluo, iamjoonsoo.kim, john.fastabend, jolsa,
kpsingh, linux-kernel, linux-mm, martin.lau, penberg, rientjes,
roman.gushchin, sdf, song, syzkaller-bugs, vbabka, yonghong.song
syzbot has bisected this issue to:
commit d0a38fad51cc70ab3dd3c59b54d8079ac19220b9
Author: Feng Tang <feng.tang@intel.com>
Date: Wed Sep 11 06:45:34 2024 +0000
mm/slub: Improve redzone check and zeroing for krealloc()
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11ddbb80580000
start commit: c02d24a5af66 Add linux-next specific files for 20241003
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=13ddbb80580000
console output: https://syzkaller.appspot.com/x/log.txt?x=15ddbb80580000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
dashboard link: https://syzkaller.appspot.com/bug?extid=7e46cdef14bf496a3ab4
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b82707980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f4c327980000
Reported-by: syzbot+7e46cdef14bf496a3ab4@syzkaller.appspotmail.com
Fixes: d0a38fad51cc ("mm/slub: Improve redzone check and zeroing for krealloc()")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [bpf?] WARNING in push_jmp_history
2024-10-08 8:43 ` [syzbot] [bpf?] WARNING in push_jmp_history syzbot
@ 2024-10-08 9:41 ` Eduard Zingerman
2024-10-08 10:01 ` Vlastimil Babka
0 siblings, 1 reply; 3+ messages in thread
From: Eduard Zingerman @ 2024-10-08 9:41 UTC (permalink / raw)
To: feng.tang
Cc: syzbot, 42.hyeyoo, akpm, andrii, ast, bpf, cl, daniel, haoluo,
iamjoonsoo.kim, john.fastabend, jolsa, kpsingh, linux-kernel,
linux-mm, martin.lau, penberg, rientjes, roman.gushchin, sdf,
song, syzkaller-bugs, vbabka, yonghong.song
On Tue, 2024-10-08 at 01:43 -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit d0a38fad51cc70ab3dd3c59b54d8079ac19220b9
> Author: Feng Tang <feng.tang@intel.com>
> Date: Wed Sep 11 06:45:34 2024 +0000
>
> mm/slub: Improve redzone check and zeroing for krealloc()
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11ddbb80580000
> start commit: c02d24a5af66 Add linux-next specific files for 20241003
> git tree: linux-next
> final oops: https://syzkaller.appspot.com/x/report.txt?x=13ddbb80580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=15ddbb80580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
> dashboard link: https://syzkaller.appspot.com/bug?extid=7e46cdef14bf496a3ab4
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b82707980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f4c327980000
>
> Reported-by: syzbot+7e46cdef14bf496a3ab4@syzkaller.appspotmail.com
> Fixes: d0a38fad51cc ("mm/slub: Improve redzone check and zeroing for krealloc()")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
There are two issues demonstrated by this repro:
- one is mm/slub related;
- another one is verification taking forever.
About the mm/slub related. Applying the following patch with
additional logging on top of commit d0a38fad51cc identified by syzbot:
------- 8< ------------------------------------------------------------
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9a7ed527e47e..c1582a6d1d33 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3494,7 +3494,9 @@ static int push_jmp_history(struct bpf_verifier_env *env, struct bpf_verifier_st
cnt++;
alloc_size = kmalloc_size_roundup(size_mul(cnt, sizeof(*p)));
+ printk("push_jmp_history: #1 cur->jmp_history=%p\n", cur->jmp_history);
p = krealloc(cur->jmp_history, alloc_size, GFP_USER);
+ printk("push_jmp_history: #2 cur->jmp_history=%p\n", p);
if (!p)
return -ENOMEM;
cur->jmp_history = p;
diff --git a/mm/slub.c b/mm/slub.c
index e0fb0a26c796..3f5b080ac1f5 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4627,7 +4627,7 @@ static inline struct kmem_cache *virt_to_cache(const void *obj)
struct slab *slab;
slab = virt_to_slab(obj);
- if (WARN_ONCE(!slab, "%s: Object is not a Slab page!\n", __func__))
+ if (WARN_ONCE(!slab, "%s: Object %p is not a Slab page!\n", __func__, obj))
return NULL;
return slab->slab_cache;
}
------------------------------------------------------------ >8 -------
Produces the following log:
l1: [ 2.942120] push_jmp_history: #2 cur->jmp_history=00000000a0f6f503
l2: [ 2.944445] push_jmp_history: #1 cur->jmp_history=00000000a0f6f503
l3: [ 2.944560] ------------[ cut here ]------------
l4: [ 2.944647] virt_to_cache: Object 00000000a0f6f503 is not a Slab page!
l5: [ 2.944765] WARNING: CPU: 0 PID: 145 at mm/slub.c:4630 krealloc_noprof (mm/slub.c:4630 mm/slub.c:4728 mm/slub.c:4813)
l6: [ 2.944906] Modules linked in:
l7: [ 2.945134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
l8: [ 2.945285] RIP: 0010:krealloc_noprof (mm/slub.c:4630 mm/slub.c:4728 mm/slub.c:4813)
...
l9: [ 2.952088] BUG: kernel NULL pointer dereference, address: 000000000000001c
l10: [ 2.952171] #PF: supervisor read access in kernel mode
l11: [ 2.952240] #PF: error_code(0x0000) - not-present page
l12: [ 2.952309] PGD 105d51067 P4D 105d51067 PUD 1013d0067 PMD 0
l13: [ 2.952402] Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
l14: [ 2.952611] Tainted: [W]=WARN
l15: [ 2.952664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
l16: [ 2.952794] RIP: 0010:krealloc_noprof (mm/slub.c:0 mm/slub.c:4729 mm/slub.c:4813)
Lines l{1,2,4} show that address 0xa0f6f503 was first allocated by
krealloc and then krealloc failed to recognize it as such.
The warning at l3 is reported by virt_to_cache() called from
__do_krealloc():
4715 static __always_inline __realloc_size(2) void *
4716 __do_krealloc(const void *p, size_t new_size, gfp_t flags)
4717 {
4718 void *ret;
4719 size_t ks;
4720 int orig_size = 0;
4721 struct kmem_cache *s;
4722
4723 /* Check for double-free. */
4724 if (likely(!ZERO_OR_NULL_PTR(p))) {
4725 if (!kasan_check_byte(p))
4726 return NULL;
4727
4728 s = virt_to_cache(p);
4729 orig_size = get_orig_size(s, (void *)p);
4730 ks = s->object_size;
When virt_to_cache() reports the warning it returns NULL.
Hence variable 's' at line 4728 is NULL and this causes null pointer
dereference at line 4730, reported at l9.
Lines 4725-4730 were changed by commit d0a38fad51cc identified by syzbot,
previously 'ks' was identified using other means.
Feng, this issue seem unrelated to BPF verifier, could you please take a look?
Best regards,
Eduard
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [bpf?] WARNING in push_jmp_history
2024-10-08 9:41 ` Eduard Zingerman
@ 2024-10-08 10:01 ` Vlastimil Babka
0 siblings, 0 replies; 3+ messages in thread
From: Vlastimil Babka @ 2024-10-08 10:01 UTC (permalink / raw)
To: Eduard Zingerman, feng.tang
Cc: syzbot, 42.hyeyoo, akpm, andrii, ast, bpf, cl, daniel, haoluo,
iamjoonsoo.kim, john.fastabend, jolsa, kpsingh, linux-kernel,
linux-mm, martin.lau, penberg, rientjes, roman.gushchin, sdf,
song, syzkaller-bugs, yonghong.song
On 10/8/24 11:41, Eduard Zingerman wrote:
> On Tue, 2024-10-08 at 01:43 -0700, syzbot wrote:
>> syzbot has bisected this issue to:
>>
>> commit d0a38fad51cc70ab3dd3c59b54d8079ac19220b9
>> Author: Feng Tang <feng.tang@intel.com>
>> Date: Wed Sep 11 06:45:34 2024 +0000
>>
>> mm/slub: Improve redzone check and zeroing for krealloc()
>>
>> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11ddbb80580000
>> start commit: c02d24a5af66 Add linux-next specific files for 20241003
>> git tree: linux-next
>> final oops: https://syzkaller.appspot.com/x/report.txt?x=13ddbb80580000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=15ddbb80580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
>> dashboard link: https://syzkaller.appspot.com/bug?extid=7e46cdef14bf496a3ab4
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b82707980000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f4c327980000
>>
>> Reported-by: syzbot+7e46cdef14bf496a3ab4@syzkaller.appspotmail.com
>> Fixes: d0a38fad51cc ("mm/slub: Improve redzone check and zeroing for krealloc()")
>>
>> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> There are two issues demonstrated by this repro:
> - one is mm/slub related;
> - another one is verification taking forever.
>
> About the mm/slub related. Applying the following patch with
> additional logging on top of commit d0a38fad51cc identified by syzbot:
The slab one is known from other reports and the problematic commit was
removed from -next since then.
>
> ------- 8< ------------------------------------------------------------
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9a7ed527e47e..c1582a6d1d33 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -3494,7 +3494,9 @@ static int push_jmp_history(struct bpf_verifier_env *env, struct bpf_verifier_st
>
> cnt++;
> alloc_size = kmalloc_size_roundup(size_mul(cnt, sizeof(*p)));
> + printk("push_jmp_history: #1 cur->jmp_history=%p\n", cur->jmp_history);
> p = krealloc(cur->jmp_history, alloc_size, GFP_USER);
> + printk("push_jmp_history: #2 cur->jmp_history=%p\n", p);
> if (!p)
> return -ENOMEM;
> cur->jmp_history = p;
> diff --git a/mm/slub.c b/mm/slub.c
> index e0fb0a26c796..3f5b080ac1f5 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -4627,7 +4627,7 @@ static inline struct kmem_cache *virt_to_cache(const void *obj)
> struct slab *slab;
>
> slab = virt_to_slab(obj);
> - if (WARN_ONCE(!slab, "%s: Object is not a Slab page!\n", __func__))
> + if (WARN_ONCE(!slab, "%s: Object %p is not a Slab page!\n", __func__, obj))
> return NULL;
> return slab->slab_cache;
> }
> ------------------------------------------------------------ >8 -------
>
> Produces the following log:
>
> l1: [ 2.942120] push_jmp_history: #2 cur->jmp_history=00000000a0f6f503
> l2: [ 2.944445] push_jmp_history: #1 cur->jmp_history=00000000a0f6f503
> l3: [ 2.944560] ------------[ cut here ]------------
> l4: [ 2.944647] virt_to_cache: Object 00000000a0f6f503 is not a Slab page!
> l5: [ 2.944765] WARNING: CPU: 0 PID: 145 at mm/slub.c:4630 krealloc_noprof (mm/slub.c:4630 mm/slub.c:4728 mm/slub.c:4813)
> l6: [ 2.944906] Modules linked in:
> l7: [ 2.945134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
> l8: [ 2.945285] RIP: 0010:krealloc_noprof (mm/slub.c:4630 mm/slub.c:4728 mm/slub.c:4813)
> ...
> l9: [ 2.952088] BUG: kernel NULL pointer dereference, address: 000000000000001c
> l10: [ 2.952171] #PF: supervisor read access in kernel mode
> l11: [ 2.952240] #PF: error_code(0x0000) - not-present page
> l12: [ 2.952309] PGD 105d51067 P4D 105d51067 PUD 1013d0067 PMD 0
> l13: [ 2.952402] Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
> l14: [ 2.952611] Tainted: [W]=WARN
> l15: [ 2.952664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
> l16: [ 2.952794] RIP: 0010:krealloc_noprof (mm/slub.c:0 mm/slub.c:4729 mm/slub.c:4813)
>
> Lines l{1,2,4} show that address 0xa0f6f503 was first allocated by
> krealloc and then krealloc failed to recognize it as such.
>
> The warning at l3 is reported by virt_to_cache() called from
> __do_krealloc():
>
>
> 4715 static __always_inline __realloc_size(2) void *
> 4716 __do_krealloc(const void *p, size_t new_size, gfp_t flags)
> 4717 {
> 4718 void *ret;
> 4719 size_t ks;
> 4720 int orig_size = 0;
> 4721 struct kmem_cache *s;
> 4722
> 4723 /* Check for double-free. */
> 4724 if (likely(!ZERO_OR_NULL_PTR(p))) {
> 4725 if (!kasan_check_byte(p))
> 4726 return NULL;
> 4727
> 4728 s = virt_to_cache(p);
> 4729 orig_size = get_orig_size(s, (void *)p);
> 4730 ks = s->object_size;
>
> When virt_to_cache() reports the warning it returns NULL.
> Hence variable 's' at line 4728 is NULL and this causes null pointer
> dereference at line 4730, reported at l9.
>
> Lines 4725-4730 were changed by commit d0a38fad51cc identified by syzbot,
> previously 'ks' was identified using other means.
>
> Feng, this issue seem unrelated to BPF verifier, could you please take a look?
>
> Best regards,
> Eduard
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-10-08 10:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <670429f6.050a0220.49194.0517.GAE@google.com>
2024-10-08 8:43 ` [syzbot] [bpf?] WARNING in push_jmp_history syzbot
2024-10-08 9:41 ` Eduard Zingerman
2024-10-08 10:01 ` Vlastimil Babka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox