From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9787BCEF148 for ; Tue, 8 Oct 2024 09:41:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 267F36B0083; Tue, 8 Oct 2024 05:41:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2196F6B0085; Tue, 8 Oct 2024 05:41:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0E0226B0088; Tue, 8 Oct 2024 05:41:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id E1AC96B0083 for ; Tue, 8 Oct 2024 05:41:10 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 2CDB7ABCB7 for ; Tue, 8 Oct 2024 09:41:08 +0000 (UTC) X-FDA: 82649941500.17.B51BA4B Received: from mail-oi1-f178.google.com (mail-oi1-f178.google.com [209.85.167.178]) by imf19.hostedemail.com (Postfix) with ESMTP id 8A16D1A0009 for ; Tue, 8 Oct 2024 09:41:08 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=gYv8ibY1; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf19.hostedemail.com: domain of eddyz87@gmail.com designates 209.85.167.178 as permitted sender) smtp.mailfrom=eddyz87@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1728380425; a=rsa-sha256; cv=none; b=0w0qCcZY8G9Fe4mej6zdwS34Iu2tEOdgJpCHjRqaaZnP0yRn5hbO3Etzn2lQ4rMPPTlADC gbdidYDv19aJ2YAox5LCFYJrFbRw8AtQQMQCLt+9htkFvLLNpy6I8ERwRZmAysSJqSRoi6 1gru5K5sjAvHZ74DoT1OQNOD+66WjcU= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=gYv8ibY1; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf19.hostedemail.com: domain of eddyz87@gmail.com designates 209.85.167.178 as permitted sender) smtp.mailfrom=eddyz87@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1728380425; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=VW7gPsy5GJq+TdNNh91j+Je70iU1cq1LYg9nRtBLrq8=; b=UO0f/YyVWC/0cF6ih5YN0iVlaLbshabmjVql87dYxaIKIGAHoj+a/bgPfKcYCZDDU/0ikO WH+06Cu9G9BTKU0SxzaugouWp9CNo9p90fOaDg/EcwFPddL4fYFD0QJyYinpOQoae/aTFz NiP4pImzPiFxMji0bmZXc2suCF8eLBc= Received: by mail-oi1-f178.google.com with SMTP id 5614622812f47-3e04801bb65so2902749b6e.0 for ; Tue, 08 Oct 2024 02:41:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1728380467; x=1728985267; darn=kvack.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=VW7gPsy5GJq+TdNNh91j+Je70iU1cq1LYg9nRtBLrq8=; b=gYv8ibY1D45NH8ZvvU5hXQrUaiAwfsnjlHKmEflDb0tojwm06ZqCRMxYsGT7RJHygy XzSmEyYE5n+9UKH4SN8H1plh1wAO1Z4OK5eeHIBkPpHSg/XWZbpWqc//a4aVf411TzhZ vFgJbAPVV2cLzcOmEWJwOtuigJz5LvPClWLny/L98/iYF1We2bnzr9pwgV34RzqL7aPQ qMsynJfdswJyYXxMDqG9QlxqdDsK1DWBH/TKB00u3QAJMyrOzJaSd0yffr2lWUsymMQT m2CZpd68IqhDeo4v4TehoELQViOBMvMUOInIEFL0PI2zUD2SWZoBeMcX6swSOtU0xcyF L/dg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728380467; x=1728985267; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=VW7gPsy5GJq+TdNNh91j+Je70iU1cq1LYg9nRtBLrq8=; b=fRGZMHfAZ7THL0GHbn5DWi98YhkCdkl1rPMOFfhaLE/3kgbVwka2vdR8UizslfbHNe 0uOUkH8XZ9I8hZT//v203LpYAmsFw09Bc48FfhtYHZSEWCSMfhFaDPSCoyQDQu2BSixa /YOdJ5ATuG1vrfddPkHKGBdPUemweY8yAnsMl30jCFEti6THJ5kDHXGNTjAKyaSAqOBm 9AOViFMOYJeBfJcHbGuZR/Ei+NZ/VHiFFvWdkflNQf1nBYpsy+2FxEO6BWdHQkuphdO+ eGxfLog3Vs9c/HVlzawSWgSokAIluFF3ecKlpErdBN/rwFw+EjgHHRsduWg3fNXczi1u BAzA== X-Forwarded-Encrypted: i=1; AJvYcCWViQZfk9xnMNWxDpgfO+tlABMZdSoudu5ZO1cyJsZKw5gaoeuiTeOCcoU57060Jnav1lNtJFMVrQ==@kvack.org X-Gm-Message-State: AOJu0YxI2PSzbiOyUhfmyAfpNdNR/0nd3+LN5q0qUUKVlY3+Ti8ZAt2l +80696G1Vcf16MswNOADc0be7GdMCnLKOqilsLwnrorFk1Dz+Qzg X-Google-Smtp-Source: AGHT+IGRD34Fd2Kt5MneL8c0v4zBGHlcjhlyHUFV2bk6tQLS9wshySuY5APs4ZCTxmZIXpBCsLbzqg== X-Received: by 2002:a05:6808:1a14:b0:3e3:98fd:dc42 with SMTP id 5614622812f47-3e3c131ebc9mr9249734b6e.7.1728380467352; Tue, 08 Oct 2024 02:41:07 -0700 (PDT) Received: from [192.168.0.235] ([38.34.87.7]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-7e9f6833cdcsm6435057a12.49.2024.10.08.02.41.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Oct 2024 02:41:06 -0700 (PDT) Message-ID: Subject: Re: [syzbot] [bpf?] WARNING in push_jmp_history From: Eduard Zingerman To: feng.tang@intel.com Cc: syzbot , 42.hyeyoo@gmail.com, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, cl@linux.com, daniel@iogearbox.net, haoluo@google.com, iamjoonsoo.kim@lge.com, john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, martin.lau@linux.dev, penberg@kernel.org, rientjes@google.com, roman.gushchin@linux.dev, sdf@fomichev.me, song@kernel.org, syzkaller-bugs@googlegroups.com, vbabka@suse.cz, yonghong.song@linux.dev Date: Tue, 08 Oct 2024 02:41:01 -0700 In-Reply-To: <6704f097.050a0220.1e4d62.0087.GAE@google.com> References: <6704f097.050a0220.1e4d62.0087.GAE@google.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.52.4 (3.52.4-1.fc40) MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Queue-Id: 8A16D1A0009 X-Rspamd-Server: rspam01 X-Stat-Signature: niaqjujt578be1zm8zxaqhe5cu6wnzyi X-HE-Tag: 1728380468-401427 X-HE-Meta: U2FsdGVkX19Jj9zGFtC+GM3PkZqlE5AJ0ZfwegOj6dRZluxuvVh+B7R3HHykB1DXZsCPnnIu+2cwA9+ReGX156QEGT45hcufMPm96oucvrBjDeVENPncdY9OacOAB+kNzfjjwb84RZc4FO7zKT071rJgo1mEyx3cE5QBbYPOZ4QFXDgfrmm3YruY2knompPa7Ns+TWJpLZn/TixtlQ5nxzsZ3cn0yO+sHabk3nR3Re+hkNnYEcG1fNZ23bOIVW9XnZqFsAB5GS6WDhrlkOvbNVTiHOibV489dRVTpo86QUseFXbtK+qdic88DuMcK6pCrk7pSFHkkSIcvlg8pUljvN4T5BNuA9k1narE9arxTuac7aG71JBpFx8uiYHyUfmOVOsDwygQO4EPuX78gYJamqUqJ6tltKXUq+88758VClpv3T+KYn0PscvBTgs2Ivy7O4xMZErbmhdJrYf6InHskwD0LAMJ9N0Iy2uNKMW4t1bmDUf+8q02u7421hkd/Q4MW9s0h0m8TAQmJwVhR7Zshly6TURkzFmL4XOg6wLk2WgeuVBQfCDPW+mBswDIyOV+MwsHfL5PhHK1BY1cR7xkRmqEeBMerECAJ70QiNI/uomlDZjyKfpTTdHcfu/Wxtd1AUk3qNUykuMIg+geuToKeAgfO0He0Yze2iswM6NSuFeRnUz+WDYjFrP8ITfd9rxrX2pK3DwKB7ObkQY4xLxT23YlX4QRtGvsKZbBcZUl5as9BRHhlMTeRN5lBgoRyAyfrpPorT8DCbb8wZKjdF9Itjk0dhCKA/TmZ+dtObbaBcMwxs2rP+aGvs5mJNqLjsxKNqPlsPg3E54vFzRIrdAhjFCsN7veylYptuytVNyacN8GdZqwd13/fyyBfTymEAIj/slMA1tWxmMQZYqLukGzNNvf5++8OC32KxkM8xRXRSsRxxlHHO7aOfxUwrJY7O6XH8zyegq0gwQBd2LgR8s gpeE6DfF jjEshenCAMZ8R/BIesMALdtez7f5WJ9Sb+lk4l50bRyyLVK0auEUNCAGtGmoKUwMtjarVTxEfd1QUGRMk/VcfQPY+Wd2LCxDG1qAfOnEuf5FMhTZ9Lu52K2nGYZE6Pyixp4CmG4+VOlvtUbFEXKoK2pGJ4zUaca+fU42nPpFEGzGfsBLpps2xhlu+oywt2nTTpWFT2UoMBfauFfpEXLOT+BtBOE5RLr8Va1KIAYQjVubkfywq4frAHJxtLM2Yxg0f42aWWdXaX1eESlK+NHEraN1LfMFbYHCJPsf1RCoPMOd+BELxL+Wii74alMHkout1dd4w5NJ1OWumaKmLdBjJcdVfIfORZkdOMppQCAHNvaeKF2lbiJElD+lMc96avR6rmt4oWUU+Si5DNC/LNx40YWjj1lpFh1WCc2ZXVBQx24TIPGdPUsRcW5DBMr+irqS5tR2tSlT9x8GESBkRm0ZA7R270NYRRDPQFXUovWY84xVq2D1W9K8AINZYvOGqCOTtRdRg95ZEdz6ICW9PICRwhD/bE5uKNxvr3SqJp7NKPYIK00iJpchtgU2/gRK2VCtXG1nyMTLLgF3iW1vNyUYRzGB2eZx8e7J1BzWV6By907qONPO7m1+2qlsSwoNjUNg1e5rjuox99uMCOT9cVF6Ela+bt7ilHVneMuJoh0mQI6pOPEBU4nF9MP+bfkVQQCmZVNZ0EGVwrE1fashQ9ZdsLobBVymrOVQFlEbNt0XmTMNT/g0r+RaEg67GdZ9/0ym/DTO20KuLlukCJ7rWhR03GYtlmzxLsGh1Q9pPQirTJNfZW5iDR8y4/KWtUXePuMG5nE1h1HTtC6D9TE36GVxoNzyMQl8pVacnx37sGDPLyBOzw4Uo0mebdCM84Jv7xroRSDIW8AY9E020UI5jbUvSRlsO3mqv1J2InYCOfV3SlHArFuUZ5KlaYiAwQw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, 2024-10-08 at 01:43 -0700, syzbot wrote: > syzbot has bisected this issue to: >=20 > commit d0a38fad51cc70ab3dd3c59b54d8079ac19220b9 > Author: Feng Tang > Date: Wed Sep 11 06:45:34 2024 +0000 >=20 > mm/slub: Improve redzone check and zeroing for krealloc() >=20 > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=3D11ddbb8058= 0000 > start commit: c02d24a5af66 Add linux-next specific files for 20241003 > git tree: linux-next > final oops: https://syzkaller.appspot.com/x/report.txt?x=3D13ddbb8058= 0000 > console output: https://syzkaller.appspot.com/x/log.txt?x=3D15ddbb8058000= 0 > kernel config: https://syzkaller.appspot.com/x/.config?x=3D94f9caf16c0af= 42d > dashboard link: https://syzkaller.appspot.com/bug?extid=3D7e46cdef14bf496= a3ab4 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D10b82707980= 000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D16f4c32798000= 0 >=20 > Reported-by: syzbot+7e46cdef14bf496a3ab4@syzkaller.appspotmail.com > Fixes: d0a38fad51cc ("mm/slub: Improve redzone check and zeroing for krea= lloc()") >=20 > For information about bisection process see: https://goo.gl/tpsmEJ#bisect= ion There are two issues demonstrated by this repro: - one is mm/slub related; - another one is verification taking forever. About the mm/slub related. Applying the following patch with additional logging on top of commit d0a38fad51cc identified by syzbot: ------- 8< ------------------------------------------------------------ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9a7ed527e47e..c1582a6d1d33 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3494,7 +3494,9 @@ static int push_jmp_history(struct bpf_verifier_env *= env, struct bpf_verifier_st =20 cnt++; alloc_size =3D kmalloc_size_roundup(size_mul(cnt, sizeof(*p))); + printk("push_jmp_history: #1 cur->jmp_history=3D%p\n", cur->jmp_his= tory); p =3D krealloc(cur->jmp_history, alloc_size, GFP_USER); + printk("push_jmp_history: #2 cur->jmp_history=3D%p\n", p); if (!p) return -ENOMEM; cur->jmp_history =3D p; diff --git a/mm/slub.c b/mm/slub.c index e0fb0a26c796..3f5b080ac1f5 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4627,7 +4627,7 @@ static inline struct kmem_cache *virt_to_cache(const = void *obj) struct slab *slab; =20 slab =3D virt_to_slab(obj); - if (WARN_ONCE(!slab, "%s: Object is not a Slab page!\n", __func__)) + if (WARN_ONCE(!slab, "%s: Object %p is not a Slab page!\n", __func_= _, obj)) return NULL; return slab->slab_cache; } ------------------------------------------------------------ >8 ------- Produces the following log: l1: [ 2.942120] push_jmp_history: #2 cur->jmp_history=3D00000000a0f6f50= 3 l2: [ 2.944445] push_jmp_history: #1 cur->jmp_history=3D00000000a0f6f50= 3 l3: [ 2.944560] ------------[ cut here ]------------ l4: [ 2.944647] virt_to_cache: Object 00000000a0f6f503 is not a Slab pa= ge! l5: [ 2.944765] WARNING: CPU: 0 PID: 145 at mm/slub.c:4630 krealloc_nop= rof (mm/slub.c:4630 mm/slub.c:4728 mm/slub.c:4813)=20 l6: [ 2.944906] Modules linked in: l7: [ 2.945134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIO= S 1.16.3-2.fc40 04/01/2014 l8: [ 2.945285] RIP: 0010:krealloc_noprof (mm/slub.c:4630 mm/slub.c:472= 8 mm/slub.c:4813)=20 ... l9: [ 2.952088] BUG: kernel NULL pointer dereference, address: 00000000= 0000001c l10: [ 2.952171] #PF: supervisor read access in kernel mode l11: [ 2.952240] #PF: error_code(0x0000) - not-present page l12: [ 2.952309] PGD 105d51067 P4D 105d51067 PUD 1013d0067 PMD 0=20 l13: [ 2.952402] Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI l14: [ 2.952611] Tainted: [W]=3DWARN l15: [ 2.952664] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIO= S 1.16.3-2.fc40 04/01/2014 l16: [ 2.952794] RIP: 0010:krealloc_noprof (mm/slub.c:0 mm/slub.c:4729 m= m/slub.c:4813)=20 Lines l{1,2,4} show that address 0xa0f6f503 was first allocated by krealloc and then krealloc failed to recognize it as such. The warning at l3 is reported by virt_to_cache() called from __do_krealloc(): 4715 static __always_inline __realloc_size(2) void * 4716 __do_krealloc(const void *p, size_t new_size, gfp_t flags) 4717 { 4718 void *ret; 4719 size_t ks; 4720 int orig_size =3D 0; 4721 struct kmem_cache *s; 4722=20 4723 /* Check for double-free. */ 4724 if (likely(!ZERO_OR_NULL_PTR(p))) { 4725 if (!kasan_check_byte(p)) 4726 return NULL; 4727=20 4728 s =3D virt_to_cache(p); 4729 orig_size =3D get_orig_size(s, (void *)p); 4730 ks =3D s->object_size; When virt_to_cache() reports the warning it returns NULL. Hence variable 's' at line 4728 is NULL and this causes null pointer dereference at line 4730, reported at l9. Lines 4725-4730 were changed by commit d0a38fad51cc identified by syzbot, previously 'ks' was identified using other means. Feng, this issue seem unrelated to BPF verifier, could you please take a lo= ok? Best regards, Eduard