LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* Re: Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text)
       [not found] <CAD1Xb+-kbRLxe1XNSkhY-VXZWV8fSy-gZeeGhtKH2hO42VJKzA@mail.gmail.com>
@ 2018-05-02 11:18 ` Dmitry Vyukov
  2018-05-07  6:01   ` Dmitry Vyukov
  0 siblings, 1 reply; 2+ messages in thread
From: Dmitry Vyukov @ 2018-05-02 11:18 UTC (permalink / raw)
  To: Dongsong Yu
  Cc: Johannes Weiner, Michal Hocko, Vladimir Davydov, cgroups,
	Linux-MM, LKML, syzkaller

On Wed, May 2, 2018 at 1:11 PM, Dongsong Yu <yudongsong1992@gmail.com> wrote:
> Hi,
> I've got the following bug report while fuzzing linux kenrel (4.16.0) on
> arm64 with syzkaller.
> The kernel config file and poc generated by C reproducer are attached.
>
> Syzkaller hit 'KASAN: use-after-scope Write in mem_cgroup_uncharge' bug.

Hi Dongsong,

If I am looking at the right source:
https://elixir.bootlin.com/linux/v4.16/source/mm/memcontrol.c#L5667
this report does not make sense.
What version of compiler do you use?
Please post disasm of mem_cgroup_uncharge with source/line annotations.

Thanks



> ==================================================================
> BUG: KASAN: use-after-scope in uncharge_gather_clear mm/memcontrol.c:5546
> [inline]
> BUG: KASAN: use-after-scope in mem_cgroup_uncharge+0xcc/0xf0
> mm/memcontrol.c:5667
> Write of size 64 at addr ffff8000738c6cf0 by task syzkaller348646/1477
>
> CPU: 0 PID: 1477 Comm: syzkaller348646 Not tainted 4.16.0 #2
> Hardware name: linux,dummy-virt (DT)
> Call trace:
>   dump_backtrace+0x0/0x350 arch/arm64/kernel/time.c:64
>   show_stack+0x20/0x30 arch/arm64/kernel/traps.c:151
>   __dump_stack lib/dump_stack.c:17 [inline]
>   dump_stack+0x11c/0x198 lib/dump_stack.c:53
>   print_address_description+0x60/0x270 mm/kasan/report.c:256
>   kasan_report_error mm/kasan/report.c:354 [inline]
>   kasan_report+0x248/0x348 mm/kasan/report.c:412
>   check_memory_region_inline mm/kasan/kasan.c:253 [inline]
>   check_memory_region+0x148/0x198 mm/kasan/kasan.c:267
>   memset+0x2c/0x50 mm/kasan/kasan.c:285
>   uncharge_gather_clear mm/memcontrol.c:5546 [inline]
>   mem_cgroup_uncharge+0xcc/0xf0 mm/memcontrol.c:5667
>   __page_cache_release+0x11c/0x640 mm/swap.c:73
>   __put_compound_page+0x30/0x70 mm/swap.c:93
>   release_pages+0x6b4/0x990 mm/swap.c:760
>   free_pages_and_swap_cache+0x1e8/0x250 mm/swap_state.c:322
>   tlb_flush_mmu_free+0x6c/0xb8 mm/memory.c:259
>   tlb_flush_mmu+0x3c/0x48 mm/memory.c:268
>   arch_tlb_finish_mmu+0x70/0xc0 mm/memory.c:283
>   tlb_finish_mmu+0xd0/0x128 mm/memory.c:433
>   unmap_region+0x248/0x2b8 mm/mmap.c:2514
>   do_munmap+0x3b8/0x670 mm/mmap.c:2726
>   mmap_region+0x3b8/0xa78 mm/mmap.c:1646
>   do_mmap+0x448/0x6a0 mm/mmap.c:1483
>   do_mmap_pgoff include/linux/mm.h:2223 [inline]
>   vm_mmap_pgoff+0x17c/0x1b8 mm/util.c:355
>   SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
>   SyS_mmap_pgoff+0x184/0x3e8 mm/mmap.c:1491
>   sys_mmap+0x58/0x80 arch/arm64/kernel/sys.c:37
>   el0_svc_naked+0x30/0x34
>
> The buggy address belongs to the page:
> page:ffff7e0001ce3180 count:0 mapcount:0 mapping:0000000000000000 index:0x0
> flags: 0x4fffc00000000000()
> raw: 4fffc00000000000 0000000000000000 0000000000000000 00000000ffffffff
> raw: 0000000000000000 ffff7e0001ce31a0 0000000000000000 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
>   ffff8000738c6b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   ffff8000738c6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>> ffff8000738c6c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1 f1 f1 f1 f8 f8
>                                                               ^
>   ffff8000738c6d00: f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f8 f8 f8 f8 f8 f8
>   ffff8000738c6d80: f8 f8 f8 f8 f8 f8 00 00 00 00 00 00 00 00 00 00
> ==================================================================
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text)
  2018-05-02 11:18 ` Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) Dmitry Vyukov
@ 2018-05-07  6:01   ` Dmitry Vyukov
  0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Vyukov @ 2018-05-07  6:01 UTC (permalink / raw)
  To: Dongsong Yu
  Cc: Johannes Weiner, Michal Hocko, Vladimir Davydov, cgroups,
	Linux-MM, LKML, syzkaller, Mark Rutland

On Wed, May 2, 2018 at 1:18 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> On Wed, May 2, 2018 at 1:11 PM, Dongsong Yu <yudongsong1992@gmail.com> wrote:
>> Hi,
>> I've got the following bug report while fuzzing linux kenrel (4.16.0) on
>> arm64 with syzkaller.
>> The kernel config file and poc generated by C reproducer are attached.
>>
>> Syzkaller hit 'KASAN: use-after-scope Write in mem_cgroup_uncharge' bug.
>
> Hi Dongsong,
>
> If I am looking at the right source:
> https://elixir.bootlin.com/linux/v4.16/source/mm/memcontrol.c#L5667
> this report does not make sense.
> What version of compiler do you use?
> Please post disasm of mem_cgroup_uncharge with source/line annotations.


I don't see how the bug can happen. Nor I see who stores 0xf8f8f8f8
into KASAN shadow, though I am not very proficient in arm64 asm. I
don't remember any similar false positives on x86.
+Mark, have you seen any KASAN false positives related to
use-after-scope on arm64?



>> ==================================================================
>> BUG: KASAN: use-after-scope in uncharge_gather_clear mm/memcontrol.c:5546
>> [inline]
>> BUG: KASAN: use-after-scope in mem_cgroup_uncharge+0xcc/0xf0
>> mm/memcontrol.c:5667
>> Write of size 64 at addr ffff8000738c6cf0 by task syzkaller348646/1477
>>
>> CPU: 0 PID: 1477 Comm: syzkaller348646 Not tainted 4.16.0 #2
>> Hardware name: linux,dummy-virt (DT)
>> Call trace:
>>   dump_backtrace+0x0/0x350 arch/arm64/kernel/time.c:64
>>   show_stack+0x20/0x30 arch/arm64/kernel/traps.c:151
>>   __dump_stack lib/dump_stack.c:17 [inline]
>>   dump_stack+0x11c/0x198 lib/dump_stack.c:53
>>   print_address_description+0x60/0x270 mm/kasan/report.c:256
>>   kasan_report_error mm/kasan/report.c:354 [inline]
>>   kasan_report+0x248/0x348 mm/kasan/report.c:412
>>   check_memory_region_inline mm/kasan/kasan.c:253 [inline]
>>   check_memory_region+0x148/0x198 mm/kasan/kasan.c:267
>>   memset+0x2c/0x50 mm/kasan/kasan.c:285
>>   uncharge_gather_clear mm/memcontrol.c:5546 [inline]
>>   mem_cgroup_uncharge+0xcc/0xf0 mm/memcontrol.c:5667
>>   __page_cache_release+0x11c/0x640 mm/swap.c:73
>>   __put_compound_page+0x30/0x70 mm/swap.c:93
>>   release_pages+0x6b4/0x990 mm/swap.c:760
>>   free_pages_and_swap_cache+0x1e8/0x250 mm/swap_state.c:322
>>   tlb_flush_mmu_free+0x6c/0xb8 mm/memory.c:259
>>   tlb_flush_mmu+0x3c/0x48 mm/memory.c:268
>>   arch_tlb_finish_mmu+0x70/0xc0 mm/memory.c:283
>>   tlb_finish_mmu+0xd0/0x128 mm/memory.c:433
>>   unmap_region+0x248/0x2b8 mm/mmap.c:2514
>>   do_munmap+0x3b8/0x670 mm/mmap.c:2726
>>   mmap_region+0x3b8/0xa78 mm/mmap.c:1646
>>   do_mmap+0x448/0x6a0 mm/mmap.c:1483
>>   do_mmap_pgoff include/linux/mm.h:2223 [inline]
>>   vm_mmap_pgoff+0x17c/0x1b8 mm/util.c:355
>>   SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
>>   SyS_mmap_pgoff+0x184/0x3e8 mm/mmap.c:1491
>>   sys_mmap+0x58/0x80 arch/arm64/kernel/sys.c:37
>>   el0_svc_naked+0x30/0x34
>>
>> The buggy address belongs to the page:
>> page:ffff7e0001ce3180 count:0 mapcount:0 mapping:0000000000000000 index:0x0
>> flags: 0x4fffc00000000000()
>> raw: 4fffc00000000000 0000000000000000 0000000000000000 00000000ffffffff
>> raw: 0000000000000000 ffff7e0001ce31a0 0000000000000000 0000000000000000
>> page dumped because: kasan: bad access detected
>>
>> Memory state around the buggy address:
>>   ffff8000738c6b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>   ffff8000738c6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>> ffff8000738c6c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1 f1 f1 f1 f8 f8
>>                                                               ^
>>   ffff8000738c6d00: f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f8 f8 f8 f8 f8 f8
>>   ffff8000738c6d80: f8 f8 f8 f8 f8 f8 00 00 00 00 00 00 00 00 00 00
>> ==================================================================
>>
>> --
>> You received this message because you are subscribed to the Google Groups "syzkaller" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-05-07  6:02 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CAD1Xb+-kbRLxe1XNSkhY-VXZWV8fSy-gZeeGhtKH2hO42VJKzA@mail.gmail.com>
2018-05-02 11:18 ` Use-after-scope Write in mem_cgroup_uncharge' bug.(Plain text) Dmitry Vyukov
2018-05-07  6:01   ` Dmitry Vyukov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).