From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756333AbcEXP2Q (ORCPT ); Tue, 24 May 2016 11:28:16 -0400 Received: from mail-pa0-f68.google.com ([209.85.220.68]:34122 "EHLO mail-pa0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752518AbcEXP2O (ORCPT ); Tue, 24 May 2016 11:28:14 -0400 To: Jens Axboe , Al Viro Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org From: Baozeng Ding Subject: BUG: slab-out-of-bounds in bio_alloc_bioset Message-ID: <19d79a69-cb2e-9742-dea1-4dceb9c328b9@gmail.com> Date: Tue, 24 May 2016 23:28:05 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi all, I've got the following report (slab-out-of-bounds in bio_alloc_bioset) while running syzkaller.The kernel version is 4.6.0-rc7+. (I can reproduce it with syzkaller).Thanks. BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr ffff8800187a9030 Read of size 4096 by task syz-executor/27197 page:ffffea000061ea40 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 27197 Comm: syz-executor Not tainted 4.6.0-rc7+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 0000000000000001 ffff8800323270b8 ffffffff82809d71 ffff880032327148 ffff8800187a9030 ffff8800187a9030 ffff8800323275b0 ffff880032327138 ffffffff815c504b ffff88001f004e00 ffff88001a5d7140 0000000000000286 Call Trace: [< inline >] __dump_stack /lib/dump_stack.c:15 [] dump_stack+0xb3/0x112 /lib/dump_stack.c:51 [< inline >] print_address_description /mm/kasan/report.c:190 [] kasan_report_error+0x4fb/0x530 /mm/kasan/report.c:275 [] ? ___slab_alloc+0x167/0x500 /mm/slub.c:2449 [< inline >] ? spin_unlock /include/linux/spinlock.h:347 [] ? deactivate_slab+0x408/0x710 /mm/slub.c:2001 [] kasan_report+0x34/0x40 /mm/kasan/report.c:297 [] ? memcpy+0x1d/0x40 /mm/kasan/kasan.c:318 [< inline >] check_memory_region /mm/kasan/kasan.c:285 [] __asan_loadN+0x124/0x1a0 /mm/kasan/kasan.c:678 [] memcpy+0x1d/0x40 /mm/kasan/kasan.c:318 [] copy_from_iter+0x581/0x960 /lib/iov_iter.c:416 [< inline >] ? kasan_poison_shadow /mm/kasan/kasan.c:52 [] ? kasan_unpoison_shadow+0x36/0x50 /mm/kasan/kasan.c:57 [] copy_page_from_iter+0x510/0xa50 /lib/iov_iter.c:467 [] ? bio_alloc_bioset+0x3ca/0x7a0 /block/bio.c:512 [] ? iov_iter_fault_in_readable+0x220/0x220 /lib/iov_iter.c:313 [] ? bio_add_pc_page+0x3fc/0x900 /block/bio.c:798 [< inline >] bio_copy_from_iter /block/bio.c:1029 [] bio_copy_user_iov+0xac8/0xe10 /block/bio.c:1230 [] ? bio_uncopy_user+0x650/0x650 /block/bio.c:1057 [] ? iov_iter_advance+0x154/0x540 /lib/iov_iter.c:511 [< inline >] bio_set_flag /include/linux/bio.h:305 [< inline >] __blk_rq_map_user_iov /block/blk-map.c:59 [] blk_rq_map_user_iov+0x23b/0xa80 /block/blk-map.c:125 [] ? blk_rq_append_bio+0x170/0x170 /block/blk-map.c:15 [] ? ___slab_alloc+0x167/0x500 /mm/slub.c:2449 [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 [< inline >] ? kmalloc /include/linux/slab.h:483 [< inline >] ? kzalloc /include/linux/slab.h:622 [< inline >] ? sg_build_sgat /drivers/scsi/sg.c:1817 [] ? sg_build_indirect.isra.18+0x8b/0x530 /drivers/scsi/sg.c:1843 [] ? import_single_range+0x1d4/0x2b0 /lib/iov_iter.c:869 [] blk_rq_map_user+0x100/0x170 /block/blk-map.c:154 [] ? blk_rq_map_user_iov+0xa80/0xa80 /block/blk-map.c:227 [] ? alloc_pages_current+0x104/0x340 /mm/mempolicy.c:2095 [< inline >] sg_start_req /drivers/scsi/sg.c:1767 [] sg_common_write.isra.19+0x1042/0x16d0 /drivers/scsi/sg.c:783 [] ? sg_open+0x13a0/0x13a0 /drivers/scsi/sg.c:2145 [] ? sg_add_request+0x30/0x2d0 /drivers/scsi/sg.c:2058 [] ? trace_hardirqs_on+0xd/0x10 /kernel/locking/lockdep.c:2734 [] ? sg_add_request+0xfb/0x2d0 /drivers/scsi/sg.c:2088 [< inline >] ? finish_lock_switch /kernel/sched/sched.h:1122 [] ? finish_task_switch+0x14e/0x5f0 /kernel/sched/core.c:2626 [] sg_write+0x606/0xa30 /drivers/scsi/sg.c:686 [] ? sg_ioctl+0x2990/0x2990 /drivers/scsi/sg.c:1090 [< inline >] ? rcu_read_unlock /include/linux/rcupdate.h:922 [] ? cpuacct_charge+0x1bd/0x340 /kernel/sched/cpuacct.c:245 [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 [< inline >] ? idle_balance /kernel/sched/fair.c:7505 [] ? pick_next_task_fair+0x310/0x2390 /kernel/sched/fair.c:5556 [< inline >] ? rcu_read_unlock /include/linux/rcupdate.h:922 [< inline >] ? idle_balance /kernel/sched/fair.c:7511 [] ? pick_next_task_fair+0x42e/0x2390 /kernel/sched/fair.c:5556 [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 [] __vfs_write+0x113/0x4b0 /fs/read_write.c:529 [] ? sg_ioctl+0x2990/0x2990 /drivers/scsi/sg.c:1090 [] ? do_iter_readv_writev+0x2b0/0x2b0 /fs/read_write.c:707 [] ? trace_hardirqs_on+0xd/0x10 /kernel/locking/lockdep.c:2734 [< inline >] ? pipe_lock_nested /fs/pipe.c:65 [< inline >] ? pipe_lock /fs/pipe.c:73 [] ? pipe_wait+0x148/0x1a0 /fs/pipe.c:121 [] ? mutex_lock_interruptible_nested+0x980/0x980 ??:? [< inline >] ? arch_local_irq_restore /./arch/x86/include/asm/paravirt.h:791 [< inline >] ? __raw_spin_unlock_irqrestore /include/linux/spinlock_api_smp.h:162 [] ? _raw_spin_unlock_irqrestore+0x36/0x60 /kernel/locking/spinlock.c:191 [< inline >] ? spin_unlock_irqrestore /include/linux/spinlock.h:362 [] ? finish_wait+0xfd/0x180 /kernel/sched/wait.c:253 [] __kernel_write+0xe7/0x320 /fs/read_write.c:551 [] ? __might_sleep+0x90/0x1a0 /kernel/sched/core.c:7426 [] write_pipe_buf+0x159/0x1e0 /fs/splice.c:1071 [] ? do_splice_direct+0x250/0x250 /fs/splice.c:1339 [] ? splice_from_pipe_next+0x2f0/0x3c0 /fs/splice.c:818 [< inline >] splice_from_pipe_feed /fs/splice.c:773 [] __splice_from_pipe+0x254/0x710 /fs/splice.c:898 [] ? do_splice_direct+0x250/0x250 /fs/splice.c:1339 [] splice_from_pipe+0xf7/0x140 /fs/splice.c:933 [] ? do_splice_direct+0x250/0x250 /fs/splice.c:1339 [] ? splice_shrink_spd+0x60/0x60 /fs/splice.c:299 [] ? security_file_permission+0x89/0x1e0 /security/security.c:733 [] default_file_splice_write+0x40/0x90 /fs/splice.c:1083 [< inline >] do_splice_from /fs/splice.c:1125 [< inline >] do_splice /fs/splice.c:1404 [< inline >] SYSC_splice /fs/splice.c:1707 [] SyS_splice+0x7fa/0x1670 /fs/splice.c:1690 [< inline >] ? SYSC_futex /kernel/futex.c:3237 [] ? SyS_futex+0x13f/0x2b0 /kernel/futex.c:3205 [] ? generic_splice_sendpage+0x50/0x50 /fs/splice.c:1107 [] ? compat_SyS_vmsplice+0x250/0x250 /fs/splice.c:1658 [] ? trace_hardirqs_on_thunk+0x1b/0x1d /arch/x86/entry/thunk_64.S:42 [] entry_SYSCALL_64_fastpath+0x23/0xc1 /arch/x86/entry/entry_64.S:207 Memory state around the buggy address: ffff8800187a9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800187a9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8800187aa000: fc 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc ^ ffff8800187aa080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800187aa100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ================================================================== Best Regards, Baozeng Ding