* [syzbot] [kernel?] KFENCE: memory corruption in add_sysfs_param
@ 2024-10-04 6:32 syzbot
2024-10-04 6:47 ` Marco Elver
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2024-10-04 6:32 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: c02d24a5af66 Add linux-next specific files for 20241003
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10ac0d80580000
kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
dashboard link: https://syzkaller.appspot.com/bug?extid=873cb3989e92ad5d796d
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/641e642c9432/disk-c02d24a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/98aaf20c29e0/vmlinux-c02d24a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c23099f2d86b/bzImage-c02d24a5.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+873cb3989e92ad5d796d@syzkaller.appspotmail.com
can: broadcast manager protocol
can: netlink gateway - max_hops=1
can: SAE J1939
can: isotp protocol (max_pdu_size 8300)
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
NET: Registered PF_RXRPC protocol family
Key type rxrpc registered
Key type rxrpc_s registered
NET: Registered PF_KCM protocol family
lec:lane_module_init: lec.c: initialized
mpoa:atm_mpoa_init: mpc.c: initialized
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
l2tp_ip: L2TP IP encapsulation support (L2TPv3)
l2tp_netlink: L2TP netlink interface
l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
NET: Registered PF_PHONET protocol family
8021q: 802.1Q VLAN Support v1.8
DCCP: Activated CCID 2 (TCP-like)
DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
sctp: Hash tables configured (bind 32/56)
NET: Registered PF_RDS protocol family
Registered RDS/infiniband transport
Registered RDS/tcp transport
tipc: Activated (version 2.0.0)
NET: Registered PF_TIPC protocol family
tipc: Started in single node mode
NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
NET: Registered PF_CAIF protocol family
NET: Registered PF_IEEE802154 protocol family
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
openvswitch: Open vSwitch switching datapath
NET: Registered PF_VSOCK protocol family
mpls_gso: MPLS GSO support
IPI shorthand broadcast: enabled
AES CTR mode by8 optimization enabled
==================================================================
BUG: KFENCE: memory corruption in krealloc_noprof+0x160/0x2e0
Corrupted memory at 0xffff88823be6c088 [ 0x08 0x46 0x11 0x30 0x80 0x88 0xff 0xff 0x60 0x46 0x11 0x30 0x80 0x88 0xff 0xff ] (in kfence-#53):
krealloc_noprof+0x160/0x2e0
add_sysfs_param+0x137/0x7f0 kernel/params.c:663
kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
do_one_initcall+0x248/0x880 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
kfence-#53: 0xffff88823be6c000-0xffff88823be6c087, size=136, cache=kmalloc-192
allocated by task 1 on cpu 1 at 10.052565s (0.009153s ago):
__do_krealloc mm/slub.c:4784 [inline]
krealloc_noprof+0xd6/0x2e0 mm/slub.c:4838
add_sysfs_param+0x137/0x7f0 kernel/params.c:663
kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
do_one_initcall+0x248/0x880 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
freed by task 1 on cpu 1 at 10.059120s (0.002598s ago):
krealloc_noprof+0x160/0x2e0
add_sysfs_param+0x137/0x7f0 kernel/params.c:663
kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
do_one_initcall+0x248/0x880 init/main.c:1266
do_initcall_level+0x157/0x210 init/main.c:1328
do_initcalls+0x3f/0x80 init/main.c:1344
kernel_init_freeable+0x435/0x5d0 init/main.c:1577
kernel_init+0x1d/0x2b0 init/main.c:1466
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc1-next-20241003-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [kernel?] KFENCE: memory corruption in add_sysfs_param
2024-10-04 6:32 [syzbot] [kernel?] KFENCE: memory corruption in add_sysfs_param syzbot
@ 2024-10-04 6:47 ` Marco Elver
0 siblings, 0 replies; 2+ messages in thread
From: Marco Elver @ 2024-10-04 6:47 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
On Fri, 4 Oct 2024 at 08:32, syzbot
<syzbot+873cb3989e92ad5d796d@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: c02d24a5af66 Add linux-next specific files for 20241003
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10ac0d80580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
> dashboard link: https://syzkaller.appspot.com/bug?extid=873cb3989e92ad5d796d
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/641e642c9432/disk-c02d24a5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/98aaf20c29e0/vmlinux-c02d24a5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/c23099f2d86b/bzImage-c02d24a5.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+873cb3989e92ad5d796d@syzkaller.appspotmail.com
>
> can: broadcast manager protocol
> can: netlink gateway - max_hops=1
> can: SAE J1939
> can: isotp protocol (max_pdu_size 8300)
> Bluetooth: RFCOMM TTY layer initialized
> Bluetooth: RFCOMM socket layer initialized
> Bluetooth: RFCOMM ver 1.11
> Bluetooth: BNEP (Ethernet Emulation) ver 1.3
> Bluetooth: BNEP filters: protocol multicast
> Bluetooth: BNEP socket layer initialized
> Bluetooth: HIDP (Human Interface Emulation) ver 1.2
> Bluetooth: HIDP socket layer initialized
> NET: Registered PF_RXRPC protocol family
> Key type rxrpc registered
> Key type rxrpc_s registered
> NET: Registered PF_KCM protocol family
> lec:lane_module_init: lec.c: initialized
> mpoa:atm_mpoa_init: mpc.c: initialized
> l2tp_core: L2TP core driver, V2.0
> l2tp_ppp: PPPoL2TP kernel driver, V2.0
> l2tp_ip: L2TP IP encapsulation support (L2TPv3)
> l2tp_netlink: L2TP netlink interface
> l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
> l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
> NET: Registered PF_PHONET protocol family
> 8021q: 802.1Q VLAN Support v1.8
> DCCP: Activated CCID 2 (TCP-like)
> DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
> DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
> sctp: Hash tables configured (bind 32/56)
> NET: Registered PF_RDS protocol family
> Registered RDS/infiniband transport
> Registered RDS/tcp transport
> tipc: Activated (version 2.0.0)
> NET: Registered PF_TIPC protocol family
> tipc: Started in single node mode
> NET: Registered PF_SMC protocol family
> 9pnet: Installing 9P2000 support
> NET: Registered PF_CAIF protocol family
> NET: Registered PF_IEEE802154 protocol family
> Key type dns_resolver registered
> Key type ceph registered
> libceph: loaded (mon/osd proto 15/24)
> batman_adv: B.A.T.M.A.N. advanced 2024.2 (compatibility version 15) loaded
> openvswitch: Open vSwitch switching datapath
> NET: Registered PF_VSOCK protocol family
> mpls_gso: MPLS GSO support
> IPI shorthand broadcast: enabled
> AES CTR mode by8 optimization enabled
> ==================================================================
> BUG: KFENCE: memory corruption in krealloc_noprof+0x160/0x2e0
>
> Corrupted memory at 0xffff88823be6c088 [ 0x08 0x46 0x11 0x30 0x80 0x88 0xff 0xff 0x60 0x46 0x11 0x30 0x80 0x88 0xff 0xff ] (in kfence-#53):
> krealloc_noprof+0x160/0x2e0
> add_sysfs_param+0x137/0x7f0 kernel/params.c:663
> kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
> param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
> param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
> do_one_initcall+0x248/0x880 init/main.c:1266
> do_initcall_level+0x157/0x210 init/main.c:1328
> do_initcalls+0x3f/0x80 init/main.c:1344
> kernel_init_freeable+0x435/0x5d0 init/main.c:1577
> kernel_init+0x1d/0x2b0 init/main.c:1466
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> kfence-#53: 0xffff88823be6c000-0xffff88823be6c087, size=136, cache=kmalloc-192
>
> allocated by task 1 on cpu 1 at 10.052565s (0.009153s ago):
> __do_krealloc mm/slub.c:4784 [inline]
> krealloc_noprof+0xd6/0x2e0 mm/slub.c:4838
> add_sysfs_param+0x137/0x7f0 kernel/params.c:663
> kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
> param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
> param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
> do_one_initcall+0x248/0x880 init/main.c:1266
> do_initcall_level+0x157/0x210 init/main.c:1328
> do_initcalls+0x3f/0x80 init/main.c:1344
> kernel_init_freeable+0x435/0x5d0 init/main.c:1577
> kernel_init+0x1d/0x2b0 init/main.c:1466
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> freed by task 1 on cpu 1 at 10.059120s (0.002598s ago):
> krealloc_noprof+0x160/0x2e0
> add_sysfs_param+0x137/0x7f0 kernel/params.c:663
> kernel_add_sysfs_param+0xb4/0x130 kernel/params.c:817
> param_sysfs_builtin+0x16e/0x1f0 kernel/params.c:856
> param_sysfs_builtin_init+0x31/0x40 kernel/params.c:990
> do_one_initcall+0x248/0x880 init/main.c:1266
> do_initcall_level+0x157/0x210 init/main.c:1328
> do_initcalls+0x3f/0x80 init/main.c:1344
> kernel_init_freeable+0x435/0x5d0 init/main.c:1577
> kernel_init+0x1d/0x2b0 init/main.c:1466
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc1-next-20241003-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Possible cause:
https://lore.kernel.org/all/CANpmjNM5XjwwSc8WrDE9=FGmSScftYrbsvC+db+82GaMPiQqvQ@mail.gmail.com/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-10-04 6:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-04 6:32 [syzbot] [kernel?] KFENCE: memory corruption in add_sysfs_param syzbot
2024-10-04 6:47 ` Marco Elver
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®