Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #60475 > unrolled thread

KASAN: use-after-free Read in set_page_dirty_lock

Started byKaipeng Zeng <kaipeng94@gmail.com>
First post2018-03-15 16:20 +0100
Last post2018-03-16 05:00 +0100
Articles 3 — 3 participants

Back to article view | Back to linux.debian.kernel

Contents

  KASAN: use-after-free Read in set_page_dirty_lock Kaipeng Zeng <kaipeng94@gmail.com> - 2018-03-15 16:20 +0100
    Re: KASAN: use-after-free Read in set_page_dirty_lock Ben Hutchings <ben@decadent.org.uk> - 2018-03-15 17:40 +0100
      Re: KASAN: use-after-free Read in set_page_dirty_lock "Yan, Zheng" <ukernel@gmail.com> - 2018-03-16 05:00 +0100

#60475 — KASAN: use-after-free Read in set_page_dirty_lock

FromKaipeng Zeng <kaipeng94@gmail.com>
Date2018-03-15 16:20 +0100
SubjectKASAN: use-after-free Read in set_page_dirty_lock
Message-ID<vtCPD-4qE-1@gated-at.bofh.it>
KASAN: use-after-free Read in set_page_dirty_lock found by syzkaller.
Kernel: debian package linux-source-4.14, build with KASAN enable
P.S. "/root/tmp" is the mount point of cephfs
Log & repro:
Syzkaller hit 'KASAN: use-after-free Read in set_page_dirty_lock' bug.

==================================================================
BUG: KASAN: use-after-free in __read_once_size
include/linux/compiler.h:178 [inline]
BUG: KASAN: use-after-free in compound_head
include/linux/page-flags.h:147 [inline]
BUG: KASAN: use-after-free in trylock_page include/linux/pagemap.h:468 [inline]
BUG: KASAN: use-after-free in lock_page include/linux/pagemap.h:478 [inline]
BUG: KASAN: use-after-free in set_page_dirty_lock+0x9c/0xa0
mm/page-writeback.c:2606
Read of size 8 at addr ffff88007bb63ae0 by task syzkaller929525/563

CPU: 2 PID: 563 Comm: syzkaller929525 Not tainted 4.14.17 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x7b/0xa4 lib/dump_stack.c:53
 print_address_description+0x73/0x270 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x254/0x370 mm/kasan/report.c:409
 __read_once_size include/linux/compiler.h:178 [inline]
 compound_head include/linux/page-flags.h:147 [inline]
 trylock_page include/linux/pagemap.h:468 [inline]
 lock_page include/linux/pagemap.h:478 [inline]
 set_page_dirty_lock+0x9c/0xa0 mm/page-writeback.c:2606
 ceph_put_page_vector+0x10b/0x180 [libceph]
 ceph_direct_read_write+0x1126/0x1da0 [ceph]
 ceph_read_iter+0xc10/0x1280 [ceph]
 call_read_iter include/linux/fs.h:1767 [inline]
 generic_file_splice_read+0x396/0x610 fs/splice.c:307
 do_splice_to+0x104/0x150 fs/splice.c:881
 do_splice fs/splice.c:1175 [inline]
 SYSC_splice fs/splice.c:1404 [inline]
 SyS_splice+0xf58/0x12d0 fs/splice.c:1384
 system_call_fast_compare_end+0x12/0x75
RIP: 0033:0x4337a9
RSP: 002b:00007ffea3f98f78 EFLAGS: 00000216

Allocated by task 459:
 save_stack+0x33/0xa0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xa0/0xd0 mm/kasan/kasan.c:551
 __do_kmalloc mm/slab.c:3726 [inline]
 __kmalloc+0x11a/0x620 mm/slab.c:3735
 kmalloc include/linux/slab.h:499 [inline]
 load_elf_phdrs+0x16d/0x1d0 fs/binfmt_elf.c:431
 load_elf_binary+0x930/0x4540 fs/binfmt_elf.c:824
 search_binary_handler+0x176/0x4b0 fs/exec.c:1640
 exec_binprm fs/exec.c:1682 [inline]
 do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
 do_execve fs/exec.c:1849 [inline]
 SYSC_execve fs/exec.c:1930 [inline]
 SyS_execve+0x39/0x50 fs/exec.c:1925
 do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
 return_from_SYSCALL_64+0x0/0x65

Freed by task 459:
 save_stack+0x33/0xa0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3504 [inline]
 kfree+0x88/0x110 mm/slab.c:3821
 load_elf_binary+0x1952/0x4540 fs/binfmt_elf.c:1096
 search_binary_handler+0x176/0x4b0 fs/exec.c:1640
 exec_binprm fs/exec.c:1682 [inline]
 do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
 do_execve fs/exec.c:1849 [inline]
 SYSC_execve fs/exec.c:1930 [inline]
 SyS_execve+0x39/0x50 fs/exec.c:1925
 do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
 return_from_SYSCALL_64+0x0/0x65

The buggy address belongs to the object at ffff88007bb63ac0
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 32 bytes inside of
 512-byte region [ffff88007bb63ac0, ffff88007bb63cc0)
The buggy address belongs to the page:
page:ffffea0001eed8c0 count:1 mapcount:0 mapping:ffff88007bb630c0 index:0x0
flags: 0x4ffffc000000100(slab)
raw: 04ffffc000000100 ffff88007bb630c0 0000000000000000 0000000100000006
raw: ffffea0001eec0e0 ffffea0001d0c220 ffff88002d4002c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88007bb63980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88007bb63a00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>ffff88007bb63a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                                       ^
 ffff88007bb63b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88007bb63b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Syzkaller reproducer:
# {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:
Fault:false FaultCall:-1 FaultNth:0 EnableTun:false UseTmpDir:false
HandleSegv:false WaitRepeat:false Debug:false Repro:false}
mmap(&(0x7f0000000000/0x447000)=nil, 0x447000, 0x3, 0x32,
0xffffffffffffffff, 0x0)
pipe$ceph_fops(&(0x7f00001c2000)={0x0, <r0=>0x0})
r1 = open$ceph_fops(&(0x7f000007e000)='/root/tmp/test\x00', 0x44000, 0x121)
splice$ceph_fops_in(r1, &(0x7f000009c000-0x8)=0x36, r0, 0x0, 0x5, 0x1)


C reproducer:
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

long r[2];
void loop()
{
  memset(r, -1, sizeof(r));
  syscall(__NR_mmap, 0x20000000, 0x447000, 3, 0x32, -1, 0);
  if (syscall(__NR_pipe, 0x201c2000) != -1)
    r[0] = *(uint32_t*)0x201c2004;
  memcpy((void*)0x2007e000, "/root/tmp/test", 15);
  r[1] = syscall(__NR_open, 0x2007e000, 0x44000, 0x121);
  *(uint64_t*)0x2009bff8 = 0x36;
  syscall(__NR_splice, r[1], 0x2009bff8, r[0], 0, 5, 1);
}

int main()
{
  loop();
  return 0;
}


Reproducing stats:
Extracting prog: 5h8m47.118307857s
Minimizing prog: 35m20.785719207s
Simplifying prog options: 0s
Extracting C: 35.310144578s
Simplifying C: 4m6.310642807s

[toc] | [next] | [standalone]

#60476

FromBen Hutchings <ben@decadent.org.uk>
Date2018-03-15 17:40 +0100
Message-ID<vtE54-59K-13@gated-at.bofh.it>
In reply to#60475

[Multipart message — attachments visible in raw view] — view raw

Cc: ceph-devel@vger.kernel.org

On Thu, 2018-03-15 at 23:10 +0800, Kaipeng Zeng wrote:
> KASAN: use-after-free Read in set_page_dirty_lock found by syzkaller.
> Kernel: debian package linux-source-4.14, build with KASAN enable
> P.S. "/root/tmp" is the mount point of cephfs
> Log & repro:
> Syzkaller hit 'KASAN: use-after-free Read in set_page_dirty_lock' bug.
> 
> ==================================================================
> BUG: KASAN: use-after-free in __read_once_size
> include/linux/compiler.h:178 [inline]
> BUG: KASAN: use-after-free in compound_head
> include/linux/page-flags.h:147 [inline]
> BUG: KASAN: use-after-free in trylock_page include/linux/pagemap.h:468 [inline]
> BUG: KASAN: use-after-free in lock_page include/linux/pagemap.h:478 [inline]
> BUG: KASAN: use-after-free in set_page_dirty_lock+0x9c/0xa0
> mm/page-writeback.c:2606
> Read of size 8 at addr ffff88007bb63ae0 by task syzkaller929525/563
> 
> CPU: 2 PID: 563 Comm: syzkaller929525 Not tainted 4.14.17 #3
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> Call Trace:
>  __dump_stack lib/dump_stack.c:17 [inline]
>  dump_stack+0x7b/0xa4 lib/dump_stack.c:53
>  print_address_description+0x73/0x270 mm/kasan/report.c:252
>  kasan_report_error mm/kasan/report.c:351 [inline]
>  kasan_report+0x254/0x370 mm/kasan/report.c:409
>  __read_once_size include/linux/compiler.h:178 [inline]
>  compound_head include/linux/page-flags.h:147 [inline]
>  trylock_page include/linux/pagemap.h:468 [inline]
>  lock_page include/linux/pagemap.h:478 [inline]
>  set_page_dirty_lock+0x9c/0xa0 mm/page-writeback.c:2606
>  ceph_put_page_vector+0x10b/0x180 [libceph]
>  ceph_direct_read_write+0x1126/0x1da0 [ceph]
>  ceph_read_iter+0xc10/0x1280 [ceph]
>  call_read_iter include/linux/fs.h:1767 [inline]
>  generic_file_splice_read+0x396/0x610 fs/splice.c:307
>  do_splice_to+0x104/0x150 fs/splice.c:881
>  do_splice fs/splice.c:1175 [inline]
>  SYSC_splice fs/splice.c:1404 [inline]
>  SyS_splice+0xf58/0x12d0 fs/splice.c:1384
>  system_call_fast_compare_end+0x12/0x75
> RIP: 0033:0x4337a9
> RSP: 002b:00007ffea3f98f78 EFLAGS: 00000216
> 
> Allocated by task 459:
>  save_stack+0x33/0xa0 mm/kasan/kasan.c:447
>  set_track mm/kasan/kasan.c:459 [inline]
>  kasan_kmalloc+0xa0/0xd0 mm/kasan/kasan.c:551
>  __do_kmalloc mm/slab.c:3726 [inline]
>  __kmalloc+0x11a/0x620 mm/slab.c:3735
>  kmalloc include/linux/slab.h:499 [inline]
>  load_elf_phdrs+0x16d/0x1d0 fs/binfmt_elf.c:431
>  load_elf_binary+0x930/0x4540 fs/binfmt_elf.c:824
>  search_binary_handler+0x176/0x4b0 fs/exec.c:1640
>  exec_binprm fs/exec.c:1682 [inline]
>  do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
>  do_execve fs/exec.c:1849 [inline]
>  SYSC_execve fs/exec.c:1930 [inline]
>  SyS_execve+0x39/0x50 fs/exec.c:1925
>  do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
>  return_from_SYSCALL_64+0x0/0x65
> 
> Freed by task 459:
>  save_stack+0x33/0xa0 mm/kasan/kasan.c:447
>  set_track mm/kasan/kasan.c:459 [inline]
>  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
>  __cache_free mm/slab.c:3504 [inline]
>  kfree+0x88/0x110 mm/slab.c:3821
>  load_elf_binary+0x1952/0x4540 fs/binfmt_elf.c:1096
>  search_binary_handler+0x176/0x4b0 fs/exec.c:1640
>  exec_binprm fs/exec.c:1682 [inline]
>  do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
>  do_execve fs/exec.c:1849 [inline]
>  SYSC_execve fs/exec.c:1930 [inline]
>  SyS_execve+0x39/0x50 fs/exec.c:1925
>  do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
>  return_from_SYSCALL_64+0x0/0x65
> 
> The buggy address belongs to the object at ffff88007bb63ac0
>  which belongs to the cache kmalloc-512 of size 512
> The buggy address is located 32 bytes inside of
>  512-byte region [ffff88007bb63ac0, ffff88007bb63cc0)
> The buggy address belongs to the page:
> page:ffffea0001eed8c0 count:1 mapcount:0 mapping:ffff88007bb630c0 index:0x0
> flags: 0x4ffffc000000100(slab)
> raw: 04ffffc000000100 ffff88007bb630c0 0000000000000000 0000000100000006
> raw: ffffea0001eec0e0 ffffea0001d0c220 ffff88002d4002c0 0000000000000000
> page dumped because: kasan: bad access detected
> 
> Memory state around the buggy address:
>  ffff88007bb63980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>  ffff88007bb63a00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
> > ffff88007bb63a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> 
>                                                        ^
>  ffff88007bb63b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff88007bb63b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
> 
> 
> Syzkaller reproducer:
> # {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:
> Fault:false FaultCall:-1 FaultNth:0 EnableTun:false UseTmpDir:false
> HandleSegv:false WaitRepeat:false Debug:false Repro:false}
> mmap(&(0x7f0000000000/0x447000)=nil, 0x447000, 0x3, 0x32,
> 0xffffffffffffffff, 0x0)
> pipe$ceph_fops(&(0x7f00001c2000)={0x0, <r0=>0x0})
> r1 = open$ceph_fops(&(0x7f000007e000)='/root/tmp/test\x00', 0x44000, 0x121)
> splice$ceph_fops_in(r1, &(0x7f000009c000-0x8)=0x36, r0, 0x0, 0x5, 0x1)
> 
> 
> C reproducer:
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> 
> #define _GNU_SOURCE
> #include <endian.h>
> #include <stdint.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> 
> long r[2];
> void loop()
> {
>   memset(r, -1, sizeof(r));
>   syscall(__NR_mmap, 0x20000000, 0x447000, 3, 0x32, -1, 0);
>   if (syscall(__NR_pipe, 0x201c2000) != -1)
>     r[0] = *(uint32_t*)0x201c2004;
>   memcpy((void*)0x2007e000, "/root/tmp/test", 15);
>   r[1] = syscall(__NR_open, 0x2007e000, 0x44000, 0x121);
>   *(uint64_t*)0x2009bff8 = 0x36;
>   syscall(__NR_splice, r[1], 0x2009bff8, r[0], 0, 5, 1);
> }
> 
> int main()
> {
>   loop();
>   return 0;
> }
> 
> 
> Reproducing stats:
> Extracting prog: 5h8m47.118307857s
> Minimizing prog: 35m20.785719207s
> Simplifying prog options: 0s
> Extracting C: 35.310144578s
> Simplifying C: 4m6.310642807s
> 
-- 
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

[toc] | [prev] | [next] | [standalone]

#60479

From"Yan, Zheng" <ukernel@gmail.com>
Date2018-03-16 05:00 +0100
Message-ID<vtOH7-54U-1@gated-at.bofh.it>
In reply to#60476
Thanks for reporting this. the issue should be fixed patch "[PATCH]
ceph: only dirty ITER_IOVEC pages for direct read"

Regards
Yan, Zheng


On Fri, Mar 16, 2018 at 12:38 AM, Ben Hutchings <ben@decadent.org.uk> wrote:
> Cc: ceph-devel@vger.kernel.org
>
> On Thu, 2018-03-15 at 23:10 +0800, Kaipeng Zeng wrote:
>> KASAN: use-after-free Read in set_page_dirty_lock found by syzkaller.
>> Kernel: debian package linux-source-4.14, build with KASAN enable
>> P.S. "/root/tmp" is the mount point of cephfs
>> Log & repro:
>> Syzkaller hit 'KASAN: use-after-free Read in set_page_dirty_lock' bug.
>>
>> ==================================================================
>> BUG: KASAN: use-after-free in __read_once_size
>> include/linux/compiler.h:178 [inline]
>> BUG: KASAN: use-after-free in compound_head
>> include/linux/page-flags.h:147 [inline]
>> BUG: KASAN: use-after-free in trylock_page include/linux/pagemap.h:468 [inline]
>> BUG: KASAN: use-after-free in lock_page include/linux/pagemap.h:478 [inline]
>> BUG: KASAN: use-after-free in set_page_dirty_lock+0x9c/0xa0
>> mm/page-writeback.c:2606
>> Read of size 8 at addr ffff88007bb63ae0 by task syzkaller929525/563
>>
>> CPU: 2 PID: 563 Comm: syzkaller929525 Not tainted 4.14.17 #3
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:17 [inline]
>>  dump_stack+0x7b/0xa4 lib/dump_stack.c:53
>>  print_address_description+0x73/0x270 mm/kasan/report.c:252
>>  kasan_report_error mm/kasan/report.c:351 [inline]
>>  kasan_report+0x254/0x370 mm/kasan/report.c:409
>>  __read_once_size include/linux/compiler.h:178 [inline]
>>  compound_head include/linux/page-flags.h:147 [inline]
>>  trylock_page include/linux/pagemap.h:468 [inline]
>>  lock_page include/linux/pagemap.h:478 [inline]
>>  set_page_dirty_lock+0x9c/0xa0 mm/page-writeback.c:2606
>>  ceph_put_page_vector+0x10b/0x180 [libceph]
>>  ceph_direct_read_write+0x1126/0x1da0 [ceph]
>>  ceph_read_iter+0xc10/0x1280 [ceph]
>>  call_read_iter include/linux/fs.h:1767 [inline]
>>  generic_file_splice_read+0x396/0x610 fs/splice.c:307
>>  do_splice_to+0x104/0x150 fs/splice.c:881
>>  do_splice fs/splice.c:1175 [inline]
>>  SYSC_splice fs/splice.c:1404 [inline]
>>  SyS_splice+0xf58/0x12d0 fs/splice.c:1384
>>  system_call_fast_compare_end+0x12/0x75
>> RIP: 0033:0x4337a9
>> RSP: 002b:00007ffea3f98f78 EFLAGS: 00000216
>>
>> Allocated by task 459:
>>  save_stack+0x33/0xa0 mm/kasan/kasan.c:447
>>  set_track mm/kasan/kasan.c:459 [inline]
>>  kasan_kmalloc+0xa0/0xd0 mm/kasan/kasan.c:551
>>  __do_kmalloc mm/slab.c:3726 [inline]
>>  __kmalloc+0x11a/0x620 mm/slab.c:3735
>>  kmalloc include/linux/slab.h:499 [inline]
>>  load_elf_phdrs+0x16d/0x1d0 fs/binfmt_elf.c:431
>>  load_elf_binary+0x930/0x4540 fs/binfmt_elf.c:824
>>  search_binary_handler+0x176/0x4b0 fs/exec.c:1640
>>  exec_binprm fs/exec.c:1682 [inline]
>>  do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
>>  do_execve fs/exec.c:1849 [inline]
>>  SYSC_execve fs/exec.c:1930 [inline]
>>  SyS_execve+0x39/0x50 fs/exec.c:1925
>>  do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
>>  return_from_SYSCALL_64+0x0/0x65
>>
>> Freed by task 459:
>>  save_stack+0x33/0xa0 mm/kasan/kasan.c:447
>>  set_track mm/kasan/kasan.c:459 [inline]
>>  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
>>  __cache_free mm/slab.c:3504 [inline]
>>  kfree+0x88/0x110 mm/slab.c:3821
>>  load_elf_binary+0x1952/0x4540 fs/binfmt_elf.c:1096
>>  search_binary_handler+0x176/0x4b0 fs/exec.c:1640
>>  exec_binprm fs/exec.c:1682 [inline]
>>  do_execveat_common.isra.30+0xffa/0x1890 fs/exec.c:1804
>>  do_execve fs/exec.c:1849 [inline]
>>  SYSC_execve fs/exec.c:1930 [inline]
>>  SyS_execve+0x39/0x50 fs/exec.c:1925
>>  do_syscall_64+0x1e8/0x4e0 arch/x86/entry/common.c:299
>>  return_from_SYSCALL_64+0x0/0x65
>>
>> The buggy address belongs to the object at ffff88007bb63ac0
>>  which belongs to the cache kmalloc-512 of size 512
>> The buggy address is located 32 bytes inside of
>>  512-byte region [ffff88007bb63ac0, ffff88007bb63cc0)
>> The buggy address belongs to the page:
>> page:ffffea0001eed8c0 count:1 mapcount:0 mapping:ffff88007bb630c0 index:0x0
>> flags: 0x4ffffc000000100(slab)
>> raw: 04ffffc000000100 ffff88007bb630c0 0000000000000000 0000000100000006
>> raw: ffffea0001eec0e0 ffffea0001d0c220 ffff88002d4002c0 0000000000000000
>> page dumped because: kasan: bad access detected
>>
>> Memory state around the buggy address:
>>  ffff88007bb63980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>  ffff88007bb63a00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>> > ffff88007bb63a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
>>
>>                                                        ^
>>  ffff88007bb63b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>>  ffff88007bb63b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ==================================================================
>>
>>
>> Syzkaller reproducer:
>> # {Threaded:false Collide:false Repeat:false Procs:1 Sandbox:
>> Fault:false FaultCall:-1 FaultNth:0 EnableTun:false UseTmpDir:false
>> HandleSegv:false WaitRepeat:false Debug:false Repro:false}
>> mmap(&(0x7f0000000000/0x447000)=nil, 0x447000, 0x3, 0x32,
>> 0xffffffffffffffff, 0x0)
>> pipe$ceph_fops(&(0x7f00001c2000)={0x0, <r0=>0x0})
>> r1 = open$ceph_fops(&(0x7f000007e000)='/root/tmp/test\x00', 0x44000, 0x121)
>> splice$ceph_fops_in(r1, &(0x7f000009c000-0x8)=0x36, r0, 0x0, 0x5, 0x1)
>>
>>
>> C reproducer:
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>>
>> #define _GNU_SOURCE
>> #include <endian.h>
>> #include <stdint.h>
>> #include <string.h>
>> #include <sys/syscall.h>
>> #include <unistd.h>
>>
>> long r[2];
>> void loop()
>> {
>>   memset(r, -1, sizeof(r));
>>   syscall(__NR_mmap, 0x20000000, 0x447000, 3, 0x32, -1, 0);
>>   if (syscall(__NR_pipe, 0x201c2000) != -1)
>>     r[0] = *(uint32_t*)0x201c2004;
>>   memcpy((void*)0x2007e000, "/root/tmp/test", 15);
>>   r[1] = syscall(__NR_open, 0x2007e000, 0x44000, 0x121);
>>   *(uint64_t*)0x2009bff8 = 0x36;
>>   syscall(__NR_splice, r[1], 0x2009bff8, r[0], 0, 5, 1);
>> }
>>
>> int main()
>> {
>>   loop();
>>   return 0;
>> }
>>
>>
>> Reproducing stats:
>> Extracting prog: 5h8m47.118307857s
>> Minimizing prog: 35m20.785719207s
>> Simplifying prog options: 0s
>> Extracting C: 35.310144578s
>> Simplifying C: 4m6.310642807s
>>
> --
> Ben Hutchings
> Quantity is no substitute for quality, but it's the only one we've got.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web