Re: perf: fuzzer KASAN unwind_get_return_address

From	Josh Poimboeuf <jpoimboe@redhat.com>
Newsgroups	linux.kernel
Subject	Re: perf: fuzzer KASAN unwind_get_return_address
Date	2016-11-15 22:00 +0100
Message-ID	<sDSZI-1sK-27@gated-at.bofh.it> (permalink)
References	<sDQ1P-7ZM-27@gated-at.bofh.it> <sDR7A-fI-19@gated-at.bofh.it> <sDRhf-ya-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Nov 15, 2016 at 11:04:45AM -0800, Dmitry Vyukov wrote:
> On Tue, Nov 15, 2016 at 10:57 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> > On Tue, Nov 15, 2016 at 12:43:56PM -0500, Vince Weaver wrote:
> >>
> >> Running on my haswell machine with the imc/uncore patch applied, the
> >> perf_fuzzer next tripped over this issue.
> >>
> >> [  202.034495] BAD LUCK: lost 371 message(s) from NMI context!
> >> [  202.034496] ==================================================================
> >> [  202.048327] BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x35/0x80 at addr ffff8800cff0bd90
> >> [  202.058826] Read of size 8 by task perf_fuzzer/16254
> >> [  202.064186] page:ffffea00033fc2c0 count:1 mapcount:0 mapping:          (null) index:0x0^Ac
> >> [  202.073068] flags: 0x1ffff8000000400(reserved)
> >> [  202.077885] page dumped because: kasan: bad access detected
> >> [  202.083880] CPU: 4 PID: 16254 Comm: perf_fuzzer Not tainted 4.9.0-rc5+ #5
> >> [  202.091204] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
> >> [  202.099181]  ffff8800cff0b1d8^Ac ffffffff816bb796^Ac ffff8800cff0b270^Ac ffff8800cff0bd90^Ac
> >> [  202.107896]  ffff8800cff0b260^Ac ffffffff812fbe95^Ac 00007ffc9d1ab480^Ac 0000000000000000^Ac
> >> [  202.116638]  ffffffff8125117d^Ac 0000000000000092^Ac 0000000000000000^Ac ffff8800cff0b7c0^Ac
> >> [  202.125339] Call Trace:
> >> [  202.127994]  <NMI>  [<ffffffff816bb796>] dump_stack+0x63/0x8d
> >> [  202.134184]  [<ffffffff812fbe95>] kasan_report_error+0x495/0x4c0
> >> [  202.140680]  [<ffffffff8125117d>] ? perf_output_begin+0x28d/0x4c0
> >> [  202.147228]  [<ffffffff812fc319>] kasan_report+0x39/0x40
> >> [  202.152987]  [<ffffffff81095ce5>] ? unwind_get_return_address+0x35/0x80
> >> [  202.160094]  [<ffffffff812fa8fe>] __asan_load8+0x5e/0x70
> >> [  202.165859]  [<ffffffff81095ce5>] unwind_get_return_address+0x35/0x80
> >
> > Josh, any ideas?
> 
> I think this is a false positive due to imprecise unwind that hits a
> stack redzone.
> We probably need to use READ_ONCE_NOCHECK as in get_wchan.

I'm not so sure about that.  The unwind should be precise here: it
should only be looking at the frame pointers and return addresses on the
current task's stack.  I can't see any reason why it would be reading
into the KASAN stack redzone.

-- 
Josh

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-15 18:50 +0100
  Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-15 20:00 +0100
    Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-15 20:10 +0100
      Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-15 22:00 +0100
        Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 14:10 +0100
          Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-16 14:20 +0100
          Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-16 15:40 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-16 16:00 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 16:00 +0100
              Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 05:50 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 10:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:10 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 18:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-17 18:50 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:40 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 19:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 18:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 18:20 +0100
                [tip:perf/urgent] perf/x86/intel: Cure bogus unwind from PEBS  entries tip-bot for Peter Zijlstra <tipbot@zytor.com> - 2016-11-22 13:40 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:50 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 16:00 +0100
              Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-16 16:10 +0100
          [PATCH 1/2] unwind: prevent KASAN false positive warnings in guess unwinder Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:20 +0100
            Re: [PATCH 1/2] unwind: prevent KASAN false positive warnings in  guess unwinder Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 21:30 +0100
              Re: [PATCH 1/2] unwind: prevent KASAN false positive warnings in  guess unwinder Ingo Molnar <mingo@kernel.org> - 2016-11-18 09:40 +0100
            [tip:x86/urgent] x86/unwind: Prevent KASAN false positive warnings  in guess unwinder tip-bot for Josh Poimboeuf <tipbot@zytor.com> - 2016-11-18 10:10 +0100
          [PATCH 2/2] dumpstack: prevent KASAN false positive warnings Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:20 +0100
            [tip:x86/urgent] x86/dumpstack: Prevent KASAN false positive  warnings tip-bot for Josh Poimboeuf <tipbot@zytor.com> - 2016-11-18 10:10 +0100
    Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-15 20:10 +0100
      Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-15 22:00 +0100

csiph-web