UBSAN: undefined-behaviour in vhost_vq_reset
7 views
Skip to first unread message
syzbot
Sep 16, 2020, 9:38:22 PM9/16/20
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: a87f9628 Linux 4.19.145
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11c1f01d900000
kernel config: https://syzkaller.appspot.com/x/.config?x=9688ecb5b728ce13
dashboard link: https://syzkaller.appspot.com/bug?extid=8d8e8804f63dd6b5c44c
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8d8e88...@syzkaller.appspotmail.com
================================================================================
UBSAN: Undefined behaviour in drivers/vhost/vhost.c:116:62
load of value 255 is not a valid value for type '_Bool'
CPU: 0 PID: 13907 Comm: syz-executor.4 Not tainted 4.19.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_load_invalid_value.cold+0x63/0x6f lib/ubsan.c:454
vhost_init_is_le drivers/vhost/vhost.c:116 [inline]
vhost_reset_is_le drivers/vhost/vhost.c:143 [inline]
vhost_vq_reset.constprop.0.cold+0x15/0x1a drivers/vhost/vhost.c:325
vhost_dev_init+0x442/0x780 drivers/vhost/vhost.c:463
vhost_vsock_dev_open+0x1c9/0x310 drivers/vhost/vsock.c:583
misc_open+0x372/0x4a0 drivers/char/misc.c:141
chrdev_open+0x266/0x770 fs/char_dev.c:423
do_dentry_open+0x4aa/0x1160 fs/open.c:796
do_last fs/namei.c:3421 [inline]
path_openat+0x7d5/0x2e90 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5f9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd84cc65c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000000243c0 RCX: 000000000045d5f9
RDX: 0000000000000002 RSI: 0000000020000100 RDI: ffffffffffffff9c
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff2e5e4e2f R14: 00007fd84cc669c0 R15: 000000000118cf4c
================================================================================
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: a87f9628 Linux 4.19.145
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11c1f01d900000
kernel config: https://syzkaller.appspot.com/x/.config?x=9688ecb5b728ce13
dashboard link: https://syzkaller.appspot.com/bug?extid=8d8e8804f63dd6b5c44c
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8d8e88...@syzkaller.appspotmail.com
================================================================================
UBSAN: Undefined behaviour in drivers/vhost/vhost.c:116:62
load of value 255 is not a valid value for type '_Bool'
CPU: 0 PID: 13907 Comm: syz-executor.4 Not tainted 4.19.145-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_load_invalid_value.cold+0x63/0x6f lib/ubsan.c:454
vhost_init_is_le drivers/vhost/vhost.c:116 [inline]
vhost_reset_is_le drivers/vhost/vhost.c:143 [inline]
vhost_vq_reset.constprop.0.cold+0x15/0x1a drivers/vhost/vhost.c:325
vhost_dev_init+0x442/0x780 drivers/vhost/vhost.c:463
vhost_vsock_dev_open+0x1c9/0x310 drivers/vhost/vsock.c:583
misc_open+0x372/0x4a0 drivers/char/misc.c:141
chrdev_open+0x266/0x770 fs/char_dev.c:423
do_dentry_open+0x4aa/0x1160 fs/open.c:796
do_last fs/namei.c:3421 [inline]
path_openat+0x7d5/0x2e90 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45d5f9
Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd84cc65c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000000243c0 RCX: 000000000045d5f9
RDX: 0000000000000002 RSI: 0000000020000100 RDI: ffffffffffffff9c
RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c
R13: 00007fff2e5e4e2f R14: 00007fd84cc669c0 R15: 000000000118cf4c
================================================================================
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
JFS: Cannot determine volume size
JFS: discard option not supported on device
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Sep 20, 2020, 2:51:15 PM9/20/20
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 015e94d0 Linux 4.19.146
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15f12c81900000
kernel config: https://syzkaller.appspot.com/x/.config?x=243dd74ad58a8a57
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150b1e73900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8d8e88...@syzkaller.appspotmail.com
audit: type=1400 audit(1600627758.142:8): avc: denied { execmem } for pid=6484 comm="syz-executor287" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
CPU: 1 PID: 6485 Comm: syz-executor287 Not tainted 4.19.146-syzkaller #0
Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff290bc308 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441229
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401fd0
R13: 0000000000402060 R14: 0000000000000000 R15: 0000000000000000
================================================================================
HEAD commit: 015e94d0 Linux 4.19.146
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15f12c81900000
kernel config: https://syzkaller.appspot.com/x/.config?x=243dd74ad58a8a57
dashboard link: https://syzkaller.appspot.com/bug?extid=8d8e8804f63dd6b5c44c
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13284b07900000
compiler: gcc (GCC) 10.1.0-syz 20200507
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150b1e73900000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8d8e88...@syzkaller.appspotmail.com
================================================================================
UBSAN: Undefined behaviour in drivers/vhost/vhost.c:116:62
load of value 177 is not a valid value for type '_Bool'
UBSAN: Undefined behaviour in drivers/vhost/vhost.c:116:62
CPU: 1 PID: 6485 Comm: syz-executor287 Not tainted 4.19.146-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_load_invalid_value.cold+0x63/0x6f lib/ubsan.c:454
vhost_init_is_le drivers/vhost/vhost.c:116 [inline]
vhost_reset_is_le drivers/vhost/vhost.c:143 [inline]
vhost_vq_reset.constprop.0.cold+0x15/0x1a drivers/vhost/vhost.c:325
vhost_dev_init+0x442/0x780 drivers/vhost/vhost.c:463
vhost_net_open+0x54c/0x730 drivers/vhost/net.c:1103
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x22c/0x33e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x3a lib/ubsan.c:161
__ubsan_handle_load_invalid_value.cold+0x63/0x6f lib/ubsan.c:454
vhost_init_is_le drivers/vhost/vhost.c:116 [inline]
vhost_reset_is_le drivers/vhost/vhost.c:143 [inline]
vhost_vq_reset.constprop.0.cold+0x15/0x1a drivers/vhost/vhost.c:325
vhost_dev_init+0x442/0x780 drivers/vhost/vhost.c:463
misc_open+0x372/0x4a0 drivers/char/misc.c:141
chrdev_open+0x266/0x770 fs/char_dev.c:423
do_dentry_open+0x4aa/0x1160 fs/open.c:796
do_last fs/namei.c:3421 [inline]
path_openat+0x7d5/0x2e90 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441229
chrdev_open+0x266/0x770 fs/char_dev.c:423
do_dentry_open+0x4aa/0x1160 fs/open.c:796
do_last fs/namei.c:3421 [inline]
path_openat+0x7d5/0x2e90 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x670 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff290bc308 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441229
RDX: 0000000000000002 RSI: 0000000020000100 RDI: ffffffffffffff9c
RBP: 00000000006cb018 R08: 0000000000000004 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401fd0
R13: 0000000000402060 R14: 0000000000000000 R15: 0000000000000000
================================================================================
Reply all
Reply to author
Forward
0 new messages