KASAN: stack-out-of-bounds Read in __remove_hrtimer

[Palash Oswal]

Hello,
I found the following issue using syzkaller with enriched corpus[1] on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux
C Reproducer : I do not have a C reproducer yet. I will update this
thread when I get one.
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f

Link:
1. https://github.com/cmu-pasta/linux-kernel-enriched-corpus

Console log :
==================================================================
BUG: KASAN: stack-out-of-bounds in __remove_hrtimer+0x250/0x2a0
Read of size 1 at addr ffffc9000358fdd0 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11c/0x130
__remove_hrtimer+0x250/0x2a0
__hrtimer_run_queues+0x4e0/0xbe0
hrtimer_interrupt+0x320/0x7b0
__sysvec_apic_timer_interrupt+0x14a/0x430
sysvec_apic_timer_interrupt+0x92/0xc0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:default_idle+0xf/0x20
Code: 89 07 49 c7 c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 76 ff
ff ff cc cc cc cc f3 0f 1e fa eb 07 0f 00 2d 13 38 49 00 fb f4 <fa> c3
66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 65
RSP: 0018:ffffffff8c407e30 EFLAGS: 00000202
RAX: 000000000033b773 RBX: 0000000000000000 RCX: ffffffff89fd3ef5
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffffff8c495800 R08: 0000000000000001 R09: ffff888063a36cab
R10: ffffed100c746d95 R11: 0000000000000000 R12: fffffbfff1892b00
R13: 0000000000000000 R14: ffffffff8e769510 R15: 0000000000000000
default_idle_call+0x67/0xa0

do_idle+0x31e/0x3e0

[31/73]
cpu_startup_entry+0x18/0x20
rest_init+0x16d/0x2b0
arch_call_rest_init+0x13/0x30
start_kernel+0x35a/0x4d0
secondary_startup_64_no_verify+0xce/0xdb
</TASK>

The buggy address belongs to the virtual mapping at
[ffffc90003588000, ffffc90003591000) created by:
kernel_clone+0xeb/0x890

The buggy address belongs to the physical page:
page:ffffea0004a0fa00 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x1283e8
flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 8032,
tgid 8032 (syz-executor.1), ts 75313358350, free_ts 0
get_page_from_freelist+0x1190/0x2e20
__alloc_pages+0x1cb/0x4a0
alloc_pages+0x1aa/0x270
__vmalloc_node_range+0xb1c/0x14a0
copy_process+0x1320/0x7590
kernel_clone+0xeb/0x890
__do_sys_clone+0xba/0x100
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page_owner free stack trace missing

Memory state around the buggy address:
ffffc9000358fc80: f3 f3 f3 00 f1 f1 f1 00 00 f2 f2 00 00 00 f3 f3
ffffc9000358fd00: f3 f3 f3 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
>ffffc9000358fd80: f3 f3 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
^
ffffc9000358fe00: f3 f3 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3
ffffc9000358fe80: f3 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3
==================================================================
----------------
Code disassembly (best guess):
0: 89 07 mov %eax,(%rdi)
2: 49 c7 c0 08 00 00 00 mov $0x8,%r8
9: 4d 29 c8 sub %r9,%r8
c: 4c 01 c7 add %r8,%rdi
f: 4c 29 c2 sub %r8,%rdx
12: e9 76 ff ff ff jmpq 0xffffff8d
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: f3 0f 1e fa endbr64
1f: eb 07 jmp 0x28
21: 0f 00 2d 13 38 49 00 verw 0x493813(%rip) # 0x49383b
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: c3 retq
2c: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
33: 00 00 00 00
37: 0f 1f 40 00 nopl 0x0(%rax)
3b: f3 0f 1e fa endbr64
3f: 65 gs

[Thomas Gleixner]

On Sat, Jun 03 2023 at 02:42, Palash Oswal wrote:
> Hello,
> I found the following issue using syzkaller with enriched corpus[1] on:
> HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
> git tree: linux
> C Reproducer : I do not have a C reproducer yet. I will update this
> thread when I get one.
> Kernel .config :
> https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f

That's not really helpful without knowing which compiler version.

> ==================================================================
> BUG: KASAN: stack-out-of-bounds in __remove_hrtimer+0x250/0x2a0

Can you please enable full decoding so it looks like this:

BUG: KASAN: stack-out-of-bounds in i801_isr_byte_done drivers/i2c/busses/i2c-i801.c:546 [inline]
BUG: KASAN: stack-out-of-bounds in i801_isr drivers/i2c/busses/i2c-i801.c:613 [inline]

and the stack trace has the proper line number decoding too.

> Read of size 1 at addr ffffc9000358fdd0 by task swapper/0/0
>
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted
> 6.3.0-rc6-pasta-00035-g0bcc40255504 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
> <IRQ>
> dump_stack_lvl+0xd9/0x150
> print_address_description.constprop.0+0x2c/0x3c0
> kasan_report+0x11c/0x130
> __remove_hrtimer+0x250/0x2a0
> __hrtimer_run_queues+0x4e0/0xbe0
> hrtimer_interrupt+0x320/0x7b0
> __sysvec_apic_timer_interrupt+0x14a/0x430
> sysvec_apic_timer_interrupt+0x92/0xc0
> </IRQ>
> <TASK>
> asm_sysvec_apic_timer_interrupt+0x1a/0x20
> RIP: 0010:default_idle+0xf/0x20
> Code: 89 07 49 c7 c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 76 ff
> ff ff cc cc cc cc f3 0f 1e fa eb 07 0f 00 2d 13 38 49 00 fb f4 <fa> c3
> 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 65

Please don't wrap the output.

Also where is the RIP/Code/Register dump for the faulting context?

This one is the interrupted task context which is completely uninteresting.

> RSP: 0018:ffffffff8c407e30 EFLAGS: 00000202
> RAX: 000000000033b773 RBX: 0000000000000000 RCX: ffffffff89fd3ef5
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: ffffffff8c495800 R08: 0000000000000001 R09: ffff888063a36cab
> R10: ffffed100c746d95 R11: 0000000000000000 R12: fffffbfff1892b00
> R13: 0000000000000000 R14: ffffffff8e769510 R15: 0000000000000000
> default_idle_call+0x67/0xa0
>
> do_idle+0x31e/0x3e0
>
> [31/73]

Interesting output. Can you please reconrd the full console output and
provide a link to it so that we can look at the complete info and not at
something which was trimmed by some tool?

> ----------------
> Code disassembly (best guess):
> 0: 89 07 mov %eax,(%rdi)
> 2: 49 c7 c0 08 00 00 00 mov $0x8,%r8
> 9: 4d 29 c8 sub %r9,%r8
> c: 4c 01 c7 add %r8,%rdi
> f: 4c 29 c2 sub %r8,%rdx
> 12: e9 76 ff ff ff jmpq 0xffffff8d
> 17: cc int3
> 18: cc int3
> 19: cc int3
> 1a: cc int3
> 1b: f3 0f 1e fa endbr64
> 1f: eb 07 jmp 0x28
> 21: 0f 00 2d 13 38 49 00 verw 0x493813(%rip) # 0x49383b
> 28: fb sti
> 29: f4 hlt
> * 2a: fa cli <-- trapping instruction

That's useless because thats the disassembly of idle() which got
interrupted.

Thanks,

tglx