Re: perf: invalid memory access in perf_swevent_del
From: Sasha Levin
Date: Fri Jul 25 2014 - 22:35:11 EST
On 05/10/2014 07:34 PM, Sasha Levin wrote:
> Hi all,
>
> While fuzzing with trinity inside a KVM tools guest running the latest -next
> kernel I've stumbled on the following spew:
Ping? I'm still seeing corruption on perf_swevent_del and perf_swevent_init:
[ 488.092839] AddressSanitizer: use after free in perf_swevent_del+0x33/0x70 at addr ffff8805f430ea48
[ 488.094444] page:ffffea0017d0c380 count:0 mapcount:0 mapping: (null) index:0x0
[ 488.095681] page flags: 0x6fffff80008000(tail)
[ 488.096407] page dumped because: kasan error
[ 488.097116] CPU: 17 PID: 9306 Comm: trinity-main Not tainted 3.16.0-rc6-next-20140725-sasha-00048-ga713fc0-dirty #937
[ 488.098736] 00000000000000fb 0000000000000000 ffffea0017d0c380 ffff8805f444b740
[ 488.099933] ffffffffb6dc96f3 ffff8805f444b810 ffff8805f444b800 ffffffffb242d17c
[ 488.100020] ffff880be215f448 ffff880be215f45d ffff8805ff7e2dc0 ffff8805ff7e2dd0
[ 488.100020] Call Trace:
[ 488.100020] dump_stack (lib/dump_stack.c:52)
[ 488.100020] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
[ 488.100020] ? kvm_clock_read (./arch/x86/include/asm/preempt.h:90 arch/x86/kernel/kvmclock.c:86)
[ 488.100020] ? sched_clock (./arch/x86/include/asm/paravirt.h:192 arch/x86/kernel/tsc.c:304)
[ 488.100020] ? sched_clock_local (kernel/sched/clock.c:214)
[ 488.100020] __asan_store8 (mm/kasan/kasan.c:400)
[ 488.100020] ? perf_swevent_del (include/linux/list.h:618 include/linux/rculist.h:345 kernel/events/core.c:5758)
[ 488.100020] perf_swevent_del (include/linux/list.h:618 include/linux/rculist.h:345 kernel/events/core.c:5758)
[ 488.100020] event_sched_out.isra.49 (kernel/events/core.c:1416)
[ 488.100020] group_sched_out (kernel/events/core.c:1442)
[ 488.100020] ctx_sched_out (kernel/events/core.c:2185 (discriminator 3))
[ 488.100020] __perf_event_task_sched_out (kernel/events/core.c:2360 kernel/events/core.c:2385)
[ 488.100020] ? __perf_event_task_sched_out (include/linux/rcupdate.h:806 kernel/events/core.c:2314 kernel/events/core.c:2385)
[ 488.100020] ? update_stats_wait_end (kernel/sched/fair.c:760)
[ 488.100020] perf_event_task_sched_out (include/linux/perf_event.h:702)
[ 488.100020] ? __schedule (kernel/sched/core.c:2773)
[ 488.100020] ? __schedule (kernel/sched/core.c:2773)
[ 488.100020] __schedule (kernel/sched/core.c:2146 kernel/sched/core.c:2184 kernel/sched/core.c:2308 kernel/sched/core.c:2810)
[ 488.100020] preempt_schedule_irq (./arch/x86/include/asm/paravirt.h:814 kernel/sched/core.c:2927)
[ 488.100020] retint_kernel (arch/x86/kernel/entry_64.S:935)
[ 488.100020] ? __asan_load4 (mm/kasan/kasan.c:358)
[ 488.100020] ? debug_lockdep_rcu_enabled (kernel/rcu/update.c:134)
[ 488.100020] __fget_light (include/linux/fdtable.h:77 fs/file.c:684)
[ 488.100020] __fdget_raw (fs/file.c:704)
[ 488.100020] path_init (include/linux/file.h:60 fs/namei.c:1873)
[ 488.100020] ? path_lookupat (fs/namei.c:1937)
[ 488.100020] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
[ 488.100020] path_lookupat (fs/namei.c:1937)
[ 488.100020] ? poison_shadow (mm/kasan/kasan.c:76)
[ 488.100020] ? unpoison_shadow (mm/kasan/kasan.c:82)
[ 488.100020] ? kasan_slab_alloc (mm/kasan/kasan.c:206)
[ 488.100020] ? strncpy_from_user (./arch/x86/include/asm/word-at-a-time.h:48 lib/strncpy_from_user.c:44 lib/strncpy_from_user.c:109)
[ 488.100020] filename_lookup (fs/namei.c:1984)
[ 488.100020] user_path_at_empty (fs/namei.c:2135)
[ 488.100020] ? check_chain_key (kernel/locking/lockdep.c:2188)
[ 488.100020] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[ 488.100020] ? get_parent_ip (kernel/sched/core.c:2561)
[ 488.100020] user_path_at (fs/namei.c:2146)
[ 488.100020] vfs_fstatat (fs/stat.c:107)
[ 488.100020] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
[ 488.100020] SYSC_newfstatat (fs/stat.c:298)
[ 488.100020] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1500 (discriminator 2))
[ 488.100020] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2600)
[ 488.100020] ? tracesys (arch/x86/kernel/entry_64.S:530)
[ 488.100020] SyS_newfstatat (fs/stat.c:291)
[ 488.100020] tracesys (arch/x86/kernel/entry_64.S:541)
[ 488.100020] Write of size 8 by thread T9306:
[ 488.100020] Memory state around the buggy address:
[ 488.100020] ffff8805f430e780: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430e800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430e980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] >ffff8805f430ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ^
[ 488.100020] ffff8805f430ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430eb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 488.100020] ffff8805f430ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 517.616094] =============================================================================
[ 517.619549] BUG kmalloc-4096 (Not tainted): Poison overwritten
[ 517.621321] -----------------------------------------------------------------------------
[ 517.621321]
[ 517.621321] Disabling lock debugging due to kernel taint
[ 517.621321] INFO: 0xffff8805f430ea48-0xffff8805f430eb77. First byte 0x0 instead of 0x6b
[ 517.621321] INFO: Allocated in perf_swevent_init+0x29f/0x440 age=14082 cpu=17 pid=9306
[ 517.621321] __slab_alloc+0x65e/0x740
[ 517.621321] kmem_cache_alloc_trace+0x17c/0x3a0
[ 517.621321] perf_swevent_init+0x29f/0x440
[ 517.621321] perf_init_event+0x293/0x340
[ 517.621321] perf_event_alloc+0x5b8/0x6e0
[ 517.621321] SYSC_perf_event_open+0x39b/0xf50
[ 517.621321] SyS_perf_event_open+0x9/0x10
[ 517.621321] tracesys+0xe1/0xe6
[ 517.621321] INFO: Freed in rcu_nocb_kthread+0x911/0x13f0 age=2958 cpu=3 pid=25
[ 517.621321] __slab_free+0x276/0x3e0
[ 517.621321] kfree+0x31a/0x390
[ 517.621321] rcu_nocb_kthread+0x911/0x13f0
[ 517.621321] kthread+0x144/0x170
[ 517.621321] ret_from_fork+0x7c/0xb0
[ 517.621321] INFO: Slab 0xffffea0017d0c200 objects=7 used=7 fp=0x (null) flags=0x6fffff80004080
[ 517.621321] INFO: Object 0xffff8805f430e7b0 @offset=26544 fp=0xffff8805f4308000
[...]
Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/