Re: [syzbot] [bpf?] UBSAN: array-index-out-of-bounds in check_stack_range_initialized
From: syzbot
Date: Fri Mar 22 2024 - 06:42:19 EST
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
ly
[ 13.243082][ T1] X25: Linux Version 0.2
[ 13.292064][ T1] NET: Registered PF_NETROM protocol family
[ 13.343313][ T1] NET: Registered PF_ROSE protocol family
[ 13.349296][ T1] NET: Registered PF_AX25 protocol family
[ 13.355995][ T1] can: controller area network core
[ 13.361609][ T1] NET: Registered PF_CAN protocol family
[ 13.367325][ T1] can: raw protocol
[ 13.371880][ T1] can: broadcast manager protocol
[ 13.376970][ T1] can: netlink gateway - max_hops=1
[ 13.382696][ T1] can: SAE J1939
[ 13.386246][ T1] can: isotp protocol (max_pdu_size 8300)
[ 13.392393][ T1] Bluetooth: RFCOMM TTY layer initialized
[ 13.398148][ T1] Bluetooth: RFCOMM socket layer initialized
[ 13.405038][ T1] Bluetooth: RFCOMM ver 1.11
[ 13.409743][ T1] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 13.415895][ T1] Bluetooth: BNEP filters: protocol multicast
[ 13.422062][ T1] Bluetooth: BNEP socket layer initialized
[ 13.427913][ T1] Bluetooth: CMTP (CAPI Emulation) ver 1.0
[ 13.433798][ T1] Bluetooth: CMTP socket layer initialized
[ 13.439683][ T1] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[ 13.446589][ T1] Bluetooth: HIDP socket layer initialized
[ 13.455663][ T1] NET: Registered PF_RXRPC protocol family
[ 13.461694][ T1] Key type rxrpc registered
[ 13.466180][ T1] Key type rxrpc_s registered
[ 13.471908][ T1] NET: Registered PF_KCM protocol family
[ 13.478501][ T1] lec:lane_module_init: lec.c: initialized
[ 13.484387][ T1] mpoa:atm_mpoa_init: mpc.c: initialized
[ 13.490222][ T1] l2tp_core: L2TP core driver, V2.0
[ 13.495433][ T1] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 13.501085][ T1] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 13.507588][ T1] l2tp_netlink: L2TP netlink interface
[ 13.513727][ T1] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 13.520521][ T1] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 13.528163][ T1] NET: Registered PF_PHONET protocol family
[ 13.534342][ T1] 8021q: 802.1Q VLAN Support v1.8
[ 13.553054][ T1] DCCP: Activated CCID 2 (TCP-like)
[ 13.558374][ T1] DCCP: Activated CCID 3 (TCP-Friendly Rate Control)
[ 13.565874][ T1] DCCP is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 13.577035][ T1] sctp: Hash tables configured (bind 32/56)
[ 13.584677][ T1] NET: Registered PF_RDS protocol family
[ 13.591398][ T1] Registered RDS/infiniband transport
[ 13.597871][ T1] Registered RDS/tcp transport
[ 13.602694][ T1] tipc: Activated (version 2.0.0)
[ 13.608498][ T1] NET: Registered PF_TIPC protocol family
[ 13.615258][ T1] tipc: Started in single node mode
[ 13.621255][ T1] NET: Registered PF_SMC protocol family
[ 13.627139][ T1] 9pnet: Installing 9P2000 support
[ 13.633262][ T1] NET: Registered PF_CAIF protocol family
[ 13.643520][ T1] NET: Registered PF_IEEE802154 protocol family
[ 13.650024][ T1] Key type dns_resolver registered
[ 13.655322][ T1] Key type ceph registered
[ 13.660315][ T1] libceph: loaded (mon/osd proto 15/24)
[ 13.667023][ T1] batman_adv: B.A.T.M.A.N. advanced 2024.1 (compatibility version 15) loaded
[ 13.676163][ T1] openvswitch: Open vSwitch switching datapath
[ 13.685504][ T1] NET: Registered PF_VSOCK protocol family
[ 13.692734][ T1] mpls_gso: MPLS GSO support
[ 13.713085][ T1] IPI shorthand broadcast: enabled
[ 13.718324][ T1] AVX2 version of gcm_enc/dec engaged.
[ 13.724817][ T1] AES CTR mode by8 optimization enabled
[ 15.093071][ T1] sched_clock: Marking stable (15050030128, 39570184)->(15098082991, -8482679)
[ 15.103483][ T1] Timer migration: 1 hierarchy levels; 8 children per group; 0 crossnode level
[ 15.113749][ T1] registered taskstats version 1
[ 15.123705][ T1] meta:ffffc90000066170, maptr:0000000000000000, check_helper_call
[ 15.132660][ T1] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
[ 15.144894][ T1] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
[ 15.153438][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-syzkaller-05232-gddb2ffdc474a-dirty #0
[ 15.163497][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[ 15.173648][ T1] RIP: 0010:check_helper_call+0x14ec/0x7620
[ 15.179554][ T1] Code: 8d bc 24 70 01 00 00 e8 62 f7 4c 00 4c 8b a4 24 70 01 00 00 49 8d 7c 24 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 67 17 00 00 41 8b 5c 24 1c 49 8d 7c 24 20
[ 15.199330][ T1] RSP: 0000:ffffc90000066000 EFLAGS: 00010207
[ 15.205657][ T1] RAX: 0000000000000003 RBX: 0000000000008004 RCX: dffffc0000000000
[ 15.213721][ T1] RDX: ffff8880162d0000 RSI: 0000000000008004 RDI: 000000000000001c
[ 15.221695][ T1] RBP: ffffc90000066250 R08: ffffffff81ab43c7 R09: 1ffff9200000cb54
[ 15.229826][ T1] R10: dffffc0000000000 R11: fffff5200000cb55 R12: 0000000000000000
[ 15.238066][ T1] R13: 0000000000000001 R14: ffff88802e208000 R15: 0000000000008004
[ 15.246307][ T1] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
[ 15.255391][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 15.261971][ T1] CR2: ffff88823ffff000 CR3: 000000000df32000 CR4: 00000000003506f0
[ 15.269930][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 15.277901][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 15.285863][ T1] Call Trace:
[ 15.289137][ T1] <TASK>
[ 15.292167][ T1] ? __die_body+0x88/0xe0
[ 15.296480][ T1] ? die_addr+0x108/0x140
[ 15.300794][ T1] ? exc_general_protection+0x3dd/0x5d0
[ 15.306433][ T1] ? asm_exc_general_protection+0x26/0x30
[ 15.312151][ T1] ? check_helper_call+0x13d7/0x7620
[ 15.317696][ T1] ? check_helper_call+0x14ec/0x7620
[ 15.323087][ T1] ? __pfx_check_helper_call+0x10/0x10
[ 15.328743][ T1] ? tnum_const+0xd/0x20
[ 15.333063][ T1] do_check+0x9e29/0x10530
[ 15.337512][ T1] ? kmalloc_trace+0x1d9/0x360
[ 15.342265][ T1] ? do_check_common+0x190/0x1dd0
[ 15.347908][ T1] ? bpf_check+0x136ab/0x19010
[ 15.352746][ T1] ? kernel_init+0x1d/0x2a0
[ 15.357416][ T1] ? ret_from_fork+0x4b/0x80
[ 15.362091][ T1] ? __pfx_do_check+0x10/0x10
[ 15.366750][ T1] ? mark_reg_not_init+0xd4/0x4b0
[ 15.372015][ T1] ? __asan_memcpy+0x40/0x70
[ 15.376588][ T1] ? mark_reg_not_init+0xd4/0x4b0
[ 15.381594][ T1] do_check_common+0x14bd/0x1dd0
[ 15.386655][ T1] bpf_check+0x136ab/0x19010
[ 15.391261][ T1] ? __pfx_validate_chain+0x10/0x10
[ 15.396455][ T1] ? validate_chain+0x11b/0x58e0
[ 15.401383][ T1] ? validate_chain+0x11b/0x58e0
[ 15.406524][ T1] ? validate_chain+0x11b/0x58e0
[ 15.411641][ T1] ? validate_chain+0x11b/0x58e0
[ 15.416565][ T1] ? __pfx_bpf_check+0x10/0x10
[ 15.421319][ T1] ? __pfx_validate_chain+0x10/0x10
[ 15.426499][ T1] ? mark_lock+0x9a/0x350
[ 15.430811][ T1] ? mark_lock+0x9a/0x350
[ 15.435122][ T1] ? __lock_acquire+0x1346/0x1fd0
[ 15.440128][ T1] ? mark_lock+0x9a/0x350
[ 15.444451][ T1] ? __lock_acquire+0x1346/0x1fd0
[ 15.449546][ T1] ? mark_lock+0x9a/0x350
[ 15.453880][ T1] ? __lock_acquire+0x1346/0x1fd0
[ 15.458925][ T1] ? __pfx_lock_acquire+0x10/0x10
[ 15.463951][ T1] ? ktime_get_with_offset+0x105/0x330
[ 15.469575][ T1] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 15.476306][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 15.482659][ T1] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 15.488838][ T1] ? ktime_get_with_offset+0x105/0x330
[ 15.494460][ T1] ? seqcount_lockdep_reader_access+0x157/0x220
[ 15.500687][ T1] ? lockdep_hardirqs_on+0x99/0x150
[ 15.505871][ T1] ? seqcount_lockdep_reader_access+0x1d7/0x220
[ 15.512096][ T1] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10
[ 15.518670][ T1] ? pcpu_alloc+0xf1a/0x1670
[ 15.523350][ T1] ? bpf_obj_name_cpy+0x18a/0x1d0
[ 15.528458][ T1] ? bpf_lsm_bpf_prog_load+0x9/0x10
[ 15.533651][ T1] ? security_bpf_prog_load+0x87/0xb0
[ 15.539207][ T1] bpf_prog_load+0x1667/0x20f0
[ 15.544077][ T1] ? __pfx_bpf_prog_load+0x10/0x10
[ 15.549174][ T1] ? kasan_quarantine_put+0xdc/0x230
[ 15.554552][ T1] ? map_update_elem+0x363/0x6f0
[ 15.559475][ T1] ? copy_from_kernel_nofault_allowed+0xa9/0x130
[ 15.565786][ T1] ? bpf_lsm_bpf+0x9/0x10
[ 15.570102][ T1] ? security_bpf+0x87/0xb0
[ 15.574700][ T1] __sys_bpf+0x4ee/0x810
[ 15.579189][ T1] ? __pfx___sys_bpf+0x10/0x10
[ 15.584016][ T1] kern_sys_bpf+0x185/0x6b0
[ 15.588592][ T1] ? __pfx_kern_sys_bpf+0x10/0x10
[ 15.593801][ T1] ? load+0xf4/0xfd0
[ 15.597854][ T1] ? kmalloc_trace+0x1d9/0x360
[ 15.602706][ T1] ? load+0x40e/0xfd0
[ 15.606676][ T1] load+0x550/0xfd0
[ 15.610560][ T1] ? __pfx_load+0x10/0x10
[ 15.615004][ T1] ? kasan_save_track+0x51/0x80
[ 15.619962][ T1] ? kasan_save_track+0x3f/0x80
[ 15.624889][ T1] ? __kasan_kmalloc+0x98/0xb0
[ 15.629899][ T1] ? __kmalloc_node+0x251/0x4e0
[ 15.634736][ T1] ? alloc_bulk+0x472/0x6f0
[ 15.639225][ T1] ? bpf_mem_alloc_init+0x47d/0xc50
[ 15.644423][ T1] ? cpumask_kfunc_init+0x98/0x150
[ 15.649710][ T1] ? do_one_initcall+0x238/0x830
[ 15.654739][ T1] ? do_initcall_level+0x157/0x210
[ 15.659948][ T1] ? do_initcalls+0x3f/0x80
[ 15.664643][ T1] ? kernel_init_freeable+0x435/0x5d0
[ 15.670263][ T1] ? kernel_init+0x1d/0x2a0
[ 15.674937][ T1] ? ret_from_fork+0x4b/0x80
[ 15.684622][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 15.689876][ T1] ? mark_lock+0x9a/0x350
[ 15.694286][ T1] ? __lock_acquire+0x1346/0x1fd0
[ 15.699402][ T1] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 15.705953][ T1] ? lockdep_hardirqs_on+0x99/0x150
[ 15.711328][ T1] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 15.717218][ T1] ? __pfx_add_device_randomness+0x10/0x10
[ 15.723251][ T1] ? __pfx_load+0x10/0x10
[ 15.727637][ T1] do_one_initcall+0x238/0x830
[ 15.732504][ T1] ? __pfx_load+0x10/0x10
[ 15.736814][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 15.743306][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 15.748700][ T1] ? __pfx_parse_args+0x10/0x10
[ 15.753887][ T1] ? do_initcalls+0x1c/0x80
[ 15.758588][ T1] ? rcu_is_watching+0x15/0xb0
[ 15.763350][ T1] do_initcall_level+0x157/0x210
[ 15.768389][ T1] do_initcalls+0x3f/0x80
[ 15.772732][ T1] kernel_init_freeable+0x435/0x5d0
[ 15.777955][ T1] ? __pfx_kernel_init_freeable+0x10/0x10
[ 15.783663][ T1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 15.789977][ T1] ? __pfx_kernel_init+0x10/0x10
[ 15.794990][ T1] ? __pfx_kernel_init+0x10/0x10
[ 15.800002][ T1] ? __pfx_kernel_init+0x10/0x10
[ 15.804935][ T1] kernel_init+0x1d/0x2a0
[ 15.809370][ T1] ret_from_fork+0x4b/0x80
[ 15.813832][ T1] ? __pfx_kernel_init+0x10/0x10
[ 15.818780][ T1] ret_from_fork_asm+0x1a/0x30
[ 15.823558][ T1] </TASK>
[ 15.826588][ T1] Modules linked in:
[ 15.830703][ T1] ---[ end trace 0000000000000000 ]---
[ 15.836626][ T1] RIP: 0010:check_helper_call+0x14ec/0x7620
[ 15.843209][ T1] Code: 8d bc 24 70 01 00 00 e8 62 f7 4c 00 4c 8b a4 24 70 01 00 00 49 8d 7c 24 1c 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 67 17 00 00 41 8b 5c 24 1c 49 8d 7c 24 20
[ 15.863225][ T1] RSP: 0000:ffffc90000066000 EFLAGS: 00010207
[ 15.869311][ T1] RAX: 0000000000000003 RBX: 0000000000008004 RCX: dffffc0000000000
[ 15.877516][ T1] RDX: ffff8880162d0000 RSI: 0000000000008004 RDI: 000000000000001c
[ 15.885761][ T1] RBP: ffffc90000066250 R08: ffffffff81ab43c7 R09: 1ffff9200000cb54
[ 15.893940][ T1] R10: dffffc0000000000 R11: fffff5200000cb55 R12: 0000000000000000
[ 15.902193][ T1] R13: 0000000000000001 R14: ffff88802e208000 R15: 0000000000008004
[ 15.910257][ T1] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
[ 15.919196][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 15.925873][ T1] CR2: 0000000000000000 CR3: 000000000df32000 CR4: 00000000003506f0
[ 15.933923][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 15.942979][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 15.951017][ T1] Kernel panic - not syncing: Fatal exception
[ 15.957777][ T1] Kernel Offset: disabled
[ 15.962097][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3260162229=/tmp/go-build -gno-record-gcc-switches'
git status (err=<nil>)
HEAD detached at baa80228d
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=baa80228d652d8b1341ecf7f1411c4e4caf75bd5 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240318-105857'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"baa80228d652d8b1341ecf7f1411c4e4caf75bd5\"
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=13b0b5c9180000
Tested on:
commit: ddb2ffdc libbpf: Define MFD_CLOEXEC if not available
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440
dashboard link: https://syzkaller.appspot.com/bug?extid=33f4297b5f927648741a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1702b481180000