| TITLE: KASAN: stack-out-of-bounds Read in iov_iter_advance |
| |
| [ 81.174109] ================================================================== |
| [ 81.174125] BUG: KASAN: stack-out-of-bounds in iov_iter_advance+0x4c0/0x4f0 at addr ffff8801ca657d38 |
| [ 81.174129] Read of size 8 by task syz-executor5/12434 |
| [ 81.174136] page:ffffea00072995c0 count:0 mapcount:0 mapping: (null) index:0x0 |
| [ 81.174141] flags: 0x200000000000000() |
| [ 81.174144] page dumped because: kasan: bad access detected |
| [ 81.219855] 0000000000000001 ffff8800ba75f830 ffffffff81cac64d 1ffff100174ebf0a |
| [ 81.227938] ffffffff82cae060 dffffc0000000000 ffff8800ba75f8f0 00000000024000c2 |
| [ 81.235928] ffff8800ba75f948 ffffffff81400659 ffff880200000001 0000000000000000 |
| [ 81.243919] Call Trace: |
| [ 81.246487] [<ffffffff81cac64d>] dump_stack+0xc1/0x124 |
| [ 81.251826] [<ffffffff81400659>] warn_alloc_failed+0x1c9/0x240 |
| [ 81.257859] [<ffffffff81400490>] ? zone_watermark_ok_safe+0x2a0/0x2a0 |
| [ 81.264501] [<ffffffff811ef330>] ? debug_check_no_locks_freed+0x2c0/0x2c0 |
| [ 81.271488] [<ffffffff814c373d>] ? alloc_pages_current+0x12d/0x3d0 |
| [ 81.277872] [<ffffffff814aa5cb>] __vmalloc_node_range+0x56b/0x6f0 |
| [ 81.284167] [<ffffffff8145acd6>] ? kmalloc_order_trace+0x86/0x190 |
| [ 81.290633] [<ffffffff814aa820>] vmalloc+0x60/0x70 |
| [ 81.295626] [<ffffffff82434c76>] ? xt_alloc_entry_offsets+0x46/0x60 |
| [ 81.302093] [<ffffffff82434c76>] xt_alloc_entry_offsets+0x46/0x60 |
| [ 81.308386] [<ffffffff82760bbb>] translate_table+0x2fb/0x1b60 |
| [ 81.314333] [<ffffffff814cf498>] ? ___slab_alloc+0x448/0x550 |
| [ 81.320194] [<ffffffff827608c0>] ? arpt_alloc_initial_table+0x6a0/0x6a0 |
| [ 81.327015] [<ffffffff814767b9>] ? __might_fault+0xe9/0x1d0 |
| [ 81.332799] [<ffffffff814767e9>] ? __might_fault+0x119/0x1d0 |
| [ 81.338657] [<ffffffff82764c85>] do_arpt_set_ctl+0x295/0x5b0 |
| [ 81.344517] [<ffffffff827649f0>] ? compat_do_arpt_set_ctl+0x6a0/0x6a0 |
| [ 81.351159] [<ffffffff82a06e90>] ? mutex_trylock+0x1e0/0x1e0 |
| [ 81.357021] [<ffffffff82a077f2>] ? mutex_unlock+0x12/0x20 |
| [ 81.362622] [<ffffffff8239a24c>] ? nf_sockopt_find.constprop.0+0x1ac/0x220 |
| [ 81.369695] [<ffffffff8239a3fc>] nf_setsockopt+0x6c/0xc0 |
| [ 81.375207] [<ffffffff825dda36>] ip_setsockopt+0xa6/0xc0 |
| [ 81.380720] [<ffffffff825fcf47>] tcp_setsockopt+0x87/0xd0 |
| [ 81.386320] [<ffffffff8156c3d6>] ? __fget_light+0xa6/0x1e0 |
| [ 81.392010] [<ffffffff82202fca>] sock_common_setsockopt+0x9a/0xe0 |
| [ 81.399088] [<ffffffff8220027d>] SyS_setsockopt+0x15d/0x240 |
| [ 81.404858] [<ffffffff82200120>] ? SyS_recv+0x40/0x40 |
| [ 81.410109] [<ffffffff8156c4d0>] ? __fget_light+0x1a0/0x1e0 |
| [ 81.415885] [<ffffffff81002284>] ? lockdep_sys_exit_thunk+0x12/0x14 |
| [ 81.422439] [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94 |
| [ 81.428999] CPU: 0 PID: 12434 Comm: syz-executor5 Not tainted 4.4.114+ #249 |
| [ 81.429116] Mem-Info: |
| [ 81.429135] active_anon:49698 inactive_anon:20 isolated_anon:0 |
| [ 81.429135] active_file:3605 inactive_file:7475 isolated_file:0 |
| [ 81.429135] unevictable:0 dirty:102 writeback:0 unstable:0 |
| [ 81.429135] slab_reclaimable:4964 slab_unreclaimable:8278 |
| [ 81.429135] mapped:24075 shmem:26 pagetables:676 bounce:0 |
| [ 81.429135] free:1551197 free_pcp:519 free_cma:0 |
| [ 81.429161] Node 0 DMA free:15904kB min:324kB low:404kB high:484kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15992kB managed:15904kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes |
| [ 81.429169] lowmem_reserve[]: 0 2936 6453 6453 |
| [ 81.429195] Node 0 DMA32 free:2821564kB min:61364kB low:76704kB high:92044kB active_anon:107768kB inactive_anon:12kB active_file:7108kB inactive_file:10020kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3129292kB managed:3012004kB mlocked:0kB dirty:172kB writeback:0kB mapped:34476kB shmem:24kB slab_reclaimable:4712kB slab_unreclaimable:13276kB kernel_stack:1792kB pagetables:1040kB unstable:0kB bounce:0kB free_pcp:840kB local_pcp:300kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no |
| [ 81.429203] lowmem_reserve[]: 0 0 3516 3516 |
| [ 81.429228] Node 0 Normal free:3367320kB min:73476kB low:91844kB high:110212kB active_anon:91024kB inactive_anon:68kB active_file:7312kB inactive_file:19880kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3601032kB mlocked:0kB dirty:236kB writeback:0kB mapped:61824kB shmem:80kB slab_reclaimable:15144kB slab_unreclaimable:19836kB kernel_stack:3008kB pagetables:1664kB unstable:0kB bounce:0kB free_pcp:1236kB local_pcp:644kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no |
| [ 81.429235] lowmem_reserve[]: 0 0 0 0 |
| [ 81.429270] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB |
| [ 81.429310] Node 0 DMA32: 85*4kB (UM) 170*8kB (UME) 203*16kB (UME) 179*32kB (UM) 148*64kB (UM) 70*128kB (UME) 12*256kB (UME) 8*512kB (UM) 4*1024kB (UME) 2*2048kB (ME) 678*4096kB (UM) = 2821556kB |
| [ 81.429351] Node 0 Normal: 164*4kB (UM) 243*8kB (UME) 152*16kB (UME) 132*32kB (UM) 137*64kB (UME) 88*128kB (UME) 13*256kB (UM) 5*512kB (UM) 4*1024kB (UME) 5*2048kB (UME) 810*4096kB (M) = 3367272kB |
| [ 81.429353] 11105 total pagecache pages |
| [ 81.429356] 0 pages in swap cache |
| [ 81.429360] Swap cache stats: add 0, delete 0, find 0/0 |
| [ 81.429362] Free swap = 0kB |
| [ 81.429364] Total swap = 0kB |
| [ 81.429366] 1965969 pages RAM |
| [ 81.429367] 0 pages HighMem/MovableOnly |
| [ 81.429369] 308734 pages reserved |
| [ 81.499041] vmalloc: allocation failure: 17178820608 bytes |
| [ 81.499047] syz-executor7: page allocation failure: order:0, mode:0x24000c2 |
| [ 81.709227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 81.718558] 0000000000000000 ffff8801ca6579e0 ffffffff81cac64d ffffed00394cafa7 |
| [ 81.726560] ffffed00394cafa7 0000000000000008 0000000000000000 ffff8801ca657d38 |
| [ 81.734551] ffff8801ca657a68 ffffffff814d588d ffff8801ccdc4680 0000000000000001 |
| [ 81.742557] Call Trace: |
| [ 81.745128] [<ffffffff81cac64d>] dump_stack+0xc1/0x124 |
| [ 81.750475] [<ffffffff814d588d>] kasan_report.part.2+0x44d/0x540 |
| [ 81.756691] [<ffffffff81ce6f10>] ? iov_iter_advance+0x4c0/0x4f0 |
| [ 81.762818] [<ffffffff81476863>] ? __might_fault+0x193/0x1d0 |
| [ 81.768680] [<ffffffff814d5a3e>] __asan_report_load8_noabort+0x2e/0x30 |
| [ 81.775414] [<ffffffff81ce6f10>] iov_iter_advance+0x4c0/0x4f0 |
| [ 81.781363] [<ffffffff820882d3>] tun_get_user+0x2e3/0x2370 |
| [ 81.787053] [<ffffffff82087ff0>] ? tun_net_xmit+0x1110/0x1110 |
| [ 81.793005] [<ffffffff811e8241>] ? __lock_is_held+0xa1/0xf0 |
| [ 81.798779] [<ffffffff82082e81>] ? __tun_get+0x131/0x240 |
| [ 81.804292] [<ffffffff8208a57a>] tun_chr_write_iter+0xda/0x190 |
| [ 81.810328] [<ffffffff815103fe>] __vfs_write+0x32e/0x440 |
| [ 81.815846] [<ffffffff815100d0>] ? __vfs_read+0x420/0x420 |
| [ 81.821454] [<ffffffff81b70667>] ? apparmor_file_permission+0x27/0x30 |
| [ 81.828098] [<ffffffff815118c5>] ? rw_verify_area+0x105/0x2f0 |
| [ 81.834046] [<ffffffff81511fdf>] vfs_write+0x18f/0x530 |
| [ 81.839386] [<ffffffff815146b9>] SyS_write+0xd9/0x1b0 |
| [ 81.844647] [<ffffffff815145e0>] ? SyS_read+0x1b0/0x1b0 |
| [ 81.850078] [<ffffffff81002284>] ? lockdep_sys_exit_thunk+0x12/0x14 |
| [ 81.856550] [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94 |
| [ 81.863104] Memory state around the buggy address: |
| [ 81.863111] CPU: 1 PID: 12430 Comm: syz-executor7 Not tainted 4.4.114+ #249 |
| [ 81.863118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 81.863127] 0000000000000001 ffff8800ba75f830 ffffffff81cac64d 1ffff100174ebf0a |
| [ 81.863135] ffffffff82cae060 dffffc0000000000 ffff8800ba75f8f0 00000000024000c2 |
| [ 81.863143] ffff8800ba75f948 ffffffff81400659 ffff880200000001 0000000000000000 |
| [ 81.863144] Call Trace: |
| [ 81.863153] [<ffffffff81cac64d>] dump_stack+0xc1/0x124 |
| [ 81.863161] [<ffffffff81400659>] warn_alloc_failed+0x1c9/0x240 |
| [ 81.863168] [<ffffffff81400490>] ? zone_watermark_ok_safe+0x2a0/0x2a0 |
| [ 81.863176] [<ffffffff811e8480>] ? SOFTIRQ_verbose+0x10/0x10 |
| [ 81.863185] [<ffffffff811ef330>] ? debug_check_no_locks_freed+0x2c0/0x2c0 |
| [ 81.863192] [<ffffffff814c373d>] ? alloc_pages_current+0x12d/0x3d0 |
| [ 81.863201] [<ffffffff814aa5cb>] __vmalloc_node_range+0x56b/0x6f0 |
| [ 81.863208] [<ffffffff8145acd6>] ? kmalloc_order_trace+0x86/0x190 |
| [ 81.863215] [<ffffffff814aa820>] vmalloc+0x60/0x70 |
| [ 81.863224] [<ffffffff82434c76>] ? xt_alloc_entry_offsets+0x46/0x60 |
| [ 81.863230] [<ffffffff82434c76>] xt_alloc_entry_offsets+0x46/0x60 |
| [ 81.863238] [<ffffffff82760bbb>] translate_table+0x2fb/0x1b60 |
| [ 81.863246] [<ffffffff811e8480>] ? SOFTIRQ_verbose+0x10/0x10 |
| [ 81.863254] [<ffffffff814cf498>] ? ___slab_alloc+0x448/0x550 |
| [ 81.863261] [<ffffffff827608c0>] ? arpt_alloc_initial_table+0x6a0/0x6a0 |
| [ 81.863270] [<ffffffff814767b9>] ? __might_fault+0xe9/0x1d0 |
| [ 81.863278] [<ffffffff814767e9>] ? __might_fault+0x119/0x1d0 |
| [ 81.863286] [<ffffffff82764c85>] do_arpt_set_ctl+0x295/0x5b0 |
| [ 81.863293] [<ffffffff827649f0>] ? compat_do_arpt_set_ctl+0x6a0/0x6a0 |
| [ 81.863300] [<ffffffff82a06e90>] ? mutex_trylock+0x1e0/0x1e0 |
| [ 81.863307] [<ffffffff82a077f2>] ? mutex_unlock+0x12/0x20 |
| [ 81.863316] [<ffffffff8239a24c>] ? nf_sockopt_find.constprop.0+0x1ac/0x220 |
| [ 81.863322] [<ffffffff8239a3fc>] nf_setsockopt+0x6c/0xc0 |
| [ 81.863330] [<ffffffff825dda36>] ip_setsockopt+0xa6/0xc0 |
| [ 81.863337] [<ffffffff825fcf47>] tcp_setsockopt+0x87/0xd0 |
| [ 81.863345] [<ffffffff8156c3d6>] ? __fget_light+0xa6/0x1e0 |
| [ 81.863354] [<ffffffff82202fca>] sock_common_setsockopt+0x9a/0xe0 |
| [ 81.863361] [<ffffffff8220027d>] SyS_setsockopt+0x15d/0x240 |
| [ 81.863368] [<ffffffff82200120>] ? SyS_recv+0x40/0x40 |
| [ 81.863377] [<ffffffff81002284>] ? lockdep_sys_exit_thunk+0x12/0x14 |
| [ 81.863385] [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94 |
| [ 81.863388] Mem-Info: |
| [ 81.863406] active_anon:49673 inactive_anon:45 isolated_anon:0 |
| [ 81.863406] active_file:3605 inactive_file:7475 isolated_file:0 |
| [ 81.863406] unevictable:0 dirty:102 writeback:0 unstable:0 |
| [ 81.863406] slab_reclaimable:4964 slab_unreclaimable:8304 |
| [ 81.863406] mapped:24149 shmem:63 pagetables:639 bounce:0 |
| [ 81.863406] free:1551167 free_pcp:489 free_cma:0 |
| [ 81.863432] Node 0 DMA free:15904kB min:324kB low:404kB high:484kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15992kB managed:15904kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes |
| [ 81.863439] lowmem_reserve[]: 0 2936 6453 6453 |
| [ 81.863465] Node 0 DMA32 free:2821768kB min:61364kB low:76704kB high:92044kB active_anon:107568kB inactive_anon:12kB active_file:7108kB inactive_file:10020kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3129292kB managed:3012004kB mlocked:0kB dirty:172kB writeback:0kB mapped:34624kB shmem:24kB slab_reclaimable:4712kB slab_unreclaimable:13276kB kernel_stack:1792kB pagetables:892kB unstable:0kB bounce:0kB free_pcp:1204kB local_pcp:664kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no |
| [ 81.863473] lowmem_reserve[]: 0 0 3516 3516 |
| [ 81.863498] Node 0 Normal free:3366996kB min:73476kB low:91844kB high:110212kB active_anon:91124kB inactive_anon:168kB active_file:7312kB inactive_file:19880kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3601032kB mlocked:0kB dirty:236kB writeback:0kB mapped:61972kB shmem:228kB slab_reclaimable:15144kB slab_unreclaimable:19940kB kernel_stack:3008kB pagetables:1664kB unstable:0kB bounce:0kB free_pcp:752kB local_pcp:160kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no |
| [ 81.863505] lowmem_reserve[]: 0 0 0 0 |
| [ 81.863541] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (U) 3*4096kB (M) = 15904kB |
| [ 81.863581] Node 0 DMA32: 102*4kB (UM) 178*8kB (UME) 202*16kB (UME) 182*32kB (UM) 148*64kB (UM) 70*128kB (UME) 12*256kB (UME) 8*512kB (UM) 4*1024kB (UME) 2*2048kB (ME) 678*4096kB (UM) = 2821768kB |
| [ 81.863620] Node 0 Normal: 181*4kB (UM) 241*8kB (UME) 153*16kB (UME) 122*32kB (M) 137*64kB (UME) 87*128kB (UME) 13*256kB (UM) 5*512kB (UM) 4*1024kB (UME) 5*2048kB (UME) 810*4096kB (M) = 3366892kB |
| [ 81.863623] 11142 total pagecache pages |
| [ 81.863625] 0 pages in swap cache |
| [ 81.863629] Swap cache stats: add 0, delete 0, find 0/0 |
| [ 81.863631] Free swap = 0kB |
| [ 81.863633] Total swap = 0kB |
| [ 81.863635] 1965969 pages RAM |
| [ 81.863637] 0 pages HighMem/MovableOnly |
| [ 81.863639] 308734 pages reserved |
| [ 82.356238] ffff8801ca657c00: f2 f2 f2 00 00 00 00 00 f2 f2 f2 f3 f3 f3 f3 00 |
| [ 82.363566] ffff8801ca657c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| [ 82.370894] >ffff8801ca657d00: f1 f1 f1 f1 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 |
| [ 82.378222] ^ |
| [ 82.383382] ffff8801ca657d80: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 |
| [ 82.390710] ffff8801ca657e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 |
| [ 82.398044] ================================================================== |
