Syzkaller hit 'WARNING in ftrace_verify_code' bug.
This bug is not a vulnerability and is reproduced only when running
with root privileges on stable 5.10 kernel.
journalctl -k (v5.10.206):
..
bpfilter: Loaded bpfilter_umh pid 2732
Started bpfilter
------------[ cut here ]------------
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4107 at arch/x86/kernel/ftrace.c:97 ftrace_verify_code+0x3e/0x80
WARNING: CPU: 1 PID: 4107 at arch/x86/kernel/ftrace.c:97 ftrace_verify_code+0x3e/0x80
Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter bridge stp llc qrtr bnep hid_generic usbhid uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common btusb btrtl btbcm btintel videodev bluetooth mc ecdh_generic ecc nls_utf8 nls_cp866 vfat fat coretemp hwmon x86_pkg_temp_thermal intel_powerclamp mei_hdcp kvm_intel kvm rtsx_pci_sdmmc mmc_core irqbypass crct10dif_pclmul wmi_bmof crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd xhci_pci mei_me ucsi_acpi ideapad_laptop cryptd xhci_pci_renesas glue_helper pcspkr typec_ucsi tiny_power_button rtsx_pci sparse_keymap xhci_hcd mei thermal typec wmi i2c_hid button fan rfkill hid acpi_pad intel_pmc_core battery video ac sch_fq_codel vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) vboxvideo
Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter bridge stp llc qrtr bnep hid_generic usbhid uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common btusb btrtl btbcm btintel videodev bluetooth mc ecdh_generic ecc nls_utf8 nls_cp866 vfat fat coretemp hwmon x86_pkg_temp_thermal intel_powerclamp mei_hdcp kvm_intel kvm rtsx_pci_sdmmc mmc_core irqbypass crct10dif_pclmul wmi_bmof crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd xhci_pci mei_me ucsi_acpi ideapad_laptop cryptd xhci_pci_renesas glue_helper pcspkr typec_ucsi tiny_power_button rtsx_pci sparse_keymap xhci_hcd mei thermal typec wmi i2c_hid button fan rfkill hid acpi_pad intel_pmc_core battery video ac sch_fq_codel vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) vboxvideo
drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec rc_core vboxsf vboxguest snd_seq_midi snd_seq_midi_event snd_seq snd_rawmidi snd_seq_device snd_timer snd soundcore drm msr fuse dm_mod efi_pstore efivarfs ip_tables x_tables autofs4 evdev input_leds serio_raw
drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec rc_core vboxsf vboxguest snd_seq_midi snd_seq_midi_event snd_seq snd_rawmidi snd_seq_device snd_timer snd soundcore drm msr fuse dm_mod efi_pstore efivarfs ip_tables x_tables autofs4 evdev input_leds serio_raw
CPU: 1 PID: 4107 Comm: repro5 Tainted: G OE 5.10.206-std-def-alt1 #1
CPU: 1 PID: 4107 Comm: repro5 Tainted: G OE 5.10.206-std-def-alt1 #1
Hardware name: LENOVO 82X8/LNVNB161216, BIOS LTCN30WW 11/08/2023
Hardware name: LENOVO 82X8/LNVNB161216, BIOS LTCN30WW 11/08/2023
RIP: 0010:ftrace_verify_code+0x3e/0x80
RIP: 0010:ftrace_verify_code+0x3e/0x80
Code: 25 28 00 00 00 48 89 44 24 08 31 c0 48 8d 7c 24 03 e8 56 f9 1b 00 48 85 c0 75 3e 8b 03 39 44 24 03 74 28 48 89 1d e2 1d 05 03 <0f> 0b b8 ea ff ff ff 48 8b 4c 24 08 65 48 2b 0c 25 28 00 00 00 75
Code: 25 28 00 00 00 48 89 44 24 08 31 c0 48 8d 7c 24 03 e8 56 f9 1b 00 48 85 c0 75 3e 8b 03 39 44 24 03 74 28 48 89 1d e2 1d 05 03 <0f> 0b b8 ea ff ff ff 48 8b 4c 24 08 65 48 2b 0c 25 28 00 00 00 75
RSP: 0018:ffffc90003aa7c88 EFLAGS: 00010212
RSP: 0018:ffffc90003aa7c88 EFLAGS: 00010212
RAX: 0000000000441f0f RBX: ffffffff82005684 RCX: 0000000000000010
RAX: 0000000000441f0f RBX: ffffffff82005684 RCX: 0000000000000010
RDX: 000000000f9dbb1f RSI: 0000000000000005 RDI: ffffffff8183d240
RDX: 000000000f9dbb1f RSI: 0000000000000005 RDI: ffffffff8183d240
RBP: ffff8881000607a0 R08: 0000000000000001 R09: 0000000000000000
RBP: ffff8881000607a0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffffffff840b9f40 R14: ffffffff82005684 R15: ffffffff82a6a760
R13: ffffffff840b9f40 R14: ffffffff82005684 R15: ffffffff82a6a760
FS: 00007f671d1c2640(0000) GS:ffff8882a7840000(0000) knlGS:0000000000000000
FS: 00007f671d1c2640(0000) GS:ffff8882a7840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd44003490 CR3: 000000013e3f2000 CR4: 0000000000750ee0
CR2: 00007efd44003490 CR3: 000000013e3f2000 CR4: 0000000000750ee0
PKRU: 55555554
PKRU: 55555554
Call Trace:
Call Trace:
? __warn+0x80/0x100
? __warn+0x80/0x100
? ftrace_verify_code+0x3e/0x80
? ftrace_verify_code+0x3e/0x80
? report_bug+0x9e/0xc0
? report_bug+0x9e/0xc0
? handle_bug+0x32/0xa0
? handle_bug+0x32/0xa0
? exc_invalid_op+0x14/0x70
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x12/0x20
? asm_exc_invalid_op+0x12/0x20
? sk_lookup_convert_ctx_access+0x280/0x280
? sk_lookup_convert_ctx_access+0x280/0x280
? ftrace_verify_code+0x3e/0x80
? ftrace_verify_code+0x3e/0x80
? ftrace_verify_code+0x2a/0x80
? ftrace_verify_code+0x2a/0x80
ftrace_replace_code+0xa6/0x190
ftrace_replace_code+0xa6/0x190
ftrace_modify_all_code+0xd8/0x170
ftrace_modify_all_code+0xd8/0x170
ftrace_run_update_code+0x13/0x70
ftrace_run_update_code+0x13/0x70
ftrace_startup.part.0+0xe9/0x160
ftrace_startup.part.0+0xe9/0x160
register_ftrace_function+0x52/0x90
register_ftrace_function+0x52/0x90
perf_trace_event_init+0x60/0x2b0
perf_trace_event_init+0x60/0x2b0
perf_trace_init+0x69/0xa0
perf_trace_init+0x69/0xa0
perf_tp_event_init+0x1b/0x50
perf_tp_event_init+0x1b/0x50
perf_try_init_event+0x42/0x130
perf_try_init_event+0x42/0x130
perf_event_alloc+0x5e3/0xdf0
perf_event_alloc+0x5e3/0xdf0
? __alloc_fd+0x44/0x170
? __alloc_fd+0x44/0x170
__do_sys_perf_event_open+0x1cd/0xec0
__do_sys_perf_event_open+0x1cd/0xec0
do_syscall_64+0x30/0x40
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x62/0xc7
entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f671d2c0d49
RIP: 0033:0x7f671d2c0d49
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007f671d1c1df8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RSP: 002b:00007f671d1c1df8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f671d2c0d49
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f671d2c0d49
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 00007f671d1c1e20 R08: 0000000000000000 R09: 0000000000000000
RBP: 00007f671d1c1e20 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd562f62de
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd562f62de
R13: 00007ffd562f62df R14: 0000000000000000 R15: 00007f671d1c2640
R13: 00007ffd562f62df R14: 0000000000000000 R15: 00007f671d1c2640
---[ end trace 74a81e537b634ec5 ]---
---[ end trace 74a81e537b634ec5 ]---
------------[ ftrace bug ]------------
------------[ ftrace bug ]------------
ftrace failed to modify
ftrace failed to modify
[<ffffffff8183d240>] bpf_dispatcher_xdp_func+0x0/0x10
[<ffffffff8183d240>] bpf_dispatcher_xdp_func+0x0/0x10
actual: ffffffe9:ffffffbb:ffffff9d:0f:1f
actual: ffffffe9:ffffffbb:ffffff9d:0f:1f
expected: 0f:1f:44:00:00
expected: 0f:1f:44:00:00
Setting ftrace call site to call ftrace function
Setting ftrace call site to call ftrace function
ftrace record flags: 10000001
ftrace record flags: 10000001
(1)
(1)
expected tramp: ffffffff81068ac0
------------[ cut here ]------------
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4107 at kernel/trace/ftrace.c:2075 ftrace_bug+0x22c/0x256
WARNING: CPU: 1 PID: 4107 at kernel/trace/ftrace.c:2075 ftrace_bug+0x22c/0x256
Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter bridge stp llc qrtr bnep hid_generic usbhid uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common btusb btrtl btbcm btintel videodev bluetooth mc ecdh_generic ecc nls_utf8 nls_cp866 vfat fat coretemp hwmon x86_pkg_temp_thermal intel_powerclamp mei_hdcp kvm_intel kvm rtsx_pci_sdmmc mmc_core irqbypass crct10dif_pclmul wmi_bmof crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd xhci_pci mei_me ucsi_acpi ideapad_laptop cryptd xhci_pci_renesas glue_helper pcspkr typec_ucsi tiny_power_button rtsx_pci sparse_keymap xhci_hcd mei thermal typec wmi i2c_hid button fan rfkill hid acpi_pad intel_pmc_core battery video ac sch_fq_codel vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) vboxvideo
Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter bridge stp llc qrtr bnep hid_generic usbhid uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common btusb btrtl btbcm btintel videodev bluetooth mc ecdh_generic ecc nls_utf8 nls_cp866 vfat fat coretemp hwmon x86_pkg_temp_thermal intel_powerclamp mei_hdcp kvm_intel kvm rtsx_pci_sdmmc mmc_core irqbypass crct10dif_pclmul wmi_bmof crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd xhci_pci mei_me ucsi_acpi ideapad_laptop cryptd xhci_pci_renesas glue_helper pcspkr typec_ucsi tiny_power_button rtsx_pci sparse_keymap xhci_hcd mei thermal typec wmi i2c_hid button fan rfkill hid acpi_pad intel_pmc_core battery video ac sch_fq_codel vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) vboxvideo
drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec rc_core vboxsf vboxguest snd_seq_midi snd_seq_midi_event snd_seq snd_rawmidi snd_seq_device snd_timer snd soundcore drm msr fuse dm_mod efi_pstore efivarfs ip_tables x_tables autofs4 evdev input_leds serio_raw
drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec rc_core vboxsf vboxguest snd_seq_midi snd_seq_midi_event snd_seq snd_rawmidi snd_seq_device snd_timer snd soundcore drm msr fuse dm_mod efi_pstore efivarfs ip_tables x_tables autofs4 evdev input_leds serio_raw
CPU: 1 PID: 4107 Comm: repro5 Tainted: G W OE 5.10.206-std-def-alt1 #1
CPU: 1 PID: 4107 Comm: repro5 Tainted: G W OE 5.10.206-std-def-alt1 #1
Hardware name: LENOVO 82X8/LNVNB161216, BIOS LTCN30WW 11/08/2023
Hardware name: LENOVO 82X8/LNVNB161216, BIOS LTCN30WW 11/08/2023
RIP: 0010:ftrace_bug+0x22c/0x256
RIP: 0010:ftrace_bug+0x22c/0x256
Code: ff 84 c0 74 d0 eb b4 48 c7 c7 36 4b 30 82 e8 0b c5 ff ff 48 89 ef e8 2a df 7a ff 48 c7 c7 47 4b 30 82 48 89 c6 e8 f4 c4 ff ff <0f> 0b c7 05 0f a5 2c 01 01 00 00 00 5b c7 05 14 a5 2c 01 00 00 00
Code: ff 84 c0 74 d0 eb b4 48 c7 c7 36 4b 30 82 e8 0b c5 ff ff 48 89 ef e8 2a df 7a ff 48 c7 c7 47 4b 30 82 48 89 c6 e8 f4 c4 ff ff <0f> 0b c7 05 0f a5 2c 01 01 00 00 00 5b c7 05 14 a5 2c 01 00 00 00
RSP: 0018:ffffc90003aa7c88 EFLAGS: 00010246
RSP: 0018:ffffc90003aa7c88 EFLAGS: 00010246
RAX: 0000000000000022 RBX: 00000000ffffffea RCX: ffff8882a7860808
RAX: 0000000000000022 RBX: 00000000ffffffea RCX: ffff8882a7860808
RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff8882a7860800
RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff8882a7860800
RBP: ffff8881000607a0 R08: 0000000000000000 R09: ffffc90003aa7ac8
RBP: ffff8881000607a0 R08: 0000000000000000 R09: ffffc90003aa7ac8
R10: ffffc90003aa7ac0 R11: ffffffff82ae22e8 R12: ffffffff8183d240
R10: ffffc90003aa7ac0 R11: ffffffff82ae22e8 R12: ffffffff8183d240
R13: ffffffff840b9f40 R14: ffffffff82005684 R15: ffffffff82a6a760
R13: ffffffff840b9f40 R14: ffffffff82005684 R15: ffffffff82a6a760
FS: 00007f671d1c2640(0000) GS:ffff8882a7840000(0000) knlGS:0000000000000000
FS: 00007f671d1c2640(0000) GS:ffff8882a7840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd44003490 CR3: 000000013e3f2000 CR4: 0000000000750ee0
CR2: 00007efd44003490 CR3: 000000013e3f2000 CR4: 0000000000750ee0
PKRU: 55555554
PKRU: 55555554
Call Trace:
Call Trace:
? __warn+0x80/0x100
? __warn+0x80/0x100
? ftrace_bug+0x22c/0x256
? ftrace_bug+0x22c/0x256
? report_bug+0x9e/0xc0
? report_bug+0x9e/0xc0
? handle_bug+0x32/0xa0
? handle_bug+0x32/0xa0
? exc_invalid_op+0x14/0x70
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x12/0x20
? asm_exc_invalid_op+0x12/0x20
? sk_lookup_convert_ctx_access+0x280/0x280
? sk_lookup_convert_ctx_access+0x280/0x280
? ftrace_bug+0x22c/0x256
? ftrace_bug+0x22c/0x256
? ftrace_bug+0x22c/0x256
? ftrace_bug+0x22c/0x256
ftrace_replace_code+0xbb/0x190
ftrace_replace_code+0xbb/0x190
ftrace_modify_all_code+0xd8/0x170
ftrace_modify_all_code+0xd8/0x170
ftrace_run_update_code+0x13/0x70
ftrace_run_update_code+0x13/0x70
ftrace_startup.part.0+0xe9/0x160
ftrace_startup.part.0+0xe9/0x160
register_ftrace_function+0x52/0x90
register_ftrace_function+0x52/0x90
perf_trace_event_init+0x60/0x2b0
perf_trace_event_init+0x60/0x2b0
perf_trace_init+0x69/0xa0
perf_trace_init+0x69/0xa0
perf_tp_event_init+0x1b/0x50
perf_tp_event_init+0x1b/0x50
perf_try_init_event+0x42/0x130
perf_try_init_event+0x42/0x130
perf_event_alloc+0x5e3/0xdf0
perf_event_alloc+0x5e3/0xdf0
? __alloc_fd+0x44/0x170
? __alloc_fd+0x44/0x170
__do_sys_perf_event_open+0x1cd/0xec0
__do_sys_perf_event_open+0x1cd/0xec0
do_syscall_64+0x30/0x40
do_syscall_64+0x30/0x40
entry_SYSCALL_64_after_hwframe+0x62/0xc7
entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f671d2c0d49
RIP: 0033:0x7f671d2c0d49
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007f671d1c1df8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RSP: 002b:00007f671d1c1df8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f671d2c0d49
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f671d2c0d49
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 00007f671d1c1e20 R08: 0000000000000000 R09: 0000000000000000
RBP: 00007f671d1c1e20 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd562f62de
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd562f62de
R13: 00007ffd562f62df R14: 0000000000000000 R15: 00007f671d1c2640
R13: 00007ffd562f62df R14: 0000000000000000 R15: 00007f671d1c2640
---[ end trace 74a81e537b634ec6 ]---
---[ end trace 74a81e537b634ec6 ]---
C reproducer:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <pthread.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <linux/futex.h>
#ifndef __NR_bpf
#define __NR_bpf 321
#endif
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void loop(void)
{
int i, call, thread;
for (call = 0; call < 3; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50 + (call == 0 ? 500 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
*(uint32_t*)0x20000000 = 6;
*(uint32_t*)0x20000004 = 3;
*(uint64_t*)0x20000008 = 0x200000c0;
*(uint8_t*)0x200000c0 = 0x18;
STORE_BY_BITMASK(uint8_t, , 0x200000c1, 0, 0, 4);
STORE_BY_BITMASK(uint8_t, , 0x200000c1, 0, 4, 4);
*(uint16_t*)0x200000c2 = 0;
*(uint32_t*)0x200000c4 = 0;
*(uint8_t*)0x200000c8 = 0;
*(uint8_t*)0x200000c9 = 0;
*(uint16_t*)0x200000ca = 0;
*(uint32_t*)0x200000cc = 0;
*(uint8_t*)0x200000d0 = 0x95;
*(uint8_t*)0x200000d1 = 0;
*(uint16_t*)0x200000d2 = 0;
*(uint32_t*)0x200000d4 = 0;
*(uint64_t*)0x20000010 = 0x20000100;
memcpy((void*)0x20000100, "syzkaller\000", 10);
*(uint32_t*)0x20000018 = 0;
*(uint32_t*)0x2000001c = 0;
*(uint64_t*)0x20000020 = 0;
*(uint32_t*)0x20000028 = 0;
*(uint32_t*)0x2000002c = 0;
memset((void*)0x20000030, 0, 16);
*(uint32_t*)0x20000040 = 0;
*(uint32_t*)0x20000044 = 0x1b;
*(uint32_t*)0x20000048 = -1;
*(uint32_t*)0x2000004c = 8;
*(uint64_t*)0x20000050 = 0;
*(uint32_t*)0x20000058 = 0;
*(uint32_t*)0x2000005c = 0x10;
*(uint64_t*)0x20000060 = 0;
*(uint32_t*)0x20000068 = 0;
*(uint32_t*)0x2000006c = 0;
*(uint32_t*)0x20000070 = 0;
*(uint32_t*)0x20000074 = 0;
*(uint64_t*)0x20000078 = 0;
res = syscall(__NR_bpf, 5ul, 0x20000000ul, 0x80ul);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint32_t*)0x20000280 = r[0];
*(uint32_t*)0x20000284 = 0;
*(uint32_t*)0x20000288 = 0;
*(uint32_t*)0x2000028c = 0;
*(uint64_t*)0x20000290 = 0;
*(uint64_t*)0x20000298 = 0;
*(uint32_t*)0x200002a0 = 0xffffff7f;
*(uint32_t*)0x200002a4 = 0;
*(uint32_t*)0x200002a8 = 0;
*(uint32_t*)0x200002ac = 0;
*(uint64_t*)0x200002b0 = 0;
*(uint64_t*)0x200002b8 = 0;
*(uint32_t*)0x200002c0 = 0;
*(uint32_t*)0x200002c4 = 0;
syscall(__NR_bpf, 0xaul, 0x20000280ul, 0x48ul);
break;
case 2:
*(uint32_t*)0x200000c0 = 2;
*(uint32_t*)0x200000c4 = 0x80;
*(uint8_t*)0x200000c8 = 1;
*(uint8_t*)0x200000c9 = 0;
*(uint8_t*)0x200000ca = 0;
*(uint8_t*)0x200000cb = 0;
*(uint32_t*)0x200000cc = 0;
*(uint64_t*)0x200000d0 = 0;
*(uint64_t*)0x200000d8 = 0;
*(uint64_t*)0x200000e0 = 0;
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 0, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 1, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 2, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 3, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 4, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 5, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 6, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 7, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 8, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 9, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 10, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 11, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 12, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 13, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 14, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 15, 2);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 17, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 18, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 19, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 20, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 21, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 22, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 23, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 24, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 25, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 26, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 27, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 28, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 29, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 30, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 31, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 32, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 33, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 34, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 35, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 36, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 37, 1);
STORE_BY_BITMASK(uint64_t, , 0x200000e8, 0, 38, 26);
*(uint32_t*)0x200000f0 = 0;
*(uint32_t*)0x200000f4 = 2;
*(uint64_t*)0x200000f8 = 0;
*(uint64_t*)0x20000100 = 0;
*(uint64_t*)0x20000108 = 0;
*(uint64_t*)0x20000110 = 4;
*(uint32_t*)0x20000118 = 0;
*(uint32_t*)0x2000011c = 0;
*(uint64_t*)0x20000120 = 0;
*(uint32_t*)0x20000128 = 0;
*(uint16_t*)0x2000012c = 0;
*(uint16_t*)0x2000012e = 0;
*(uint32_t*)0x20000130 = 0;
*(uint32_t*)0x20000134 = 0;
*(uint64_t*)0x20000138 = 0;
syscall(__NR_perf_event_open, 0x200000c0ul, 0, 0ul, -1, 0ul);
break;
}
}
int main(void)
{
syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
loop();
return 0;
}
The following adapted patch is proposed to fix the bug on the 5.10.y kernel:
[PATCH 5.10.y 1/1] bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace)
On Mon, Jan 29, 2024 at 12:17:45PM +0300, [email protected] wrote:
> Syzkaller hit 'WARNING in ftrace_verify_code' bug.
>
> This bug is not a vulnerability and is reproduced only when running
> with root privileges on stable 5.10 kernel.
What about 5.15.y? We can't take a patch for older kernels and not for
newer ones, right?
thanks,
greg k-h
29.01.2024 19:20, Greg KH wrote:
> On Mon, Jan 29, 2024 at 12:17:45PM +0300, [email protected] wrote:
>> Syzkaller hit 'WARNING in ftrace_verify_code' bug.
>>
>> This bug is not a vulnerability and is reproduced only when running
>> with root privileges on stable 5.10 kernel.
> What about 5.15.y? We can't take a patch for older kernels and not for
> newer ones, right?
Indeed, this patch was not backported at 5.15.
I fixed it, successfully tested it on the 5.15.148 kernel and sent the
patch [1]
However, at the time of the kernel build, I noticed a compiler warning
about an unused "*tmp" variable,
that I fixed in the patch for 5.15, but remained in this patch 5.10:
..
+ void *new, *tmp;
..
need to fix on
..
+ void *new;
..
Therefore, I resend the patch with a fix (deleted the unused tmp
pointer). [2]
[1]
https://lore.kernel.org/bpf/[email protected]/T/#u
[2]
https://lore.kernel.org/bpf/[email protected]/T/#u
--
Regards,
Vasiliy Kovalev