Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754830AbbHLON3 (ORCPT ); Wed, 12 Aug 2015 10:13:29 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:31666 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753952AbbHLON1 (ORCPT ); Wed, 12 Aug 2015 10:13:27 -0400 Message-ID: <55CB5484.6080000@oracle.com> Date: Wed, 12 Aug 2015 10:13:24 -0400 From: Sasha Levin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Al Viro CC: linux-fsdevel , LKML Subject: fs: out of bounds on stack in iov_iter_advance Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2437 Lines: 42 Hi all, While fuzzing with trinity inside a KVM tools guest running -next I've stumbled on the following: [64092.216447] ================================================================== [64092.217840] BUG: KASan: out of bounds on stack in iov_iter_advance+0x3b7/0x480 at addr ffff88040506fd48 [64092.219314] Read of size 8 by task trinity-c194/11387 [64092.220114] page:ffffea0010141bc0 count:0 mapcount:0 mapping: (null) index:0x2 [64092.221354] flags: 0x46fffff80000000() [64092.221998] page dumped because: kasan: bad access detected [64092.222879] CPU: 4 PID: 11387 Comm: trinity-c194 Not tainted 4.2.0-rc6-next-20150810-sasha-00040-g12ad0db3-dirty #2427 [64092.224537] ffff88040506fd30 ffff88040506fa88 ffffffff9ce7763b ffff88040506fb10 [64092.225763] ffff88040506fb00 ffffffff9376b1be 0000000000000000 ffff880270108600 [64092.226992] 0000000000000282 0000000000000000 0000000000000000 0000000000000000 [64092.228221] Call Trace: [64092.228679] dump_stack (lib/dump_stack.c:52) [64092.231252] kasan_report_error (mm/kasan/report.c:132 mm/kasan/report.c:193) [64092.232219] __asan_report_load8_noabort (mm/kasan/report.c:251) [64092.234167] iov_iter_advance (lib/iov_iter.c:511) [64092.235105] generic_file_read_iter (mm/filemap.c:1743) [64092.241532] blkdev_read_iter (fs/block_dev.c:1649) [64092.242448] __vfs_read (fs/read_write.c:423 fs/read_write.c:434) [64092.246949] vfs_read (fs/read_write.c:454) [64092.247743] SyS_pread64 (fs/read_write.c:607 fs/read_write.c:594) [64092.250445] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186) [64092.251440] Memory state around the buggy address: [64092.252221] ffff88040506fc00: 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f4 f4 f4 f3 [64092.253340] ffff88040506fc80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 [64092.254456] >ffff88040506fd00: 00 00 f1 f1 f1 f1 00 00 f4 f4 f2 f2 f2 f2 00 00 [64092.255566] ^ [64092.256432] ffff88040506fd80: 00 00 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 f4 [64092.257557] ffff88040506fe00: f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 [64092.258684] ================================================================== Thanks, Sasha -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/