Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Write in ringbuf_map_alloc
To:     Marco Elver <elver@google.com>,
        syzbot <syzbot+5ad567a418794b9b5983@syzkaller.appspotmail.com>
Cc:     akpm@linux-foundation.org, andreyknvl@google.com,
        andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
        davem@davemloft.net, glider@google.com, hotforest@gmail.com,
        houtao1@huawei.com, john.fastabend@gmail.com, kafai@fb.com,
        kpsingh@kernel.org, kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, sfr@canb.auug.org.au,
        songliubraving@fb.com, syzkaller-bugs@googlegroups.com, yhs@fb.com
References: <0000000000000a9b7d05d6ee565f@google.com>
 <0000000000004cc7f905d709f0f6@google.com>
 <CANpmjNPL-12uWHk+EDPdz=6rs2+n2zJWX1zMAbsfUm=dbZJ4qQ@mail.gmail.com>
From:   Daniel Borkmann <daniel@iogearbox.net>
Message-ID: <ee888b57-7d2f-d223-4d38-ff783ae9d263@iogearbox.net>
Date:   Wed, 2 Feb 2022 15:55:31 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.2
MIME-Version: 1.0
In-Reply-To: <CANpmjNPL-12uWHk+EDPdz=6rs2+n2zJWX1zMAbsfUm=dbZJ4qQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2/2/22 3:49 PM, Marco Elver wrote:
> On Wed, 2 Feb 2022 at 15:36, syzbot
> <syzbot+5ad567a418794b9b5983@syzkaller.appspotmail.com> wrote:
>>
>> syzbot has bisected this issue to:
>>
>> commit c34cdf846c1298de1c0f7fbe04820fe96c45068c
>> Author: Andrey Konovalov <andreyknvl@google.com>
>> Date:   Wed Feb 2 01:04:27 2022 +0000
>>
>>      kasan, vmalloc: unpoison VM_ALLOC pages after mapping
> 
> Is this a case of a new bug surfacing due to KASAN improvements? But
> it's not quite clear to me why this commit.
> 
> Andrey, any thoughts?

Marco / Andrey, fix should be this one:

https://patchwork.kernel.org/project/netdevbpf/patch/20220202060158.6260-1-houtao1@huawei.com/

>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=128cb900700000
>> start commit:   6abab1b81b65 Add linux-next specific files for 20220202
>> git tree:       linux-next
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=118cb900700000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=168cb900700000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=b8d8750556896349
>> dashboard link: https://syzkaller.appspot.com/bug?extid=5ad567a418794b9b5983
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1450d9f0700000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=130ef35bb00000
>>
>> Reported-by: syzbot+5ad567a418794b9b5983@syzkaller.appspotmail.com
>> Fixes: c34cdf846c12 ("kasan, vmalloc: unpoison VM_ALLOC pages after mapping")
>>
>> For information about bisection process see: https://goo.gl/tpsmEJ#bisection