pkg/report: fix KASAN report parsing

We did not skip kasan_check_read.
Also don't let stack parsing to silently sink to another stack trace.

6 files changed, 143 insertions, 6 deletions

diff --git a/pkg/report/linux.go b/pkg/report/linux.go
index 8cdb38205..ef7b8ac5c 100644
--- a/pkg/report/linux.go
+++ b/pkg/report/linux.go
@@ -460,6 +460,7 @@ var linuxStackKeywords = []*regexp.Regexp{
 }
 
 var linuxStackParams = &stackParams{
+	stackStartRes: linuxStackKeywords,
 	frameRes: []*regexp.Regexp{
 		compile("^ +(?:{{PC}} )?{{FUNC}}"),
 		compile("IP: (?:{{PC}} +)?{{FUNC}}"),
@@ -468,8 +469,11 @@ var linuxStackParams = &stackParams{
 	skipPatterns: []string{
 		"__sanitizer",
 		"__asan",
+		"kasan",
 		"check_memory_region",
+		"print_address_description",
 		"panic",
+		"invalid_op",
 		"dump_stack",
 		"warn_slowpath",
 		"debug_object",
@@ -516,7 +520,7 @@ var linuxOopses = []*oops{
 				title: compile("BUG: KASAN: ([a-z\\-]+) in {{FUNC}}(?:.*\\n)+?.*(Read|Write) of size (?:[0-9]+)"),
 				fmt:   "KASAN: %[1]v %[3]v in %[4]v",
 				stack: &stackFmt{
-					start: []string{"kasan_report"},
+					start: []string{"Call Trace:"},
 				},
 			},
 			{
@@ -801,7 +805,7 @@ var linuxOopses = []*oops{
 				fmt:   "INFO: rcu detected stall in %[1]v",
 				stack: &stackFmt{
 					start: []string{" apic_timer_interrupt"},
-					skip:  []string{"rcu"},
+					skip:  []string{"apic_timer_interrupt", "rcu"},
 				},
 			},
 			{
@@ -809,7 +813,7 @@ var linuxOopses = []*oops{
 				fmt:   "INFO: rcu detected stall in %[1]v",
 				stack: &stackFmt{
 					start: []string{" apic_timer_interrupt"},
-					skip:  []string{"rcu"},
+					skip:  []string{"apic_timer_interrupt", "rcu"},
 				},
 			},
 			{
diff --git a/pkg/report/report.go b/pkg/report/report.go
index 694f86440..399b497bc 100644
--- a/pkg/report/report.go
+++ b/pkg/report/report.go
@@ -185,6 +185,8 @@ func extractDescription(output []byte, oops *oops, params *stackParams) (
 		format = f
 	}
 	if len(desc) == 0 {
+		// If we are here and matchedTitle is set, it means that we've matched
+		// a title of an oops but not full report regexp or stack trace.
 		corrupted = matchedTitle
 		pos := bytes.Index(output, oops.header)
 		if pos == -1 {
@@ -210,6 +212,8 @@ func extractDescription(output []byte, oops *oops, params *stackParams) (
 }
 
 type stackParams struct {
+	// stackStartRes matches start of stack traces.
+	stackStartRes []*regexp.Regexp
 	// frameRes match different formats of lines containing kernel frames (capture function name).
 	frameRes []*regexp.Regexp
 	// skipPatterns match functions that must be unconditionally skipped.
@@ -224,7 +228,7 @@ func startReportPrefix(output []byte, prefixes []string) []byte {
 		re := regexp.MustCompile(prefix + ".*\\n")
 		match := re.FindSubmatchIndex(output)
 		if match != nil {
-			return output[match[1]:]
+			return output[match[0]:]
 		}
 	}
 	return nil
@@ -235,11 +239,21 @@ func extractStackFrame(params *stackParams, stack *stackFmt, output []byte) (fra
 	if len(output) == 0 {
 		return
 	}
+	stackTraces := 0
 	skip := append([]string{}, params.skipPatterns...)
 	skip = append(skip, stack.skip...)
 	skipRe := regexp.MustCompile(strings.Join(skip, "|"))
 	for s := bufio.NewScanner(bytes.NewReader(output)); s.Scan(); {
 		ln := s.Bytes()
+		for _, re := range params.stackStartRes {
+			if re.Match(ln) {
+				stackTraces++
+				if stackTraces > 1 {
+					return "", false
+				}
+				break
+			}
+		}
 		var match []int
 		for _, re := range params.frameRes {
 			match = re.FindSubmatchIndex(ln)
diff --git a/pkg/report/testdata/linux/report/154 b/pkg/report/testdata/linux/report/154
index 3302bdff4..084df8f38 100644
--- a/pkg/report/testdata/linux/report/154
+++ b/pkg/report/testdata/linux/report/154
@@ -1,5 +1,5 @@
 # TODO: must be corrupted (report in report)
-TITLE: BUG: unable to handle kernel paging request in print_address_description
+TITLE: BUG: unable to handle kernel paging request in rb_first_postorder
 
 [   85.149573] BUG: unable to handle kernel paging request at ffffffff0001eea6
 [   85.153038] ==================================================================
diff --git a/pkg/report/testdata/linux/report/180 b/pkg/report/testdata/linux/report/180
index 6241fc753..54d08728c 100644
--- a/pkg/report/testdata/linux/report/180
+++ b/pkg/report/testdata/linux/report/180
@@ -1,5 +1,5 @@
 # TODO: must be corrupted (report in report).
-TITLE: BUG: unable to handle kernel paging request in print_address_description
+TITLE: BUG: unable to handle kernel paging request in rb_first_postorder
 
 [   85.149573] BUG: unable to handle kernel paging request at ffffffff0001eea6
 [   85.153038] ==================================================================
diff --git a/pkg/report/testdata/linux/report/195 b/pkg/report/testdata/linux/report/195
new file mode 100644
index 000000000..253c49f49
--- /dev/null
+++ b/pkg/report/testdata/linux/report/195
@@ -0,0 +1,40 @@
+TITLE: KASAN: wild-memory-access Read in sg_read
+
+[   67.633749] ==================================================================
+[   67.633767] BUG: KASAN: wild-memory-access in sg_read+0xe5c/0x1440
+[   67.633774] Read of size 4096 at addr ffe70873f7f2b000 by task syz-executor1/13133
+[   67.633775] 
+[   67.633796] CPU: 0 PID: 13133 Comm: syz-executor1 Not tainted 4.9.80-g550c01d #29
+[   67.633801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[   67.633815]  ffff8801b42afa38 ffffffff81d94b69 ffe70873f7f2b000 0000000000001000
+[   67.633827]  0000000000000000 0000000000000000 ffff8801c5ef4340 ffff8801b42afa80
+[   67.633838]  ffffffff8153e49e ffffffff8266a72c 0000000000000282 b11e0ea3aa111a19
+[   67.633841] Call Trace:
+[   67.633851]  [<ffffffff81d94b69>] dump_stack+0xc1/0x128
+[   67.633860]  [<ffffffff8153e49e>] kasan_report+0x15e/0x360
+[   67.633867]  [<ffffffff8266a72c>] ? sg_read+0xe5c/0x1440
+[   67.633875]  [<ffffffff8153cfc7>] check_memory_region+0x137/0x190
+[   67.633882]  [<ffffffff8153d031>] kasan_check_read+0x11/0x20
+[   67.633888]  [<ffffffff8266a72c>] sg_read+0xe5c/0x1440
+[   67.633896]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633902]  [<ffffffff81644640>] ? fsnotify+0xf30/0xf30
+[   67.633910]  [<ffffffff81bdc219>] ? avc_policy_seqno+0x9/0x20
+[   67.633919]  [<ffffffff8156cc21>] do_loop_readv_writev.part.17+0x141/0x1e0
+[   67.633926]  [<ffffffff81bd32d9>] ? security_file_permission+0x89/0x1e0
+[   67.633933]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633940]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633947]  [<ffffffff81570a90>] do_readv_writev+0x520/0x750
+[   67.633954]  [<ffffffff81570570>] ? vfs_write+0x530/0x530
+[   67.633962]  [<ffffffff8136b494>] ? kcov_ioctl+0x24/0x1c0
+[   67.633972]  [<ffffffff81dfbfab>] ? check_preemption_disabled+0x3b/0x200
+[   67.633979]  [<ffffffff815d1581>] ? __fget+0x201/0x3a0
+[   67.633986]  [<ffffffff815d15a8>] ? __fget+0x228/0x3a0
+[   67.633992]  [<ffffffff815d13c7>] ? __fget+0x47/0x3a0
+[   67.634000]  [<ffffffff81570d44>] vfs_readv+0x84/0xc0
+[   67.634007]  [<ffffffff81570e66>] do_readv+0xe6/0x250
+[   67.634014]  [<ffffffff81570d80>] ? vfs_readv+0xc0/0xc0
+[   67.634022]  [<ffffffff838b344a>] ? entry_SYSCALL_64_fastpath+0x5/0xe8
+[   67.634032]  [<ffffffff8123b64b>] ? trace_hardirqs_on_caller+0x38b/0x590
+[   67.634040]  [<ffffffff81574357>] SyS_readv+0x27/0x30
+[   67.634047]  [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
+[   67.634050] ==================================================================
diff --git a/pkg/report/testdata/linux/report/196 b/pkg/report/testdata/linux/report/196
new file mode 100644
index 000000000..dd3ae765d
--- /dev/null
+++ b/pkg/report/testdata/linux/report/196
@@ -0,0 +1,79 @@
+TITLE: KASAN: wild-memory-access Read in sg_read
+CORRUPTED: Y
+
+[   67.633749] ==================================================================
+[   67.633767] BUG: KASAN: wild-memory-access in sg_read+0xe5c/0x1440
+[   67.633774] Read of size 4096 at addr ffe70873f7f2b000 by task syz-executor1/13133
+[   67.633775] 
+[   67.633796] CPU: 0 PID: 13133 Comm: syz-executor1 Not tainted 4.9.80-g550c01d #29
+[   67.633801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[   67.633815]  ffff8801b42afa38 ffffffff81d94b69 ffe70873f7f2b000 0000000000001000
+[   67.633827]  0000000000000000 0000000000000000 ffff8801c5ef4340 ffff8801b42afa80
+[   67.633838]  ffffffff8153e49e ffffffff8266a72c 0000000000000282 b11e0ea3aa111a19
+[   67.633841] Call Trace:
+[   67.633851]  [<ffffffff81d94b69>] dump_stack+0xc1/0x128
+[   67.633860]  [<ffffffff8153e49e>] kasan_report+0x15e/0x360
+[   67.633867]  [<ffffffff8266a72c>] ? sg_read+0xe5c/0x1440
+[   67.633875]  [<ffffffff8153cfc7>] check_memory_region+0x137/0x190
+[   67.633882]  [<ffffffff8153d031>] kasan_check_read+0x11/0x20
+[   27.258999] ==================================================================
+[   27.260623] kasan: CONFIG_KASAN_INLINE enabled
+[   27.260630] kasan: GPF could be caused by NULL-ptr deref or user memory access
+[   27.260634] general protection fault: 0000 [#1] PREEMPT SMP KASAN
+[   27.260638] Dumping ftrace buffer:
+[   27.260641]    (ftrace buffer empty)
+[   27.260644] Modules linked in:
+[   27.260651] CPU: 1 PID: 3377 Comm: syzkaller685434 Not tainted 4.4.107-g610c835 #4
+[   27.260654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[   27.260658] task: ffff8800b823c740 task.stack: ffff8801d94c8000
+[   27.260671] RIP: 0010:[<ffffffff8123487f>]  [<ffffffff8123487f>] __lock_acquire+0x61f/0x4b50
+[   27.260675] RSP: 0018:ffff8801d94cf880  EFLAGS: 00010086
+[   27.260678] RAX: dffffc0000000000 RBX: dead4ead00000000 RCX: ffffffff81237ade
+[   27.260682] RDX: 1ffff1003a313890 RSI: 0000000000000008 RDI: ffff8801d189c480
+[   27.260685] RBP: ffff8801d94cfa20 R08: 0000000000000001 R09: 0000000000000001
+[   27.260688] R10: 0000000000000001 R11: 1ffff1003b299f22 R12: 0000000000000000
+[   27.260692] R13: ffff8800b823c740 R14: ffff8801d189c478 R15: 0000000000000000
+[   27.260697] FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f47d3b40
+[   27.260701] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
+[   27.260704] CR2: 00000000206f6000 CR3: 00000001d0a15000 CR4: 00000000001406e0
+[   27.260713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[   27.260717] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[   27.260718] Stack:
+[   27.260725]  ffff8801d0ee0818 ffff8800b4b59d90 ffff8801d94cfa00 ffffffff8149e232
+[   27.260733]  ffff8801d94cf8b0 ffffffff00000000 ffff8800b823c740 ffff8800b823cfb0
+[   27.260739]  0000000000000288 ffff8800b823c740 0000000000000002 0000000000000002
+[   27.260741] Call Trace:
+[   27.260751]  [<ffffffff8149e232>] ? handle_mm_fault+0x3f2/0x3190
+[   27.260758]  [<ffffffff81234260>] ? debug_check_no_locks_freed+0x2c0/0x2c0
+[   27.260764]  [<ffffffff8148979e>] ? vmacache_update+0xfe/0x130
+[   27.260772]  [<ffffffff810db470>] ? __do_page_fault+0x380/0xa00
+[   27.260778]  [<ffffffff8123a61e>] lock_acquire+0x15e/0x460
+[   27.260787]  [<ffffffff825b8a89>] ? sg_remove_request+0x69/0x110
+[   27.260794]  [<ffffffff83773a1e>] _raw_write_lock_irqsave+0x4e/0x70
+[   27.260800]  [<ffffffff825b8a89>] ? sg_remove_request+0x69/0x110
+[   27.260806]  [<ffffffff825b8a89>] sg_remove_request+0x69/0x110
+[   27.260813]  [<ffffffff825b9095>] sg_finish_rem_req+0x295/0x340
+[   27.260819]  [<ffffffff825baed1>] sg_read+0xa21/0x1490
+[   67.633888]  [<ffffffff8266a72c>] sg_read+0xe5c/0x1440
+[   67.633896]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633902]  [<ffffffff81644640>] ? fsnotify+0xf30/0xf30
+[   67.633910]  [<ffffffff81bdc219>] ? avc_policy_seqno+0x9/0x20
+[   67.633919]  [<ffffffff8156cc21>] do_loop_readv_writev.part.17+0x141/0x1e0
+[   67.633926]  [<ffffffff81bd32d9>] ? security_file_permission+0x89/0x1e0
+[   67.633933]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633940]  [<ffffffff826698d0>] ? sg_proc_seq_show_debug+0xd90/0xd90
+[   67.633947]  [<ffffffff81570a90>] do_readv_writev+0x520/0x750
+[   67.633954]  [<ffffffff81570570>] ? vfs_write+0x530/0x530
+[   67.633962]  [<ffffffff8136b494>] ? kcov_ioctl+0x24/0x1c0
+[   67.633972]  [<ffffffff81dfbfab>] ? check_preemption_disabled+0x3b/0x200
+[   67.633979]  [<ffffffff815d1581>] ? __fget+0x201/0x3a0
+[   67.633986]  [<ffffffff815d15a8>] ? __fget+0x228/0x3a0
+[   67.633992]  [<ffffffff815d13c7>] ? __fget+0x47/0x3a0
+[   67.634000]  [<ffffffff81570d44>] vfs_readv+0x84/0xc0
+[   67.634007]  [<ffffffff81570e66>] do_readv+0xe6/0x250
+[   67.634014]  [<ffffffff81570d80>] ? vfs_readv+0xc0/0xc0
+[   67.634022]  [<ffffffff838b344a>] ? entry_SYSCALL_64_fastpath+0x5/0xe8
+[   67.634032]  [<ffffffff8123b64b>] ? trace_hardirqs_on_caller+0x38b/0x590
+[   67.634040]  [<ffffffff81574357>] SyS_readv+0x27/0x30
+[   67.634047]  [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
+[   67.634050] ==================================================================