diff options
Diffstat (limited to 'pkg/report/testdata/linux')
| -rw-r--r-- | pkg/report/testdata/linux/report/146 | 57 | ||||
| -rw-r--r-- | pkg/report/testdata/linux/report/147 | 98 | ||||
| -rw-r--r-- | pkg/report/testdata/linux/report/148 | 90 |
3 files changed, 245 insertions, 0 deletions
diff --git a/pkg/report/testdata/linux/report/146 b/pkg/report/testdata/linux/report/146 new file mode 100644 index 000000000..8615499b4 --- /dev/null +++ b/pkg/report/testdata/linux/report/146 @@ -0,0 +1,57 @@ +# TODO: this must be "in remove_wait_queue". +# We need to skip all *lock_acquire/release functions, +# as they produce unuseful title and sometimes duplicates for +# __lock_acquire vs perf_trace_lock_acquire. +TITLE: BUG: unable to handle kernel paging request in __lock_acquire + +[ 19.572672] BUG: unable to handle kernel paging request at 0000000100000137 +[ 19.572683] IP: __lock_acquire+0xd8/0x1430 +[ 19.572685] PGD 0 P4D 0 +[ 19.572688] Oops: 0002 [#1] SMP +[ 19.572691] Dumping ftrace buffer: +[ 19.572693] (ftrace buffer empty) +[ 19.572694] Modules linked in: +[ 19.572698] CPU: 1 PID: 3131 Comm: syzkaller331655 Not tainted 4.15.0-rc3-next-20171214+ #67 +[ 19.572700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 19.572703] RIP: 0010:__lock_acquire+0xd8/0x1430 +[ 19.572705] RSP: 0018:ffffc9000190bb90 EFLAGS: 00010006 +[ 19.572707] RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 0000000000000000 +[ 19.572708] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8802143518b8 +[ 19.572710] RBP: ffffc9000190bc60 R08: 0000000000000001 R09: ffffffff8121b4f4 +[ 19.572712] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +[ 19.572713] R13: ffff880213514240 R14: 0000000000000001 R15: ffff8802143518b8 +[ 19.572716] FS: 000000000149c880(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000 +[ 19.572717] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 19.572719] CR2: 0000000100000137 CR3: 000000000301e003 CR4: 00000000001606e0 +[ 19.572724] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 19.572725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 19.572726] Call Trace: +[ 19.572732] lock_acquire+0xbf/0x220 +[ 19.572735] ? lock_acquire+0xbf/0x220 +[ 19.572739] ? remove_wait_queue+0x14/0x60 +[ 19.572745] ? ep_unregister_pollwait.isra.7+0x105/0x1f0 +[ 19.572749] _raw_spin_lock_irqsave+0x56/0x70 +[ 19.572752] ? remove_wait_queue+0x14/0x60 +[ 19.572755] remove_wait_queue+0x14/0x60 +[ 19.572758] ep_unregister_pollwait.isra.7+0x79/0x1f0 +[ 19.572762] ep_remove+0x22/0x180 +[ 19.572765] eventpoll_release_file+0x63/0xa0 +[ 19.572774] __fput+0x232/0x270 +[ 19.572778] ____fput+0x15/0x20 +[ 19.572783] task_work_run+0xa3/0xe0 +[ 19.572787] do_exit+0x3e6/0x1050 +[ 19.572793] ? security_file_ioctl+0x51/0x80 +[ 19.572797] do_group_exit+0x60/0x100 +[ 19.572800] SyS_exit_group+0x18/0x20 +[ 19.572805] entry_SYSCALL_64_fastpath+0x1f/0x96 +[ 19.572807] RIP: 0033:0x4444f9 +[ 19.572809] RSP: 002b:00007ffee7715938 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 +[ 19.572813] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004444f9 +[ 19.572815] RDX: 00000000004444f9 RSI: 0000000000000000 RDI: 0000000000000000 +[ 19.572816] RBP: 00000000006cf018 R08: 0000000000000000 R09: 0000000000000000 +[ 19.572818] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 +[ 19.572819] R13: 0000000000401e00 R14: 0000000000000000 R15: 0000000000000000 +[ 19.572822] Code: ff ff e8 6c db ff ff 48 85 c0 4c 8b 8d 60 ff ff ff 44 8b 9d 48 ff ff ff 44 8b 95 40 ff ff ff 8b 8d 3c ff ff ff 0f 84 6d 03 00 00 <f0> ff 80 38 01 00 00 8b 1d 33 4e d4 02 45 8b 85 68 08 00 00 85 +[ 19.572867] RIP: __lock_acquire+0xd8/0x1430 RSP: ffffc9000190bb90 +[ 19.572868] CR2: 0000000100000137 +[ 19.572872] ---[ end trace 43b4a0602d494b9e ]--- diff --git a/pkg/report/testdata/linux/report/147 b/pkg/report/testdata/linux/report/147 new file mode 100644 index 000000000..b6b2eeeeb --- /dev/null +++ b/pkg/report/testdata/linux/report/147 @@ -0,0 +1,98 @@ +# TODO: this must be "in remove_wait_queue". See TODO in 146. +TITLE: KASAN: use-after-free Read in __lock_acquire + +[ 19.121820] ================================================================== +[ 19.121834] BUG: KASAN: use-after-free in __lock_acquire+0x3c41/0x3cf0 +[ 19.121839] Read of size 8 at addr ffff8801c75ea0f8 by task syzkaller992070/3471 +[ 19.121840] +[ 19.121847] CPU: 1 PID: 3471 Comm: syzkaller992070 Not tainted 4.15.0-rc6-next-20180103+ #87 +[ 19.121850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 19.121852] Call Trace: +[ 19.121861] dump_stack+0x137/0x198 +[ 19.121867] ? __lock_acquire+0x3c41/0x3cf0 +[ 19.121877] print_address_description+0x73/0x250 +[ 19.121883] ? __lock_acquire+0x3c41/0x3cf0 +[ 19.121889] kasan_report+0x23b/0x360 +[ 19.121897] __asan_report_load8_noabort+0x14/0x20 +[ 19.121903] __lock_acquire+0x3c41/0x3cf0 +[ 19.121908] ? lock_downgrade+0x860/0x860 +[ 19.121916] ? __bpf_address_lookup+0x2b0/0x2b0 +[ 19.121923] ? __lock_acquire+0x63e/0x3cf0 +[ 19.121930] ? remove_wait_queue+0x24/0x1b0 +[ 19.121939] ? debug_check_no_locks_freed+0x3c0/0x3c0 +[ 19.121947] ? debug_check_no_locks_freed+0x3c0/0x3c0 +[ 19.121956] ? __mutex_lock+0xec/0x1550 +[ 19.121970] ? ep_free+0x72/0x230 +[ 19.121975] ? save_stack+0xa3/0xd0 +[ 19.121983] lock_acquire+0x16b/0x420 +[ 19.121988] ? lock_acquire+0x16b/0x420 +[ 19.121994] ? remove_wait_queue+0x24/0x1b0 +[ 19.122007] _raw_spin_lock_irqsave+0x96/0xc0 +[ 19.122013] ? remove_wait_queue+0x24/0x1b0 +[ 19.122019] remove_wait_queue+0x24/0x1b0 +[ 19.122027] ep_unregister_pollwait.isra.7+0x9d/0x360 +[ 19.122034] ? ep_free+0x230/0x230 +[ 19.122040] ep_free+0xae/0x230 +[ 19.122046] ? ep_free+0x230/0x230 +[ 19.122052] ep_eventpoll_release+0x44/0x60 +[ 19.122058] __fput+0x291/0x6e0 +[ 19.122065] ____fput+0x15/0x20 +[ 19.122071] task_work_run+0x122/0x1a0 +[ 19.122081] do_exit+0x7f4/0x2da0 +[ 19.122090] ? binder_ioctl_write_read.isra.39+0x8e0/0x8e0 +[ 19.122097] ? do_vfs_ioctl+0x439/0xfe0 +[ 19.122104] ? mm_update_next_owner+0x690/0x690 +[ 19.122110] ? ioctl_preallocate+0x1c0/0x1c0 +[ 19.122117] ? __do_page_fault+0x3c3/0xca0 +[ 19.122127] ? entry_SYSCALL_64_fastpath+0x5/0x9a +[ 19.122135] do_group_exit+0x108/0x320 +[ 19.122142] SyS_exit_group+0x1d/0x20 +[ 19.122148] entry_SYSCALL_64_fastpath+0x23/0x9a +[ 19.122153] RIP: 0033:0x4429f8 +[ 19.122156] RSP: 002b:00007ffc4a4029a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +[ 19.122163] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8 +[ 19.122166] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 +[ 19.122169] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0 +[ 19.122172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40 +[ 19.122175] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000 +[ 19.122182] +[ 19.122185] Allocated by task 3471: +[ 19.122191] save_stack+0x43/0xd0 +[ 19.122196] kasan_kmalloc+0xad/0xe0 +[ 19.122201] kmem_cache_alloc_trace+0x136/0x750 +[ 19.122205] binder_get_thread+0x15d/0x700 +[ 19.122209] binder_poll+0x4a/0x210 +[ 19.122214] ep_item_poll.isra.10+0xf2/0x320 +[ 19.122220] SyS_epoll_ctl+0x11c4/0x27b0 +[ 19.122226] entry_SYSCALL_64_fastpath+0x23/0x9a +[ 19.122227] +[ 19.122229] Freed by task 3471: +[ 19.122233] save_stack+0x43/0xd0 +[ 19.122238] kasan_slab_free+0x71/0xc0 +[ 19.122242] kfree+0xd6/0x260 +[ 19.122247] binder_thread_dec_tmpref+0x17d/0x1e0 +[ 19.122252] binder_thread_release+0x27d/0x540 +[ 19.122256] binder_ioctl+0xa1b/0x10ee +[ 19.122261] do_vfs_ioctl+0x190/0xfe0 +[ 19.122265] SyS_ioctl+0x8f/0xc0 +[ 19.122271] entry_SYSCALL_64_fastpath+0x23/0x9a +[ 19.122272] +[ 19.122276] The buggy address belongs to the object at ffff8801c75ea040 +[ 19.122276] which belongs to the cache kmalloc-512 of size 512 +[ 19.122281] The buggy address is located 184 bytes inside of +[ 19.122281] 512-byte region [ffff8801c75ea040, ffff8801c75ea240) +[ 19.122282] The buggy address belongs to the page: +[ 19.122287] page:ffffea00071d7a80 count:1 mapcount:0 mapping:ffff8801c75ea040 index:0x0 +[ 19.122292] flags: 0x2fffc0000000100(slab) +[ 19.122300] raw: 02fffc0000000100 ffff8801c75ea040 0000000000000000 0000000100000006 +[ 19.122307] raw: ffffea00071e1ca0 ffffea00071fd0a0 ffff8801db000940 0000000000000000 +[ 19.122309] page dumped because: kasan: bad access detected +[ 19.122310] +[ 19.122311] Memory state around the buggy address: +[ 19.122316] ffff8801c75e9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 19.122320] ffff8801c75ea000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb +[ 19.122324] >ffff8801c75ea080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 19.122327] ^ +[ 19.122331] ffff8801c75ea100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 19.122335] ffff8801c75ea180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 19.122337] ================================================================== diff --git a/pkg/report/testdata/linux/report/148 b/pkg/report/testdata/linux/report/148 new file mode 100644 index 000000000..1719364ab --- /dev/null +++ b/pkg/report/testdata/linux/report/148 @@ -0,0 +1,90 @@ +# TODO: this must be "in tipc_subscrb_subscrp_delete". See TODO in 146. +TITLE: general protection fault in __lock_acquire + +[ 41.864973] kasan: CONFIG_KASAN_INLINE enabled +[ 41.869549] kasan: GPF could be caused by NULL-ptr deref or user memory access +[ 41.876882] general protection fault: 0000 [#1] SMP KASAN +[ 41.882385] Dumping ftrace buffer: +[ 41.885888] (ftrace buffer empty) +[ 41.889561] Modules linked in: +[ 41.892722] CPU: 0 PID: 3085 Comm: syzkaller064164 Not tainted 4.15.0-rc1+ #137 +[ 41.900130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 41.909450] task: 00000000c24413a5 task.stack: 000000005e8160b5 +[ 41.915475] RIP: 0010:__lock_acquire+0xd55/0x47f0 +[ 41.920278] RSP: 0018:ffff8801cb5474a8 EFLAGS: 00010002 +[ 41.925604] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 41.932837] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff85ecb400 +[ 41.940070] RBP: ffff8801cb547830 R08: 0000000000000001 R09: 0000000000000000 +[ 41.947304] R10: 0000000000000000 R11: ffffffff87489d60 R12: ffff8801cd2980c0 +[ 41.954537] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000020 +[ 41.961772] FS: 00000000014ee880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000 +[ 41.969963] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 41.975807] CR2: 00007ffee2426e40 CR3: 00000001cb85a000 CR4: 00000000001406f0 +[ 41.983046] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 41.990280] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 41.997514] Call Trace: +[ 42.000068] ? find_held_lock+0x39/0x1d0 +[ 42.004098] ? lock_downgrade+0x980/0x980 +[ 42.008214] ? debug_check_no_locks_freed+0x3d0/0x3d0 +[ 42.013368] ? find_held_lock+0x39/0x1d0 +[ 42.017400] ? llist_add_batch+0xf3/0x180 +[ 42.021513] ? find_last_bit+0xd0/0xd0 +[ 42.025367] ? tick_nohz_tick_stopped+0x9/0x20 +[ 42.029912] ? irq_work_queue+0xf7/0x170 +[ 42.033940] ? wake_up_klogd+0xc3/0x100 +[ 42.037877] ? is_console_locked+0x20/0x20 +[ 42.042080] ? console_unlock+0x57e/0xd80 +[ 42.046191] ? trace_hardirqs_on_caller+0x421/0x5c0 +[ 42.051171] ? console_unlock+0x983/0xd80 +[ 42.055286] ? __down_trylock_console_sem+0x70/0x1e0 +[ 42.060349] ? wake_up_klogd+0x100/0x100 +[ 42.064373] ? vprintk_emit+0x49b/0x590 +[ 42.068312] lock_acquire+0x1d5/0x580 +[ 42.072085] ? tipc_subscrb_subscrp_delete+0x8f/0x470 +[ 42.077237] ? lock_release+0xda0/0xda0 +[ 42.081174] ? vprintk_default+0x28/0x30 +[ 42.085204] ? vprintk_func+0x5e/0xc0 +[ 42.088966] ? printk+0xaa/0xca +[ 42.092210] ? tipc_subscrb_subscrp_delete+0x8f/0x470 +[ 42.097362] _raw_spin_lock_bh+0x31/0x40 +[ 42.101385] ? tipc_subscrb_subscrp_delete+0x8f/0x470 +[ 42.106538] tipc_subscrb_subscrp_delete+0x8f/0x470 +[ 42.111518] ? tipc_subscrp_put+0x360/0x360 +[ 42.115800] ? tipc_subscrb_put+0x30/0x30 +[ 42.119910] ? __lock_is_held+0xbc/0x140 +[ 42.123932] ? tipc_subscrb_subscrp_delete+0x470/0x470 +[ 42.129172] tipc_subscrb_release_cb+0x17/0x30 +[ 42.133719] tipc_close_conn+0x171/0x270 +[ 42.137745] tipc_topsrv_kern_subscr+0x724/0x810 +[ 42.142464] ? tipc_conn_terminate+0x50/0x50 +[ 42.146837] ? addr_domain+0x204/0x380 +[ 42.150696] ? tipc_nlist_init+0x77/0x130 +[ 42.154806] ? in_own_node+0x320/0x320 +[ 42.158660] tipc_group_create+0x702/0x9c0 +[ 42.162860] ? tipc_group_size+0x50/0x50 +[ 42.166883] ? lock_release+0xda0/0xda0 +[ 42.170824] ? addr_domain+0x204/0x380 +[ 42.174680] ? in_own_node+0x320/0x320 +[ 42.178532] ? lock_sock_nested+0x91/0x110 +[ 42.182728] ? trace_hardirqs_on+0xd/0x10 +[ 42.186843] ? __local_bh_enable_ip+0x121/0x230 +[ 42.191476] tipc_setsockopt+0x249/0xc10 +[ 42.195502] ? tipc_sk_leave+0x200/0x200 +[ 42.199529] ? security_socket_setsockopt+0x89/0xb0 +[ 42.204510] SyS_setsockopt+0x189/0x360 +[ 42.208446] ? SyS_recv+0x40/0x40 +[ 42.211864] ? SyS_write+0x184/0x220 +[ 42.215543] ? entry_SYSCALL_64_fastpath+0x5/0x96 +[ 42.220348] ? trace_hardirqs_on_caller+0x421/0x5c0 +[ 42.225330] ? trace_hardirqs_on_thunk+0x1a/0x1c +[ 42.230049] entry_SYSCALL_64_fastpath+0x1f/0x96 +[ 42.234769] RIP: 0033:0x444dd9 +[ 42.237923] RSP: 002b:00007fffe5997f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 +[ 42.245593] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000444dd9 +[ 42.252835] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000004 +[ 42.260070] RBP: 0000000000000006 R08: 000000000000001c R09: 0000006f00000034 +[ 42.267303] R10: 0000000020265000 R11: 0000000000000246 R12: 0000000000402310 +[ 42.274537] R13: 00000000004023a0 R14: 0000000000000000 R15: 0000000000000000 +[ 42.281774] Code: e9 03 f3 48 ab 48 81 c4 60 03 00 00 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 cf 38 00 00 49 81 3f 00 58 8b 86 41 be 00 00 +[ 42.300805] RIP: __lock_acquire+0xd55/0x47f0 RSP: ffff8801cb5474a8 +[ 42.307089] ---[ end trace 1d79d73eb824586d ]--- |