From 66c15deb7ae082fbf5f24e0bc47013458ddf8855 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Tue, 6 Feb 2018 15:21:47 +0100 Subject: pkg/report: fix KASAN report parsing We did not skip kasan_check_read. Also don't let stack parsing to silently sink to another stack trace. --- pkg/report/linux.go | 10 +++-- pkg/report/report.go | 16 +++++++- pkg/report/testdata/linux/report/154 | 2 +- pkg/report/testdata/linux/report/180 | 2 +- pkg/report/testdata/linux/report/195 | 40 ++++++++++++++++++ pkg/report/testdata/linux/report/196 | 79 ++++++++++++++++++++++++++++++++++++ 6 files changed, 143 insertions(+), 6 deletions(-) create mode 100644 pkg/report/testdata/linux/report/195 create mode 100644 pkg/report/testdata/linux/report/196 (limited to 'pkg') diff --git a/pkg/report/linux.go b/pkg/report/linux.go index 8cdb38205..ef7b8ac5c 100644 --- a/pkg/report/linux.go +++ b/pkg/report/linux.go @@ -460,6 +460,7 @@ var linuxStackKeywords = []*regexp.Regexp{ } var linuxStackParams = &stackParams{ + stackStartRes: linuxStackKeywords, frameRes: []*regexp.Regexp{ compile("^ +(?:{{PC}} )?{{FUNC}}"), compile("IP: (?:{{PC}} +)?{{FUNC}}"), @@ -468,8 +469,11 @@ var linuxStackParams = &stackParams{ skipPatterns: []string{ "__sanitizer", "__asan", + "kasan", "check_memory_region", + "print_address_description", "panic", + "invalid_op", "dump_stack", "warn_slowpath", "debug_object", @@ -516,7 +520,7 @@ var linuxOopses = []*oops{ title: compile("BUG: KASAN: ([a-z\\-]+) in {{FUNC}}(?:.*\\n)+?.*(Read|Write) of size (?:[0-9]+)"), fmt: "KASAN: %[1]v %[3]v in %[4]v", stack: &stackFmt{ - start: []string{"kasan_report"}, + start: []string{"Call Trace:"}, }, }, { @@ -801,7 +805,7 @@ var linuxOopses = []*oops{ fmt: "INFO: rcu detected stall in %[1]v", stack: &stackFmt{ start: []string{" apic_timer_interrupt"}, - skip: []string{"rcu"}, + skip: []string{"apic_timer_interrupt", "rcu"}, }, }, { @@ -809,7 +813,7 @@ var linuxOopses = []*oops{ fmt: "INFO: rcu detected stall in %[1]v", stack: &stackFmt{ start: []string{" apic_timer_interrupt"}, - skip: []string{"rcu"}, + skip: []string{"apic_timer_interrupt", "rcu"}, }, }, { diff --git a/pkg/report/report.go b/pkg/report/report.go index 694f86440..399b497bc 100644 --- a/pkg/report/report.go +++ b/pkg/report/report.go @@ -185,6 +185,8 @@ func extractDescription(output []byte, oops *oops, params *stackParams) ( format = f } if len(desc) == 0 { + // If we are here and matchedTitle is set, it means that we've matched + // a title of an oops but not full report regexp or stack trace. corrupted = matchedTitle pos := bytes.Index(output, oops.header) if pos == -1 { @@ -210,6 +212,8 @@ func extractDescription(output []byte, oops *oops, params *stackParams) ( } type stackParams struct { + // stackStartRes matches start of stack traces. + stackStartRes []*regexp.Regexp // frameRes match different formats of lines containing kernel frames (capture function name). frameRes []*regexp.Regexp // skipPatterns match functions that must be unconditionally skipped. @@ -224,7 +228,7 @@ func startReportPrefix(output []byte, prefixes []string) []byte { re := regexp.MustCompile(prefix + ".*\\n") match := re.FindSubmatchIndex(output) if match != nil { - return output[match[1]:] + return output[match[0]:] } } return nil @@ -235,11 +239,21 @@ func extractStackFrame(params *stackParams, stack *stackFmt, output []byte) (fra if len(output) == 0 { return } + stackTraces := 0 skip := append([]string{}, params.skipPatterns...) skip = append(skip, stack.skip...) skipRe := regexp.MustCompile(strings.Join(skip, "|")) for s := bufio.NewScanner(bytes.NewReader(output)); s.Scan(); { ln := s.Bytes() + for _, re := range params.stackStartRes { + if re.Match(ln) { + stackTraces++ + if stackTraces > 1 { + return "", false + } + break + } + } var match []int for _, re := range params.frameRes { match = re.FindSubmatchIndex(ln) diff --git a/pkg/report/testdata/linux/report/154 b/pkg/report/testdata/linux/report/154 index 3302bdff4..084df8f38 100644 --- a/pkg/report/testdata/linux/report/154 +++ b/pkg/report/testdata/linux/report/154 @@ -1,5 +1,5 @@ # TODO: must be corrupted (report in report) -TITLE: BUG: unable to handle kernel paging request in print_address_description +TITLE: BUG: unable to handle kernel paging request in rb_first_postorder [ 85.149573] BUG: unable to handle kernel paging request at ffffffff0001eea6 [ 85.153038] ================================================================== diff --git a/pkg/report/testdata/linux/report/180 b/pkg/report/testdata/linux/report/180 index 6241fc753..54d08728c 100644 --- a/pkg/report/testdata/linux/report/180 +++ b/pkg/report/testdata/linux/report/180 @@ -1,5 +1,5 @@ # TODO: must be corrupted (report in report). -TITLE: BUG: unable to handle kernel paging request in print_address_description +TITLE: BUG: unable to handle kernel paging request in rb_first_postorder [ 85.149573] BUG: unable to handle kernel paging request at ffffffff0001eea6 [ 85.153038] ================================================================== diff --git a/pkg/report/testdata/linux/report/195 b/pkg/report/testdata/linux/report/195 new file mode 100644 index 000000000..253c49f49 --- /dev/null +++ b/pkg/report/testdata/linux/report/195 @@ -0,0 +1,40 @@ +TITLE: KASAN: wild-memory-access Read in sg_read + +[ 67.633749] ================================================================== +[ 67.633767] BUG: KASAN: wild-memory-access in sg_read+0xe5c/0x1440 +[ 67.633774] Read of size 4096 at addr ffe70873f7f2b000 by task syz-executor1/13133 +[ 67.633775] +[ 67.633796] CPU: 0 PID: 13133 Comm: syz-executor1 Not tainted 4.9.80-g550c01d #29 +[ 67.633801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 67.633815] ffff8801b42afa38 ffffffff81d94b69 ffe70873f7f2b000 0000000000001000 +[ 67.633827] 0000000000000000 0000000000000000 ffff8801c5ef4340 ffff8801b42afa80 +[ 67.633838] ffffffff8153e49e ffffffff8266a72c 0000000000000282 b11e0ea3aa111a19 +[ 67.633841] Call Trace: +[ 67.633851] [] dump_stack+0xc1/0x128 +[ 67.633860] [] kasan_report+0x15e/0x360 +[ 67.633867] [] ? sg_read+0xe5c/0x1440 +[ 67.633875] [] check_memory_region+0x137/0x190 +[ 67.633882] [] kasan_check_read+0x11/0x20 +[ 67.633888] [] sg_read+0xe5c/0x1440 +[ 67.633896] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633902] [] ? fsnotify+0xf30/0xf30 +[ 67.633910] [] ? avc_policy_seqno+0x9/0x20 +[ 67.633919] [] do_loop_readv_writev.part.17+0x141/0x1e0 +[ 67.633926] [] ? security_file_permission+0x89/0x1e0 +[ 67.633933] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633940] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633947] [] do_readv_writev+0x520/0x750 +[ 67.633954] [] ? vfs_write+0x530/0x530 +[ 67.633962] [] ? kcov_ioctl+0x24/0x1c0 +[ 67.633972] [] ? check_preemption_disabled+0x3b/0x200 +[ 67.633979] [] ? __fget+0x201/0x3a0 +[ 67.633986] [] ? __fget+0x228/0x3a0 +[ 67.633992] [] ? __fget+0x47/0x3a0 +[ 67.634000] [] vfs_readv+0x84/0xc0 +[ 67.634007] [] do_readv+0xe6/0x250 +[ 67.634014] [] ? vfs_readv+0xc0/0xc0 +[ 67.634022] [] ? entry_SYSCALL_64_fastpath+0x5/0xe8 +[ 67.634032] [] ? trace_hardirqs_on_caller+0x38b/0x590 +[ 67.634040] [] SyS_readv+0x27/0x30 +[ 67.634047] [] entry_SYSCALL_64_fastpath+0x29/0xe8 +[ 67.634050] ================================================================== diff --git a/pkg/report/testdata/linux/report/196 b/pkg/report/testdata/linux/report/196 new file mode 100644 index 000000000..dd3ae765d --- /dev/null +++ b/pkg/report/testdata/linux/report/196 @@ -0,0 +1,79 @@ +TITLE: KASAN: wild-memory-access Read in sg_read +CORRUPTED: Y + +[ 67.633749] ================================================================== +[ 67.633767] BUG: KASAN: wild-memory-access in sg_read+0xe5c/0x1440 +[ 67.633774] Read of size 4096 at addr ffe70873f7f2b000 by task syz-executor1/13133 +[ 67.633775] +[ 67.633796] CPU: 0 PID: 13133 Comm: syz-executor1 Not tainted 4.9.80-g550c01d #29 +[ 67.633801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 67.633815] ffff8801b42afa38 ffffffff81d94b69 ffe70873f7f2b000 0000000000001000 +[ 67.633827] 0000000000000000 0000000000000000 ffff8801c5ef4340 ffff8801b42afa80 +[ 67.633838] ffffffff8153e49e ffffffff8266a72c 0000000000000282 b11e0ea3aa111a19 +[ 67.633841] Call Trace: +[ 67.633851] [] dump_stack+0xc1/0x128 +[ 67.633860] [] kasan_report+0x15e/0x360 +[ 67.633867] [] ? sg_read+0xe5c/0x1440 +[ 67.633875] [] check_memory_region+0x137/0x190 +[ 67.633882] [] kasan_check_read+0x11/0x20 +[ 27.258999] ================================================================== +[ 27.260623] kasan: CONFIG_KASAN_INLINE enabled +[ 27.260630] kasan: GPF could be caused by NULL-ptr deref or user memory access +[ 27.260634] general protection fault: 0000 [#1] PREEMPT SMP KASAN +[ 27.260638] Dumping ftrace buffer: +[ 27.260641] (ftrace buffer empty) +[ 27.260644] Modules linked in: +[ 27.260651] CPU: 1 PID: 3377 Comm: syzkaller685434 Not tainted 4.4.107-g610c835 #4 +[ 27.260654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +[ 27.260658] task: ffff8800b823c740 task.stack: ffff8801d94c8000 +[ 27.260671] RIP: 0010:[] [] __lock_acquire+0x61f/0x4b50 +[ 27.260675] RSP: 0018:ffff8801d94cf880 EFLAGS: 00010086 +[ 27.260678] RAX: dffffc0000000000 RBX: dead4ead00000000 RCX: ffffffff81237ade +[ 27.260682] RDX: 1ffff1003a313890 RSI: 0000000000000008 RDI: ffff8801d189c480 +[ 27.260685] RBP: ffff8801d94cfa20 R08: 0000000000000001 R09: 0000000000000001 +[ 27.260688] R10: 0000000000000001 R11: 1ffff1003b299f22 R12: 0000000000000000 +[ 27.260692] R13: ffff8800b823c740 R14: ffff8801d189c478 R15: 0000000000000000 +[ 27.260697] FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f47d3b40 +[ 27.260701] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 +[ 27.260704] CR2: 00000000206f6000 CR3: 00000001d0a15000 CR4: 00000000001406e0 +[ 27.260713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 27.260717] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 27.260718] Stack: +[ 27.260725] ffff8801d0ee0818 ffff8800b4b59d90 ffff8801d94cfa00 ffffffff8149e232 +[ 27.260733] ffff8801d94cf8b0 ffffffff00000000 ffff8800b823c740 ffff8800b823cfb0 +[ 27.260739] 0000000000000288 ffff8800b823c740 0000000000000002 0000000000000002 +[ 27.260741] Call Trace: +[ 27.260751] [] ? handle_mm_fault+0x3f2/0x3190 +[ 27.260758] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 +[ 27.260764] [] ? vmacache_update+0xfe/0x130 +[ 27.260772] [] ? __do_page_fault+0x380/0xa00 +[ 27.260778] [] lock_acquire+0x15e/0x460 +[ 27.260787] [] ? sg_remove_request+0x69/0x110 +[ 27.260794] [] _raw_write_lock_irqsave+0x4e/0x70 +[ 27.260800] [] ? sg_remove_request+0x69/0x110 +[ 27.260806] [] sg_remove_request+0x69/0x110 +[ 27.260813] [] sg_finish_rem_req+0x295/0x340 +[ 27.260819] [] sg_read+0xa21/0x1490 +[ 67.633888] [] sg_read+0xe5c/0x1440 +[ 67.633896] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633902] [] ? fsnotify+0xf30/0xf30 +[ 67.633910] [] ? avc_policy_seqno+0x9/0x20 +[ 67.633919] [] do_loop_readv_writev.part.17+0x141/0x1e0 +[ 67.633926] [] ? security_file_permission+0x89/0x1e0 +[ 67.633933] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633940] [] ? sg_proc_seq_show_debug+0xd90/0xd90 +[ 67.633947] [] do_readv_writev+0x520/0x750 +[ 67.633954] [] ? vfs_write+0x530/0x530 +[ 67.633962] [] ? kcov_ioctl+0x24/0x1c0 +[ 67.633972] [] ? check_preemption_disabled+0x3b/0x200 +[ 67.633979] [] ? __fget+0x201/0x3a0 +[ 67.633986] [] ? __fget+0x228/0x3a0 +[ 67.633992] [] ? __fget+0x47/0x3a0 +[ 67.634000] [] vfs_readv+0x84/0xc0 +[ 67.634007] [] do_readv+0xe6/0x250 +[ 67.634014] [] ? vfs_readv+0xc0/0xc0 +[ 67.634022] [] ? entry_SYSCALL_64_fastpath+0x5/0xe8 +[ 67.634032] [] ? trace_hardirqs_on_caller+0x38b/0x590 +[ 67.634040] [] SyS_readv+0x27/0x30 +[ 67.634047] [] entry_SYSCALL_64_fastpath+0x29/0xe8 +[ 67.634050] ================================================================== -- cgit mrf-deployment