From: "agentzh at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: systemtap@sourceware.org
Subject: [Bug translator/30395] New: Regex code has invalid memory reads caught by KASAN
Date: Thu, 27 Apr 2023 05:09:38 +0000 [thread overview]
Message-ID: <bug-30395-6586@http.sourceware.org/bugzilla/> (raw)
https://sourceware.org/bugzilla/show_bug.cgi?id=30395
Bug ID: 30395
Summary: Regex code has invalid memory reads caught by KASAN
Product: systemtap
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: translator
Assignee: systemtap at sourceware dot org
Reporter: agentzh at gmail dot com
Target Milestone: ---
Using the latest master branch of systemtap to run the following minimal .stp
scrpt with a KASAN-enabled Linux kernel (5.13.18 x86_64) yields a invalid
memory read error.
```
[ 376.206051] stap_f0245f24e11ddd20c2e276120c521e3a_8363: loading out-of-tree
module taints kernel.
[ 376.206169] stap_f0245f24e11ddd20c2e276120c521e3a_8363: module verification
failed: signature and/or required key missing - tainting kernel
[ 376.601760] stap_f0245f24e11ddd20c2e276120c521e3a_8363 (a.stp): systemtap:
4.9/0.188, base: ffffffffc0b6b000, memory:
72data/56text/79ctx/524390net/366alloc kb, probes: 1
[ 376.601791]
==================================================================
[ 376.601802] BUG: KASAN: global-out-of-bounds in __stp_dfa0+0x826/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601810] Read of size 1 at addr ffffffffc0b7ae86 by task stapio/8363
[ 376.601819] CPU: 29 PID: 8363 Comm: stapio Tainted: G OE
5.13.18-orinc-Og+ #1
[ 376.601822] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.15.0-1.fc35 04/01/2014
[ 376.601824] Call Trace:
[ 376.601830] dump_stack+0xa5/0xdc
[ 376.601842] print_address_description.constprop.0+0x18/0x130
[ 376.601851] ? __stp_dfa0+0x826/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601856] ? __stp_dfa0+0x826/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601861] kasan_report.cold+0x7f/0x111
[ 376.601874] ? __stp_dfa0+0x826/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601881] __stp_dfa0+0x826/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601890] probe_6374+0x148/0xd40
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601896] ? lock_is_held_type+0xe0/0x110
[ 376.601917] ? __stp_dfa0+0x850/0x850
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601927] enter_be_probe.constprop.0+0x3b8/0x690
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601933] ? _stp_error+0xd0/0xd0
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601938] ? lockdep_init_map_type+0x2c3/0x790
[ 376.601945] _stp_ctl_write_cmd.cold+0x1ab/0x2ec
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601953] ? _stp_cleanup_and_exit.part.0+0x720/0x720
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.601958] ? lock_release+0x690/0x690
[ 376.601961] ? __cond_resched+0x15/0x30
[ 376.601968] ? selinux_file_permission+0x2f7/0x3e0
[ 376.601983] proc_reg_write+0x1a9/0x270
[ 376.601994] vfs_write+0x17b/0x7e0
[ 376.602007] ksys_write+0xe9/0x1b0
[ 376.602011] ? __ia32_sys_read+0xb0/0xb0
[ 376.602015] ? syscall_enter_from_user_mode+0x27/0x80
[ 376.602021] do_syscall_64+0x3d/0x80
[ 376.602025] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 376.602028] RIP: 0033:0x7f835d8fc90f
[ 376.602032] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48
8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48
[ 376.602035] RSP: 002b:00007fff529d3f50 EFLAGS: 00000293 ORIG_RAX:
0000000000000001
[ 376.602042] RAX: ffffffffffffffda RBX: 0000000000000008 RCX:
00007f835d8fc90f
[ 376.602045] RDX: 000000000000000c RSI: 00007fff529d3f80 RDI:
0000000000000004
[ 376.602047] RBP: 0000000000008002 R08: 0000000000000000 R09:
00007f834d6fb700
[ 376.602048] R10: 00007f834d6fb9d0 R11: 0000000000000293 R12:
000000000000000c
[ 376.602050] R13: 0000000000000001 R14: 0000000000000000 R15:
00007fff529d4464
[ 376.602064] The buggy address belongs to the variable:
[ 376.602068] _sub_I_65535_1+0x2906/0xa80
[stap_f0245f24e11ddd20c2e276120c521e3a_8363]
[ 376.602074] Memory state around the buggy address:
[ 376.602077] ffffffffc0b7ad80: 06 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9
f9
[ 376.602082] ffffffffc0b7ae00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9
f9
[ 376.602083] >ffffffffc0b7ae80: 06 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00
00
[ 376.602085] ^
[ 376.602087] ffffffffc0b7af00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00
00
[ 376.602089] ffffffffc0b7af80: 00 01 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9
f9
[ 376.602090]
==================================================================
[ 376.602092] Disabling lock debugging due to kernel taint
```
The stap script file that can always reproduce this error is like this:
```
probe oneshot {
if ("32, 5" =~ "^([0-9]+), ([0-9]+)$") {
println("matched: ", matched(1));
}
}
```
The output of this script looks good:
```
matched: 32
```
But dmesg logs have the KASAN error as shown above. How to fix this, please?
--
You are receiving this mail because:
You are the assignee for the bug.
next reply other threads:[~2023-04-27 5:09 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-27 5:09 agentzh at gmail dot com [this message]
2023-04-27 5:10 ` [Bug translator/30395] " agentzh at gmail dot com
2023-04-28 2:20 ` agentzh at gmail dot com
2023-05-03 0:42 ` agentzh at gmail dot com
2023-05-03 0:46 ` agentzh at gmail dot com
2023-05-03 13:55 ` serhei at serhei dot io
2023-05-05 16:12 ` serhei at serhei dot io
2023-05-08 12:17 ` serhei at serhei dot io
2023-05-09 19:55 ` agentzh at gmail dot com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-30395-6586@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=systemtap@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).