Re: [syzbot] kernel panic: corrupted stack end in openat

On Tue, Mar 16, 2021 at 04:44:45PM +0100, Arnd Bergmann wrote:

On Tue, Mar 16, 2021 at 11:17 AM Dmitry Vyukov [off-list ref] wrote:

quoted

On Tue, Mar 16, 2021 at 11:02 AM Arnd Bergmann [off-list ref] wrote:

quoted

quoted

On Tue, Mar 16, 2021 at 8:18 AM syzbot

quoted

quoted

quoted

[<8073772c>] (integrity_kernel_read) from [<8073a904>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484)
[<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline])
[<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572)

ima_calc_file_hash_tfm() has a SHASH_DESC_ON_STACK(), which by itself can
use up 512 bytes, but KASAN sometimes triples this number. However, I see
you do not actually have KASAN enabled, so there is probably more to it.

The compiler is gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Ok, building with Ubuntu 10.2.1-1ubuntu1 20201207 locally, that's
the closest I have installed, and I think the Debian and Ubuntu versions
are generally quite close in case of gcc since they are maintained by
the same packagers.

I see ima_calc_field_array_hash_tfm() shows up as one of the larger
stack users, but not alarmingly high:
../security/integrity/ima/ima_crypto.c: In function
‘ima_calc_field_array_hash_tfm’:
../security/integrity/ima/ima_crypto.c:624:1: warning: the frame size
of 664 bytes is larger than 600 bytes [-Wframe-larger-than=]
none of the other functions from the call chain have more than 600 bytes
in this combination of config/compiler/sourcetree.

In combination, I don't get to more than ~2300 bytes:

... which shouldn't be a problem - that's just over 1/4 of the stack
space. Could it be the syzbot's gcc is doing something weird and
inflating the stack frames?

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel