Thread (4 messages) 4 messages, 3 authors, 2020-03-13

Re: KASAN: slab-out-of-bounds Read in cgroup_file_notify

From: Mina Almasry <hidden>
Date: 2020-03-13 22:43:23
Also in: bpf, cgroups, lkml

On Thu, Mar 12, 2020 at 2:06 PM Mina Almasry [off-list ref] wrote:
On Thu, Mar 12, 2020 at 11:28 AM Tejun Heo [off-list ref] wrote:
quoted
On Tue, Mar 10, 2020 at 08:55:14AM -0700, syzbot wrote:
quoted
Hello,

syzbot found the following crash on:

HEAD commit:    c99b17ac Add linux-next specific files for 20200225
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1610d70de00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6b7ebe4bd0931c45
dashboard link: https://syzkaller.appspot.com/bug?extid=cac0c4e204952cf449b1
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1242e1fde00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1110d70de00000

The bug was bisected to:

commit 6863de00e5400b534cd4e3869ffbc8f94da41dfc
Author: Mina Almasry [off-list ref]
Date:   Thu Feb 20 03:55:30 2020 +0000

    hugetlb_cgroup: add accounting for shared mappings
Mina, can you please take a look at this?
Gah, I missed the original syzbot email but I just saw this. I'll take a look.
This was easy enough to track down, I just sent out a fix:
https://lore.kernel.org/linux-mm/20200313223920.124230-1-almasrymina@google.com (local)

BTW, even though this was bisected to my patch, the root cause seems
to be a mistake in commit faced7e0806cf ("mm: hugetlb controller for
cgroups v2"), which is not only in linux-next but also in linus's tree
(I did not check if it's in stable). If my fix is reviewed, the patch
should be sent there as well. I'll make the same comment on the above
thread as well.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help