====================================== | [ 634.760935][ T2875] ================================================================== | [ 634.761239][ T2875] BUG: KASAN: wild-memory-access in _copy_to_iter (./arch/x86/include/asm/smap.h:35 ./arch/x86/include/asm/uaccess_64.h:121 ./arch/x86/include/asm/uaccess_64.h:147 lib/iov_iter.c:25 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:185) | [ 634.761508][ T2875] Read of size 982 at addr 0005088000000000 by task ncdevmem/2875 | [ 634.761760][ T2875] [ 634.761855][ T2875] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 634.761857][ T2875] Call Trace: [ 634.761860][ T2875] [ 634.761861][ T2875] dump_stack_lvl (lib/dump_stack.c:123) [ 634.761869][ T2875] ? _copy_to_iter (./arch/x86/include/asm/smap.h:35 ./arch/x86/include/asm/uaccess_64.h:121 ./arch/x86/include/asm/uaccess_64.h:147 lib/iov_iter.c:25 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:185) [ 634.761871][ T2875] kasan_report (mm/kasan/report.c:597) [ 634.761878][ T2875] ? _copy_to_iter (./arch/x86/include/asm/smap.h:35 ./arch/x86/include/asm/uaccess_64.h:121 ./arch/x86/include/asm/uaccess_64.h:147 lib/iov_iter.c:25 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:185) [ 634.761883][ T2875] kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) [ 634.761887][ T2875] _copy_to_iter (./arch/x86/include/asm/smap.h:35 ./arch/x86/include/asm/uaccess_64.h:121 ./arch/x86/include/asm/uaccess_64.h:147 lib/iov_iter.c:25 ./include/linux/iov_iter.h:30 ./include/linux/iov_iter.h:302 ./include/linux/iov_iter.h:330 lib/iov_iter.c:185) [ 634.761891][ T2875] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 634.761897][ T2875] ? _copy_from_iter_flushcache (lib/iov_iter.c:180) [ 634.761901][ T2875] ? mark_held_locks (kernel/locking/lockdep.c:4325) [ 634.761905][ T2875] ? finish_task_switch.isra.0 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/sched/sched.h:1531 kernel/sched/core.c:5105 kernel/sched/core.c:5223) [ 634.761910][ T2875] ? finish_task_switch.isra.0 (./arch/x86/include/asm/atomic.h:67 ./include/linux/atomic/atomic-arch-fallback.h:2278 ./include/linux/atomic/atomic-instrumented.h:1384 ./include/linux/sched/mm.h:54 ./include/linux/sched/mm.h:83 ./include/linux/sched/mm.h:110 kernel/sched/core.c:5250) [ 634.761915][ T2875] __skb_datagram_iter (net/core/datagram.c:440) [ 634.761920][ T2875] ? skb_free_datagram (net/core/datagram.c:520) [ 634.761924][ T2875] ? validate_chain (kernel/locking/lockdep.c:3801 kernel/locking/lockdep.c:3821 kernel/locking/lockdep.c:3876) [ 634.761929][ T2875] skb_copy_datagram_iter (net/core/datagram.c:535) [ 634.761933][ T2875] tcp_recvmsg_locked (net/ipv4/tcp.c:2802) [ 634.761941][ T2875] ? do_raw_spin_lock (./arch/x86/include/asm/atomic.h:107 ./include/linux/atomic/atomic-arch-fallback.h:2170 ./include/linux/atomic/atomic-instrumented.h:1302 ./include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) [ 634.761944][ T2875] ? tcp_update_recv_tstamps (net/ipv4/tcp.c:2613) [ 634.761949][ T2875] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:412) [ 634.761954][ T2875] tcp_recvmsg (net/ipv4/tcp.c:2906) [ 634.761956][ T2875] ? filemap_map_pages (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:871 mm/filemap.c:3794) [ 634.761960][ T2875] ? tcp_recv_timestamp (net/ipv4/tcp.c:2892) [ 634.761964][ T2875] ? rcu_read_lock_any_held (kernel/rcu/update.c:386 kernel/rcu/update.c:380) [ 634.761968][ T2875] ? validate_chain (kernel/locking/lockdep.c:3801 kernel/locking/lockdep.c:3821 kernel/locking/lockdep.c:3876) [ 634.761974][ T2875] inet6_recvmsg (net/ipv6/af_inet6.c:680 (discriminator 2)) [ 634.761978][ T2875] ? inet6_sk_rebuild_header (net/ipv6/af_inet6.c:667) [ 634.761983][ T2875] ____sys_recvmsg (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/sock.h:304 net/socket.c:1069 net/socket.c:1087 net/socket.c:2834) [ 634.761988][ T2875] ? kernel_sendmsg (net/socket.c:2812) [ 634.761990][ T2875] ? _copy_from_user (./arch/x86/include/asm/smap.h:29 ./arch/x86/include/asm/uaccess_64.h:134 ./arch/x86/include/asm/uaccess_64.h:141 ./include/linux/uaccess.h:178 lib/usercopy.c:18) [ 634.761995][ T2875] ? copy_msghdr_from_user (net/socket.c:2554) [ 634.761998][ T2875] ? __copy_msghdr (net/socket.c:2540) [ 634.762004][ T2875] ___sys_recvmsg (net/socket.c:2877) [ 634.762008][ T2875] ? ___sys_sendmsg (net/socket.c:2866) [ 634.762011][ T2875] ? __handle_mm_fault (mm/memory.c:6195) [ 634.762015][ T2875] ? __pmd_alloc (mm/memory.c:6104) [ 634.762022][ T2875] ? lock_vma_under_rcu (./include/linux/rcupdate.h:874 mm/mmap_lock.c:170) [ 634.762028][ T2875] __sys_recvmsg (net/socket.c:2909) [ 634.762031][ T2875] ? __sys_recvmsg_sock (net/socket.c:2894) [ 634.762034][ T2875] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:151 arch/x86/mm/fault.c:1484 arch/x86/mm/fault.c:1532) [ 634.762041][ T2875] ? do_user_addr_fault (./arch/x86/include/asm/atomic.h:93 ./include/linux/atomic/atomic-arch-fallback.h:949 ./include/linux/atomic/atomic-instrumented.h:401 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/mmap_lock.h:143 ./include/linux/mmap_lock.h:267 arch/x86/mm/fault.c:1338) [ 634.762047][ T2875] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 634.762052][ T2875] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 634.762057][ T2875] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 634.762060][ T2875] RIP: 0033:0x7fc9254e907d [ 634.762063][ T2875] Code: eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 41 54 48 83 ec 10 64 8b 04 25 18 00 00 00 85 c0 75 22 b8 2f 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5b 4c 63 e0 48 83 c4 10 4c 89 e0 41 5c c3 66 All code ======== 0: eb b7 jmp 0xffffffffffffffb9 2: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 9: 00 00 00 c: 90 nop d: f3 0f 1e fa endbr64 11: 41 54 push %r12 13: 48 83 ec 10 sub $0x10,%rsp 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 22 jne 0x45 23: b8 2f 00 00 00 mov $0x2f,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 5b ja 0x8d 32: 4c 63 e0 movslq %eax,%r12 35: 48 83 c4 10 add $0x10,%rsp 39: 4c 89 e0 mov %r12,%rax 3c: 41 5c pop %r12 3e: c3 ret 3f: 66 data16 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 5b ja 0x63 8: 4c 63 e0 movslq %eax,%r12 b: 48 83 c4 10 add $0x10,%rsp f: 4c 89 e0 mov %r12,%rax 12: 41 5c pop %r12 14: c3 ret 15: 66 data16 [ 634.762066][ T2875] RSP: 002b:00007ffcabbecf10 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 634.762070][ T2875] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fc9254e907d [ 634.762072][ T2875] RDX: 0000000002000000 RSI: 00007ffcabbecf40 RDI: 0000000000000008 [ 634.762074][ T2875] RBP: 00007ffcabcc89f0 R08: 0000000000000000 R09: 00007ffcabbeaca3 [ 634.762076][ T2875] R10: 00007fc9253e91c8 R11: 0000000000000246 R12: 00007ffcabcc8b58 Finger prints: kasan_report:kasan_check_range:_copy_to_iter:__skb_datagram_iter:skb_copy_datagram_iter