Created attachment 307574 [details] git bisect log file I ran into the following unexpected result from the stack clash test included with the LTP testsuite while running tests against 6.12.10: ### tst_test.c:1724: TINFO: Overall timeout per run is 0h 04m 00s tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffcfd0 > 0x7fffffffcf40 stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 mmap:0x7fffffdfb000+0x1000 stack_clash.c:207: TBROK: mmap((nil),4096,PROT_READ | PROT_WRITE(3),34,0,0) failed: ENOMEM (12) stack_clash.c:329: TBROK: Child exited with 2 HINT: You _MAY_ be missing kernel fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58c5d0d6d522 HINT: You _MAY_ be vulnerable to CVE(s): ### The test worked previously on 6.1.x. I ran the same test on a 6.6.x (6.6.70 to be specific) and I got the same failure. git bisect testing appeared to narrow down the reason for the unexpected result to the following commit: 6b008640db7355d8de6ac18f74cedd7ccc92684f Tested reverting the changes from the latter commit and I was able to get the expected result: [root@rno2-sim-j08-017 ~]# stack_clash tst_test.c:1900: TINFO: LTP version: 20240930 tst_test.c:1904: TINFO: Tested kernel: 6.12.10 #8 SMP PREEMPT_DYNAMIC Fri Jan 31 12:42:41 PST 2025 x86_64 tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz' tst_test.c:1724: TINFO: Overall timeout per run is 0h 00m 30s tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffd3b0 > 0x7fffffffd320 stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 mmap:0x7fffffdfb000+0x1000 stack_clash.c:89: TINFO: mmap = [7fffffdfb000, 7fffffdfc000), addr = 7fffffefbd60, diff = ffd60, THRESHOLD = ff000 stack_clash.c:321: TPASS: stack is far enough from mmaped area Summary: passed 1 failed 0 broken 0 skipped 0 warnings 0
(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface). On Tue, 04 Feb 2025 22:19:44 +0000 bugzilla-daemon@kernel.org wrote: > https://bugzilla.kernel.org/show_bug.cgi?id=219750 > > Bug ID: 219750 > Summary: Unexpected result from the stack_clash test for CVE > 2017-1000364 > Product: Memory Management > Version: 2.5 > Hardware: All > OS: Linux > Status: NEW > Severity: normal > Priority: P3 > Component: Other > Assignee: akpm@linux-foundation.org > Reporter: lawa@nvidia.com > Regression: No Thanks. I'm suspecting that the changes in 6b008640db73 ("mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area()") broke the heuristics in stack_clash.c. Let's cc the LTP team and ask whether others are seeing this? > Created attachment 307574 [details] > --> https://bugzilla.kernel.org/attachment.cgi?id=307574&action=edit > git bisect log file > > I ran into the following unexpected result from the stack clash test included > with the LTP testsuite while running tests against 6.12.10: > > ### > > tst_test.c:1724: TINFO: Overall timeout per run is 0h 04m 00s > tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline > stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffcfd0 > > 0x7fffffffcf40 > stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 > mmap:0x7fffffdfb000+0x1000 > stack_clash.c:207: TBROK: mmap((nil),4096,PROT_READ | PROT_WRITE(3),34,0,0) > failed: ENOMEM (12) > stack_clash.c:329: TBROK: Child exited with 2 > > HINT: You _MAY_ be missing kernel fixes: > > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58c5d0d6d522 > > HINT: You _MAY_ be vulnerable to CVE(s): > > ### > > > The test worked previously on 6.1.x. > > I ran the same test on a 6.6.x (6.6.70 to be specific) and I got the same > failure. > > git bisect testing appeared to narrow down the reason for the unexpected > result > to the following commit: > > 6b008640db7355d8de6ac18f74cedd7ccc92684f > > > Tested reverting the changes from the latter commit and I was able to get the > expected result: > > > [root@rno2-sim-j08-017 ~]# stack_clash > tst_test.c:1900: TINFO: LTP version: 20240930 > tst_test.c:1904: TINFO: Tested kernel: 6.12.10 #8 SMP PREEMPT_DYNAMIC Fri Jan > 31 12:42:41 PST 2025 x86_64 > tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz' > tst_test.c:1724: TINFO: Overall timeout per run is 0h 00m 30s > tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline > stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffd3b0 > > 0x7fffffffd320 > stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 > mmap:0x7fffffdfb000+0x1000 > stack_clash.c:89: TINFO: mmap = [7fffffdfb000, 7fffffdfc000), addr = > 7fffffefbd60, diff = ffd60, THRESHOLD = ff000 > stack_clash.c:321: TPASS: stack is far enough from mmaped area > > Summary: > passed 1 > failed 0 > broken 0 > skipped 0 > warnings 0 > > -- > You may reply to this email to add a comment. > > You are receiving this mail because: > You are the assignee for the bug.
Created attachment 307576 [details] attachment-19278-0.html Thank you for the reply. I forgot to include this information but the test system was running a Rocky 8.9 OS. Regards, Leandro Awa ________________________________ From: Andrew Morton <akpm@linux-foundation.org> Sent: Tuesday, February 4, 2025 6:37 PM To: bugzilla-daemon@kernel.org <bugzilla-daemon@kernel.org> Cc: Leandro Awa <lawa@nvidia.com>; ltp@lists.linux.it <ltp@lists.linux.it>; rick.p.edgecombe@intel.com <rick.p.edgecombe@intel.com> Subject: Re: [Bug 219750] New: Unexpected result from the stack_clash test for CVE 2017-1000364 [You don't often get email from akpm@linux-foundation.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] External email: Use caution opening links or attachments (switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface). On Tue, 04 Feb 2025 22:19:44 +0000 bugzilla-daemon@kernel.org wrote: > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.kernel.org%2Fshow_bug.cgi%3Fid%3D219750&data=05%7C02%7Clawa%40nvidia.com%7C5ab5b4d3c70344f417fe08dd458dfe42%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C638743198365806564%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=lCwiGq%2FLpeyLROctH6Zo%2FIYl7h5JSsbb8%2FZPmwpXuhQ%3D&reserved=0<https://bugzilla.kernel.org/show_bug.cgi?id=219750> > > Bug ID: 219750 > Summary: Unexpected result from the stack_clash test for CVE > 2017-1000364 > Product: Memory Management > Version: 2.5 > Hardware: All > OS: Linux > Status: NEW > Severity: normal > Priority: P3 > Component: Other > Assignee: akpm@linux-foundation.org > Reporter: lawa@nvidia.com > Regression: No Thanks. I'm suspecting that the changes in 6b008640db73 ("mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area()") broke the heuristics in stack_clash.c. Let's cc the LTP team and ask whether others are seeing this? > Created attachment 307574 [details] > --> > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.kernel.org%2Fattachment.cgi%3Fid%3D307574%26action%3Dedit&data=05%7C02%7Clawa%40nvidia.com%7C5ab5b4d3c70344f417fe08dd458dfe42%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C638743198365832526%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=FYbvvW9%2Bj9LS1usZlgAUmwWQZa%2BwSRfH9M38%2FNnHB6o%3D&reserved=0<https://bugzilla.kernel.org/attachment.cgi?id=307574&action=edit> > git bisect log file > > I ran into the following unexpected result from the stack clash test included > with the LTP testsuite while running tests against 6.12.10: > > ### > > tst_test.c:1724: TINFO: Overall timeout per run is 0h 04m 00s > tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline > stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffcfd0 > > 0x7fffffffcf40 > stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 > mmap:0x7fffffdfb000+0x1000 > stack_clash.c:207: TBROK: mmap((nil),4096,PROT_READ | PROT_WRITE(3),34,0,0) > failed: ENOMEM (12) > stack_clash.c:329: TBROK: Child exited with 2 > > HINT: You _MAY_ be missing kernel fixes: > > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit.kernel.org%2Fpub%2Fscm%2Flinux%2Fkernel%2Fgit%2Ftorvalds%2Flinux.git%2Fcommit%2F%3Fid%3D58c5d0d6d522&data=05%7C02%7Clawa%40nvidia.com%7C5ab5b4d3c70344f417fe08dd458dfe42%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C638743198365845964%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ykZjHGwpe2I2mEf5cV1hqpGRGZmqlPXVuWW0CEvXsyk%3D&reserved=0<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58c5d0d6d522> > > HINT: You _MAY_ be vulnerable to CVE(s): > > ### > > > The test worked previously on 6.1.x. > > I ran the same test on a 6.6.x (6.6.70 to be specific) and I got the same > failure. > > git bisect testing appeared to narrow down the reason for the unexpected > result > to the following commit: > > 6b008640db7355d8de6ac18f74cedd7ccc92684f > > > Tested reverting the changes from the latter commit and I was able to get the > expected result: > > > [root@rno2-sim-j08-017 ~]# stack_clash > tst_test.c:1900: TINFO: LTP version: 20240930 > tst_test.c:1904: TINFO: Tested kernel: 6.12.10 #8 SMP PREEMPT_DYNAMIC Fri Jan > 31 12:42:41 PST 2025 x86_64 > tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz' > tst_test.c:1724: TINFO: Overall timeout per run is 0h 00m 30s > tst_kconfig.c:629: TINFO: stack_guard_gap is not found in /proc/cmdline > stack_clash.c:296: TINFO: STACK_GROWSDOWN = 1 == 0x7fffffffd3b0 > > 0x7fffffffd320 > stack_clash.c:247: TINFO: Stack:0x7fffffefc000+0x103000 > mmap:0x7fffffdfb000+0x1000 > stack_clash.c:89: TINFO: mmap = [7fffffdfb000, 7fffffdfc000), addr = > 7fffffefbd60, diff = ffd60, THRESHOLD = ff000 > stack_clash.c:321: TPASS: stack is far enough from mmaped area > > Summary: > passed 1 > failed 0 > broken 0 > skipped 0 > warnings 0 > > -- > You may reply to this email to add a comment. > > You are receiving this mail because: > You are the assignee for the bug.