* power9 slab-out-of-bounds in _find_First_zero_bit
@ 2022-06-24 21:04 Liam Howlett
2022-06-24 23:51 ` Nathan Lynch
0 siblings, 1 reply; 5+ messages in thread
From: Liam Howlett @ 2022-06-24 21:04 UTC (permalink / raw)
To: linuxppc-dev, linux-kernel; +Cc: Yury Norov
Hello,
When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
following on boot:
[ 0.174621] ==================================================================
[ 0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
[ 0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/0/1
[ 0.176900]
[ 0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.19.0-rc3+ #8
[ 0.179461] Call Trace:
[ 0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x74/0xa8 (unreliable)
[ 0.181107] [c000000011967810] [c000000000632220] print_report+0x330/0x740
[ 0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100/0x1f0
[ 0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/0xe0
[ 0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_bit+0x40/0x140
[ 0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi+0xcc/0x220
[ 0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi+0x1ec/0x420
[ 0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+0x44/0xd4
[ 0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0x62c/0x688
[ 0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeable+0x24c/0x520
[ 0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0x1c0
[ 0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_thread+0x5c/0x64
[ 0.188124]
[ 0.188429] Allocated by task 0:
[ 0.188820] kasan_save_stack+0x34/0x70
[ 0.189298] __kasan_kmalloc+0xb8/0xf0
[ 0.189617] __kmalloc+0x148/0x570
[ 0.189909] xive_spapr_init+0x478/0x6fc
[ 0.190212] pseries_init_irq+0x48/0x284
[ 0.190523] init_IRQ+0x4c/0x8c
[ 0.190810] start_kernel+0x25c/0x4d0
[ 0.191130] start_here_common+0x1c/0x20
[ 0.191549]
[ 0.191845] The buggy address belongs to the object at c00000000f7f0410
[ 0.191845] which belongs to the cache kmalloc-8 of size 8
[ 0.192594] The buggy address is located 0 bytes inside of
[ 0.192594] 8-byte region [c00000000f7f0410, c00000000f7f0418)
[ 0.193250]
[ 0.193499] The buggy address belongs to the physical page:
[ 0.194324] page:c00c00000003dfc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf7f
[ 0.195277] flags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff)
[ 0.196521] raw: 007ffff000000200 0000000000000000 5deadbeef0000122 c00000000f7e0300
[ 0.197023] raw: 0000000000000000 0000000086660666 00000001ffffffff 0000000000000000
[ 0.197558] page dumped because: kasan: bad access detected
[ 0.197938]
[ 0.198128] Memory state around the buggy address:
[ 0.198676] c00000000f7f0300: fc fc fc fc 03 fc fc fc fc 03 fc fc fc fc 03 fc
[ 0.199218] c00000000f7f0380: fc fc fc 03 fc fc fc fc 03 fc fc fc fc 03 fc fc
[ 0.199671] >c00000000f7f0400: fc fc 02 fc fc fc fc 04 fc fc fc fc 04 fc fc fc
[ 0.200122] ^
[ 0.200464] c00000000f7f0480: fc 00 fc fc fc fc fa fc fc fc fc 02 fc fc fc fc
[ 0.200905] c00000000f7f0500: fa fc fc fc fc fa fc fc fc fc fa fc fc fc fc 00
[ 0.201379] ==================================================================
Thanks,
Liam
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: power9 slab-out-of-bounds in _find_First_zero_bit
2022-06-24 21:04 power9 slab-out-of-bounds in _find_First_zero_bit Liam Howlett
@ 2022-06-24 23:51 ` Nathan Lynch
0 siblings, 0 replies; 5+ messages in thread
From: Nathan Lynch @ 2022-06-24 23:51 UTC (permalink / raw)
To: Liam Howlett; +Cc: Yury Norov, linuxppc-dev, linux-kernel
Hi Liam,
Liam Howlett <liam.howlett@oracle.com> writes:
>
> When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
> following on boot:
>
> [ 0.174621] ==================================================================
> [ 0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
> [ 0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/0/1
> [ 0.176900]
> [ 0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.19.0-rc3+ #8
> [ 0.179461] Call Trace:
> [ 0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x74/0xa8 (unreliable)
> [ 0.181107] [c000000011967810] [c000000000632220] print_report+0x330/0x740
> [ 0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100/0x1f0
> [ 0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/0xe0
> [ 0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_bit+0x40/0x140
> [ 0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi+0xcc/0x220
> [ 0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi+0x1ec/0x420
> [ 0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+0x44/0xd4
> [ 0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0x62c/0x688
> [ 0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeable+0x24c/0x520
> [ 0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0x1c0
> [ 0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_thread+0x5c/0x64
[...]
Please try "powerpc/xive/spapr: correct bitmap allocation size", posted yesterday:
https://lore.kernel.org/linuxppc-dev/20220623182509.3985625-1-nathanl@linux.ibm.com/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: power9 slab-out-of-bounds in _find_First_zero_bit
@ 2022-06-24 23:51 ` Nathan Lynch
0 siblings, 0 replies; 5+ messages in thread
From: Nathan Lynch @ 2022-06-24 23:51 UTC (permalink / raw)
To: Liam Howlett; +Cc: linuxppc-dev, linux-kernel, Yury Norov
Hi Liam,
Liam Howlett <liam.howlett@oracle.com> writes:
>
> When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
> following on boot:
>
> [ 0.174621] ==================================================================
> [ 0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
> [ 0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/0/1
> [ 0.176900]
> [ 0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.19.0-rc3+ #8
> [ 0.179461] Call Trace:
> [ 0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x74/0xa8 (unreliable)
> [ 0.181107] [c000000011967810] [c000000000632220] print_report+0x330/0x740
> [ 0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100/0x1f0
> [ 0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/0xe0
> [ 0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_bit+0x40/0x140
> [ 0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi+0xcc/0x220
> [ 0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi+0x1ec/0x420
> [ 0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+0x44/0xd4
> [ 0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0x62c/0x688
> [ 0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeable+0x24c/0x520
> [ 0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0x1c0
> [ 0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_thread+0x5c/0x64
[...]
Please try "powerpc/xive/spapr: correct bitmap allocation size", posted yesterday:
https://lore.kernel.org/linuxppc-dev/20220623182509.3985625-1-nathanl@linux.ibm.com/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: power9 slab-out-of-bounds in _find_First_zero_bit
2022-06-24 23:51 ` Nathan Lynch
@ 2022-06-25 1:49 ` Liam Howlett
-1 siblings, 0 replies; 5+ messages in thread
From: Liam Howlett @ 2022-06-25 1:49 UTC (permalink / raw)
To: Nathan Lynch; +Cc: Yury Norov, linuxppc-dev, linux-kernel
* Nathan Lynch <nathanl@linux.ibm.com> [220624 19:51]:
> Hi Liam,
>
> Liam Howlett <liam.howlett@oracle.com> writes:
> >
> > When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
> > following on boot:
> >
> > [ 0.174621] ==================================================================
> > [ 0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
> > [ 0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/0/1
> > [ 0.176900]
> > [ 0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.19.0-rc3+ #8
> > [ 0.179461] Call Trace:
> > [ 0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x74/0xa8 (unreliable)
> > [ 0.181107] [c000000011967810] [c000000000632220] print_report+0x330/0x740
> > [ 0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100/0x1f0
> > [ 0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/0xe0
> > [ 0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_bit+0x40/0x140
> > [ 0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi+0xcc/0x220
> > [ 0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi+0x1ec/0x420
> > [ 0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+0x44/0xd4
> > [ 0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0x62c/0x688
> > [ 0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeable+0x24c/0x520
> > [ 0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0x1c0
> > [ 0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_thread+0x5c/0x64
>
> [...]
>
> Please try "powerpc/xive/spapr: correct bitmap allocation size", posted yesterday:
>
> https://lore.kernel.org/linuxppc-dev/20220623182509.3985625-1-nathanl@linux.ibm.com/
Thanks, that works.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: power9 slab-out-of-bounds in _find_First_zero_bit
@ 2022-06-25 1:49 ` Liam Howlett
0 siblings, 0 replies; 5+ messages in thread
From: Liam Howlett @ 2022-06-25 1:49 UTC (permalink / raw)
To: Nathan Lynch; +Cc: linuxppc-dev, linux-kernel, Yury Norov
* Nathan Lynch <nathanl@linux.ibm.com> [220624 19:51]:
> Hi Liam,
>
> Liam Howlett <liam.howlett@oracle.com> writes:
> >
> > When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
> > following on boot:
> >
> > [ 0.174621] ==================================================================
> > [ 0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140
> > [ 0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/0/1
> > [ 0.176900]
> > [ 0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.19.0-rc3+ #8
> > [ 0.179461] Call Trace:
> > [ 0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x74/0xa8 (unreliable)
> > [ 0.181107] [c000000011967810] [c000000000632220] print_report+0x330/0x740
> > [ 0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100/0x1f0
> > [ 0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/0xe0
> > [ 0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_bit+0x40/0x140
> > [ 0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi+0xcc/0x220
> > [ 0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi+0x1ec/0x420
> > [ 0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+0x44/0xd4
> > [ 0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0x62c/0x688
> > [ 0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeable+0x24c/0x520
> > [ 0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0x1c0
> > [ 0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_thread+0x5c/0x64
>
> [...]
>
> Please try "powerpc/xive/spapr: correct bitmap allocation size", posted yesterday:
>
> https://lore.kernel.org/linuxppc-dev/20220623182509.3985625-1-nathanl@linux.ibm.com/
Thanks, that works.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-06-25 1:50 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-24 21:04 power9 slab-out-of-bounds in _find_First_zero_bit Liam Howlett
2022-06-24 23:51 ` Nathan Lynch
2022-06-24 23:51 ` Nathan Lynch
2022-06-25 1:49 ` Liam Howlett
2022-06-25 1:49 ` Liam Howlett
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.