* BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
@ 2023-03-20 10:32 Mikhail Gavrilov
2023-03-20 14:00 ` Ben Greear
0 siblings, 1 reply; 3+ messages in thread
From: Mikhail Gavrilov @ 2023-03-20 10:32 UTC (permalink / raw)
To: Linux List Kernel Mailing, sean.wang, deren.wu, Felix Fietkau,
Linux List Kernel Mailing
[-- Attachment #1: Type: text/plain, Size: 5234 bytes --]
Hi,
After enabling KASAN sanitizer the message "BUG: KASAN:
vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
[mt7921_common]" chase me at every boot.
[ 27.514098] ==================================================================
[ 27.514103] BUG: KASAN: vmalloc-out-of-bounds in
mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[ 27.514118] Read of size 1 at addr ffffc900063dda69 by task (udev-worker)/792
[ 27.514123] CPU: 1 PID: 792 Comm: (udev-worker) Tainted: G W
L ------- ---
6.3.0-0.rc2.20230317git38e04b3e4240.27.fc39.x86_64+debug #1
[ 27.514128] Hardware name: ASUSTeK COMPUTER INC. ROG Strix
G513QY_G513QY/G513QY, BIOS G513QY.320 09/07/2022
[ 27.514130] Call Trace:
[ 27.514132] <TASK>
[ 27.514135] dump_stack_lvl+0x72/0xc0
[ 27.514143] print_report+0xcf/0x670
[ 27.514150] ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[ 27.514161] ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[ 27.514172] kasan_report+0xa4/0xe0
[ 27.514177] ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[ 27.514191] mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[ 27.514203] ? __pfx_mt7921_check_offload_capability+0x10/0x10
[mt7921_common]
[ 27.514214] ? __pfx_pcibios_set_master+0x10/0x10
[ 27.514219] ? pcim_iomap_regions+0xf3/0x250
[ 27.514226] ? __pfx_mt7921_pci_probe+0x10/0x10 [mt7921e]
[ 27.514236] mt7921_pci_probe+0xf1/0xc20 [mt7921e]
[ 27.514243] ? _raw_spin_unlock_irqrestore+0x4b/0x80
[ 27.514249] ? __pfx_mt7921_pci_probe+0x10/0x10 [mt7921e]
[ 27.514256] local_pci_probe+0xd9/0x190
[ 27.514261] pci_device_probe+0x236/0x770
[ 27.514265] ? kernfs_add_one+0x129/0x460
[ 27.514270] ? __pfx_pci_device_probe+0x10/0x10
[ 27.514275] ? kernfs_create_link+0x167/0x230
[ 27.514280] ? kernfs_put+0x18/0x40
[ 27.514283] ? sysfs_do_create_link_sd+0x8e/0x100
[ 27.514289] really_probe+0x3e2/0xb60
[ 27.514296] __driver_probe_device+0x18c/0x460
[ 27.514301] driver_probe_device+0x4a/0x120
[ 27.514305] __driver_attach+0x1e1/0x4a0
[ 27.514310] ? __pfx___driver_attach+0x10/0x10
[ 27.514313] bus_for_each_dev+0x105/0x180
[ 27.514317] ? __pfx_bus_for_each_dev+0x10/0x10
[ 27.514324] bus_add_driver+0x29d/0x570
[ 27.514328] ? __pfx_init_module+0x10/0x10 [mt7921e]
[ 27.514337] ? __pfx_init_module+0x10/0x10 [mt7921e]
[ 27.514344] driver_register+0x130/0x450
[ 27.514349] ? __pfx_init_module+0x10/0x10 [mt7921e]
[ 27.514356] do_one_initcall+0xd1/0x3b0
[ 27.514361] ? __pfx_do_one_initcall+0x10/0x10
[ 27.514368] ? kasan_unpoison+0x23/0x50
[ 27.514374] do_init_module+0x190/0x670
[ 27.514382] load_module+0x7059/0x7d90
[ 27.514395] ? __pfx_load_module+0x10/0x10
[ 27.514401] ? lock_acquire+0x1a0/0x4e0
[ 27.514405] ? find_held_lock+0x34/0x120
[ 27.514416] ? __pfx___might_resched+0x10/0x10
[ 27.514422] ? __do_sys_init_module+0x208/0x240
[ 27.514426] __do_sys_init_module+0x208/0x240
[ 27.514429] ? __pfx___do_sys_init_module+0x10/0x10
[ 27.514438] ? seqcount_lockdep_reader_access.constprop.0+0xa5/0xb0
[ 27.514443] ? ktime_get_coarse_real_ts64+0x3d/0xc0
[ 27.514450] do_syscall_64+0x5b/0x80
[ 27.514457] ? asm_exc_page_fault+0x22/0x30
[ 27.514461] ? lockdep_hardirqs_on+0x7d/0x100
[ 27.514466] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 27.514469] RIP: 0033:0x7f5f101348ce
[ 27.514488] Code: 48 8b 0d 3d 15 0c 00 f7 d8 64 89 01 48 83 c8 ff
c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00
00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0a 15 0c 00 f7 d8 64 89
01 48
[ 27.514492] RSP: 002b:00007ffd2ab47908 EFLAGS: 00000246 ORIG_RAX:
00000000000000af
[ 27.514497] RAX: ffffffffffffffda RBX: 0000560016d1b1c0 RCX: 00007f5f101348ce
[ 27.514499] RDX: 00007f5f1060907d RSI: 000000000003b946 RDI: 00005600180ae4d0
[ 27.514501] RBP: 00007ffd2ab479c0 R08: 0000560016cfa0f0 R09: 000000000003a000
[ 27.514503] R10: 0000560576ce1d7a R11: 0000000000000246 R12: 00007f5f1060907d
[ 27.514505] R13: 0000000000020000 R14: 0000560016d1b010 R15: 0000560016d02040
[ 27.514512] </TASK>
[ 27.514515] Memory state around the buggy address:
[ 27.514518] ffffc900063dd900: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[ 27.514520] ffffc900063dd980: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[ 27.514522] >ffffc900063dda00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[ 27.514523] ^
[ 27.514525] ffffc900063dda80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[ 27.514528] ffffc900063ddb00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[ 27.514529] ==================================================================
[ 27.514531] Disabling lock debugging due to kernel taint
[ 27.517884] mt7921e 0000:05:00.0: ASIC revision: 79610010
[ 27.582536] usbcore: registered new interface driver btusb
[ 27.614430] mt7921e 0000:05:00.0: HW/SW Version: 0x8a108a10, Build
Time: 20230302150916a
I do not know which information would be also useful. Please ask me.
I attached a full kernel log if someone would be interested to see it.
--
Best Regards,
Mike Gavrilov.
[-- Attachment #2: dmesg.tar.xz --]
[-- Type: application/octet-stream, Size: 33292 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
2023-03-20 10:32 BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common] Mikhail Gavrilov
@ 2023-03-20 14:00 ` Ben Greear
2023-03-21 0:04 ` Mikhail Gavrilov
0 siblings, 1 reply; 3+ messages in thread
From: Ben Greear @ 2023-03-20 14:00 UTC (permalink / raw)
To: Mikhail Gavrilov, Linux List Kernel Mailing, sean.wang, deren.wu,
Felix Fietkau, Linux List Kernel Mailing
On 3/20/23 03:32, Mikhail Gavrilov wrote:
> Hi,
> After enabling KASAN sanitizer the message "BUG: KASAN:
> vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
> [mt7921_common]" chase me at every boot.
This is use-after-free bug, and I already posted a patch to fix it.
"wireless: mt76: mt7921: Fix use-after-free in fw features query."
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
2023-03-20 14:00 ` Ben Greear
@ 2023-03-21 0:04 ` Mikhail Gavrilov
0 siblings, 0 replies; 3+ messages in thread
From: Mikhail Gavrilov @ 2023-03-21 0:04 UTC (permalink / raw)
To: Ben Greear
Cc: Linux List Kernel Mailing, sean.wang, deren.wu, Felix Fietkau,
Linux List Kernel Mailing
On Mon, Mar 20, 2023 at 7:00 PM Ben Greear <greearb@candelatech.com> wrote:
>
> On 3/20/23 03:32, Mikhail Gavrilov wrote:
> > Hi,
> > After enabling KASAN sanitizer the message "BUG: KASAN:
> > vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
> > [mt7921_common]" chase me at every boot.
>
> This is use-after-free bug, and I already posted a patch to fix it.
> "wireless: mt76: mt7921: Fix use-after-free in fw features query."
Hi,
This is the last version?
https://patchwork.kernel.org/project/linux-wireless/patch/20230308175832.2394061-1-greearb@candelatech.com/
Unfortunately it is not applicable to 6.3-rc3.
❯ git apply v2-wireless-mt76-mt7921-Fix-use-after-free-in-fw-features-query..patch
-v
Checking patch drivers/net/wireless/mediatek/mt76/mt7921/init.c...
Hunk #1 succeeded at 171 (offset 6 lines).
Hunk #2 succeeded at 203 (offset 6 lines).
error: while searching for:
release_firmware(fw);
return features ? features->data : 0;
}
EXPORT_SYMBOL_GPL(mt7921_check_offload_capability);
error: patch failed: drivers/net/wireless/mediatek/mt76/mt7921/init.c:211
error: drivers/net/wireless/mediatek/mt76/mt7921/init.c: patch does not apply
--
Best Regards,
Mike Gavrilov.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-03-21 0:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-20 10:32 BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common] Mikhail Gavrilov
2023-03-20 14:00 ` Ben Greear
2023-03-21 0:04 ` Mikhail Gavrilov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.