linux-arm-kernel.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
From: Qian Cai <quic_qiancai@quicinc.com>
To: Will Deacon <will@kernel.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	 Mark Rutland <mark.rutland@arm.com>
Cc: <linux-arm-kernel@lists.infradead.org>,
	Dmitry Vyukov <dvyukov@google.com>,
	<linux-kernel@vger.kernel.org>, <kasan-dev@googlegroups.com>,
	Valentin Schneider <valentin.schneider@arm.com>
Subject: KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu
Date: Fri, 12 Nov 2021 23:50:16 -0500	[thread overview]
Message-ID: <YY9ECKyPtDbD9q8q@qian-HP-Z2-SFF-G5-Workstation> (raw)

FYI, running CPU soft-hotplug with KASAN on arm64 defconfig will
always trigger a stack-out-of-bounds below. I am not right sure where
exactly KASAN pointed at, so I am just doing the brute-force
bisect. The progress so far:

# git bisect log
git bisect start
# bad: [e73f0f0ee7541171d89f2e2491130c7771ba58d3] Linux 5.14-rc1
git bisect bad e73f0f0ee7541171d89f2e2491130c7771ba58d3
# good: [62fb9874f5da54fdb243003b386128037319b219] Linux 5.13
git bisect good 62fb9874f5da54fdb243003b386128037319b219
# bad: [e058a84bfddc42ba356a2316f2cf1141974625c9] Merge tag 'drm-next-2021-07-01' of git://anongit.freedesktop.org/drm/drm
git bisect bad e058a84bfddc42ba356a2316f2cf1141974625c9
# bad: [a6eaf3850cb171c328a8b0db6d3c79286a1eba9d] Merge tag 'sched-urgent-2021-06-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad a6eaf3850cb171c328a8b0db6d3c79286a1eba9d
# bad: [31e798fd6f0ff0acdc49c1a358b581730936a09a] Merge tag 'media/v5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
git bisect bad 31e798fd6f0ff0acdc49c1a358b581730936a09a

I am going to test the "arm64-upstream" merge request next which has
some interesting arm64/cpuinfo patches.

 BUG: KASAN: stack-out-of-bounds in vsnprintf
 Read of size 8 at addr ffff800016297db8 by task swapper/0/0

 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-next-20211110 #157
 Hardware name: MiTAC RAPTOR EV-883832-X3-0001/RAPTOR, BIOS 1.6 06/28/2020
 Call trace:
  dump_backtrace
  show_stack
  dump_stack_lvl
  print_address_description.constprop.0
  kasan_report
  __asan_report_load8_noabort
  vsnprintf
  vsnprintf at /root/linux-next/lib/vsprintf.c:2807
  vprintk_store
  vprintk_store at /root/linux-next/kernel/printk/printk.c:2138 (discriminator 5)
  vprintk_emit
  vprintk_emit at /root/linux-next/kernel/printk/printk.c:2232
  vprintk_default
  vprintk_default at /root/linux-next/kernel/printk/printk.c:2260
  vprintk
  vprintk at /root/linux-next/kernel/printk/printk_safe.c:50
  _printk
  printk at /root/linux-next/kernel/printk/printk.c:2264
  __cpuinfo_store_cpu
  __cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:412
  cpuinfo_store_cpu
  cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:418
  secondary_start_kernel
  secondary_start_kernel at /root/linux-next/arch/arm64/kernel/smp.c:241
  __secondary_switched


 addr ffff800016297db8 is located in stack of task swapper/0/0 at offset 136 in frame:
  _printk

 this frame has 1 object:
  [32, 64) 'args'

 Memory state around the buggy address:
  ffff800016297c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff800016297d00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3
 >ffff800016297d80: f3 f3 00 00 00 00 f3 f3 00 00 00 00 00 00 00 00
                                         ^
  ffff800016297e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff800016297e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

             reply	other threads:[~2021-11-13  4:51 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-13  4:50 Qian Cai [this message]
2021-11-13  6:07 ` Qian Cai
2021-11-13  6:49   ` Dmitry Vyukov
2021-11-15 13:29     ` Qian Cai
2021-11-15 10:44 ` Mark Rutland
2021-11-15 13:50   ` Mark Rutland

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YY9ECKyPtDbD9q8q@qian-HP-Z2-SFF-G5-Workstation \
    --to=quic_qiancai@quicinc.com \
    --cc=catalin.marinas@arm.com \
    --cc=dvyukov@google.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=valentin.schneider@arm.com \
    --cc=will@kernel.org \
    --subject='Re: KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).