[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171025162213.GH3294@yexl-desktop>
Date: Thu, 26 Oct 2017 00:22:13 +0800
From: kernel test robot <xiaolong.ye@...el.com>
To: "Tobin C. Harding" <me@...in.cc>
Cc: kernel-hardening@...ts.openwall.com, "Tobin C. Harding" <me@...in.cc>,
"Jason A. Donenfeld" <Jason@...c4.com>,
Theodore Ts'o <tytso@....edu>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Kees Cook <keescook@...omium.org>,
Paolo Bonzini <pbonzini@...hat.com>,
Tycho Andersen <tycho@...ker.com>,
"Roberts, William C" <william.c.roberts@...el.com>,
Tejun Heo <tj@...nel.org>,
Jordan Glover <Golden_Miller83@...tonmail.ch>,
Greg KH <gregkh@...uxfoundation.org>,
Petr Mladek <pmladek@...e.com>, Joe Perches <joe@...ches.com>,
Ian Campbell <ijc@...lion.org.uk>,
Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
Catalin Marinas <catalin.marinas@....com>,
Will Deacon <wilal.deacon@....com>,
Steven Rostedt <rostedt@...dmis.org>,
Chris Fries <cfries@...gle.com>, Dave Weinstein <olorin@...gle.com>,
Daniel Micay <danielmicay@...il.com>,
Djalal Harouni <tixxdz@...il.com>, linux-kernel@...r.kernel.org,
lkp@...org
Subject: [lkp-robot] [printk] 7f7c60e066: BUG:KASAN:slab-out-of-bounds
FYI, we noticed the following commit (built with gcc-4.9):
commit: 7f7c60e0663645e757e520245606fde9c6e326bb ("printk: hash addresses printed with %p")
url: https://github.com/0day-ci/linux/commits/Tobin-C-Harding/printk-hash-addresses-printed-with-p/20171024-231922
in testcase: trinity
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -smp 2 -m 512M
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+------------------------------------------------+------------+------------+
| | 6cff0a118f | 7f7c60e066 |
+------------------------------------------------+------------+------------+
| boot_successes | 26 | 0 |
| boot_failures | 16 | 49 |
| BUG:soft_lockup-CPU##stuck_for#s | 16 | |
| Kernel_panic-not_syncing:softlockup:hung_tasks | 16 | |
| BUG:KASAN:slab-out-of-bounds | 0 | 49 |
+------------------------------------------------+------------+------------+
[ 39.757461] BUG: KASAN: slab-out-of-bounds in __test+0xee/0x13f
[ 39.757461] Read of size 34 at addr 22cb34bb by task swapper/0/1
[ 39.757461]
[ 39.757461] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.0-rc6-00013-g7f7c60e #1
[ 39.757461] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 39.757461] Call Trace:
[ 39.757461] dump_stack+0xb0/0xf2
[ 39.757461] print_address_description+0x63/0x2b0
[ 39.757461] kasan_report+0x1fb/0x320
[ 39.757461] ? __test+0xee/0x13f
[ 39.757461] check_memory_region+0x142/0x1a0
[ 39.757461] __asan_loadN+0xf/0x20
[ 39.757461] __test+0xee/0x13f
[ 39.757461] test_printf_init+0x657/0x1378
[ 39.757461] ? test_sort_init+0xff/0x10d
[ 39.757461] ? kfree+0x8b/0x200
[ 39.757461] ? test_sort_init+0xff/0x10d
[ 39.757461] ? __test+0x13f/0x13f
[ 39.757461] do_one_initcall+0x9d/0x19a
[ 39.757461] kernel_init_freeable+0x1be/0x24b
[ 39.757461] ? rest_init+0xe0/0xe0
[ 39.757461] kernel_init+0x13/0x120
[ 39.757461] ? rest_init+0xe0/0xe0
[ 39.757461] ret_from_fork+0x25/0x30
[ 39.757461]
[ 39.757461] Allocated by task 1:
[ 39.757461] save_stack_trace+0x1b/0x20
[ 39.757461] kasan_kmalloc+0xd7/0x180
[ 39.757461] kasan_slab_alloc+0x12/0x20
[ 39.757461] __kmalloc_track_caller+0x107/0x260
[ 39.757461] kvasprintf+0x55/0xb0
[ 39.757461] __test+0xd2/0x13f
[ 39.757461] test_printf_init+0x657/0x1378
[ 39.757461] do_one_initcall+0x9d/0x19a
[ 39.757461] kernel_init_freeable+0x1be/0x24b
[ 39.757461] kernel_init+0x13/0x120
[ 39.757461] ret_from_fork+0x25/0x30
[ 39.757461]
[ 39.757461] Freed by task 1:
[ 39.757461] save_stack_trace+0x1b/0x20
[ 39.757461] kasan_slab_free+0xb9/0x190
[ 39.757461] kfree+0x8b/0x200
[ 39.757461] do_copy+0x6e/0xe0
[ 39.757461] write_buffer+0x37/0x4a
[ 39.757461] flush_buffer+0x38/0xa2
[ 39.757461] __gunzip+0x3b7/0x49e
[ 39.757461] gunzip+0x11/0x13
[ 39.757461] unpack_to_rootfs+0x19a/0x313
[ 39.757461] populate_rootfs+0xa6/0x131
[ 39.757461] do_one_initcall+0x9d/0x19a
[ 39.757461] kernel_init_freeable+0x1be/0x24b
[ 39.757461] kernel_init+0x13/0x120
[ 39.757461] ret_from_fork+0x25/0x30
[ 39.757461]
[ 39.757461] The buggy address belongs to the object at 22cb34bb
[ 39.757461] which belongs to the cache kmalloc-32 of size 32
[ 39.757461] The buggy address is located 0 bytes inside of
[ 39.757461] 32-byte region [22cb34bb, 24ac3a60)
[ 39.757461] The buggy address belongs to the page:
[ 39.757461] page:a7cc2f90 count:1 mapcount:0 mapping: (null) index:0x0
[ 39.757461] flags: 0x4000000000000100(slab)
[ 39.757461] raw: 4000000000000100 0000000000000000 0000000000000000 0000000180550055
[ 39.757461] raw: ffffea00005db400 0000000600000006 ffff88001a001a00 0000000000000000
[ 39.757461] page dumped because: kasan: bad access detected
[ 39.757461]
[ 39.757461] Memory state around the buggy address:
[ 39.757461] 1c0e72a5: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 39.757461] 5e1f6c: fb fb fb fb fc fc fb fb fb fb fc fc 00 00 00 00
[ 39.757461] >24ac3a60: fc fc fb fb fb fb fc fc fb fb fb fb fc fc fb fb
[ 39.757461] ^
[ 39.757461] c354f823: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 39.757461] 149d6220: fb fb fb fb fc fc fb fb fb fb fc fc fb fb fb fb
[ 39.757461] ==================================================================
[ 39.757461] Disabling lock debugging due to kernel taint
[ 40.275423] test_printf: kvasprintf(..., "%p %p", ...) returned '3cf9adbe eff717bf', expected '0000000001234567 fffffffffedcba98'
[ 40.296739] test_printf: vsnprintf(buf, 256, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.322776] test_printf: vsnprintf(buf, 16, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.334834] test_printf: vsnprintf(buf, 0, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.343273] test_printf: kvasprintf(..., "|%-*p|%*p|", ...) returned '|3cf9adbe|3cf9adbe|', expected '|1234567 | 1234567|'
[ 40.356067] test_printf: vsnprintf(buf, 256, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.369273] test_printf: vsnprintf(buf, 22, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.380306] test_printf: vsnprintf(buf, 0, "|%-*p|%*p|", ...) returned 19, expected 39
[ 40.392978] test_printf: kvasprintf(..., "|%-*p|%*p|", ...) returned '|eff717bf|eff717bf|', expected '|fffffffffedcba98 | fffffffffedcba98|'
[ 40.414478] test_printf: vsnprintf(buf, 256, "|%p0y|", ...) returned 10, expected 18
[ 40.428661] test_printf: vsnprintf(buf, 9, "|%p0y|", ...) returned 10, expected 18
[ 40.439610] test_printf: vsnprintf(buf, 0, "|%p0y|", ...) returned 10, expected 18
[ 40.449516] test_printf: kvasprintf(..., "|%p0y|", ...) returned '|3cf9adbe|', expected '|0000000001234567|'
[ 40.461806] test_printf: vsnprintf(buf, 256, "|%p0y|", ...) returned 10, expected 18
[ 40.476076] test_printf: vsnprintf(buf, 13, "|%p0y|", ...) returned 10, expected 18
[ 40.485627] test_printf: vsnprintf(buf, 0, "|%p0y|", ...) returned 10, expected 18
[ 40.498327] test_printf: kvasprintf(..., "|%p0y|", ...) returned '|eff717bf|', expected '|fffffffffedcba98|'
[ 40.517481] test_printf: failed 20 out of 260 tests
[ 41.174874] test_bitmap: test 13: input is '0-2047:128/256' OK, Time: 2658
[ 41.243847] test_bitmap: all 460506 tests passed
[ 41.251270] test_uuid: all 18 tests passed
[ 41.261713] xz_dec_test: module loaded
[ 41.267646] xz_dec_test: Create a device node with 'mknod xz_dec_test c 247 0' and write .xz files to it.
[ 41.294800] rbtree testing
[ 47.622880] -> test 1 (latency of nnodes insert+delete): 143065 cycles
Elapsed time: 60
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
Xiaolong
View attachment "config-4.14.0-rc6-00013-g7f7c60e" of type "text/plain" (108751 bytes)
View attachment "job-script" of type "text/plain" (3728 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (10008 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
