Messages in this thread | | | Date | Fri, 12 Nov 2021 23:50:16 -0500 | From | Qian Cai <> | Subject | KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu |
| |
FYI, running CPU soft-hotplug with KASAN on arm64 defconfig will always trigger a stack-out-of-bounds below. I am not right sure where exactly KASAN pointed at, so I am just doing the brute-force bisect. The progress so far:
# git bisect log git bisect start # bad: [e73f0f0ee7541171d89f2e2491130c7771ba58d3] Linux 5.14-rc1 git bisect bad e73f0f0ee7541171d89f2e2491130c7771ba58d3 # good: [62fb9874f5da54fdb243003b386128037319b219] Linux 5.13 git bisect good 62fb9874f5da54fdb243003b386128037319b219 # bad: [e058a84bfddc42ba356a2316f2cf1141974625c9] Merge tag 'drm-next-2021-07-01' of git://anongit.freedesktop.org/drm/drm git bisect bad e058a84bfddc42ba356a2316f2cf1141974625c9 # bad: [a6eaf3850cb171c328a8b0db6d3c79286a1eba9d] Merge tag 'sched-urgent-2021-06-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip git bisect bad a6eaf3850cb171c328a8b0db6d3c79286a1eba9d # bad: [31e798fd6f0ff0acdc49c1a358b581730936a09a] Merge tag 'media/v5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media git bisect bad 31e798fd6f0ff0acdc49c1a358b581730936a09a
I am going to test the "arm64-upstream" merge request next which has some interesting arm64/cpuinfo patches.
BUG: KASAN: stack-out-of-bounds in vsnprintf Read of size 8 at addr ffff800016297db8 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-next-20211110 #157 Hardware name: MiTAC RAPTOR EV-883832-X3-0001/RAPTOR, BIOS 1.6 06/28/2020 Call trace: dump_backtrace show_stack dump_stack_lvl print_address_description.constprop.0 kasan_report __asan_report_load8_noabort vsnprintf vsnprintf at /root/linux-next/lib/vsprintf.c:2807 vprintk_store vprintk_store at /root/linux-next/kernel/printk/printk.c:2138 (discriminator 5) vprintk_emit vprintk_emit at /root/linux-next/kernel/printk/printk.c:2232 vprintk_default vprintk_default at /root/linux-next/kernel/printk/printk.c:2260 vprintk vprintk at /root/linux-next/kernel/printk/printk_safe.c:50 _printk printk at /root/linux-next/kernel/printk/printk.c:2264 __cpuinfo_store_cpu __cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:412 cpuinfo_store_cpu cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:418 secondary_start_kernel secondary_start_kernel at /root/linux-next/arch/arm64/kernel/smp.c:241 __secondary_switched
addr ffff800016297db8 is located in stack of task swapper/0/0 at offset 136 in frame: _printk
this frame has 1 object: [32, 64) 'args'
Memory state around the buggy address: ffff800016297c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800016297d00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 >ffff800016297d80: f3 f3 00 00 00 00 f3 f3 00 00 00 00 00 00 00 00 ^ ffff800016297e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800016297e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
| |