From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A89B7C3DA7F for ; Mon, 12 Aug 2024 18:54:15 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2B5846B009A; Mon, 12 Aug 2024 14:54:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 264256B00BA; Mon, 12 Aug 2024 14:54:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 105716B00A4; Mon, 12 Aug 2024 14:54:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id E33146B00BA for ; Mon, 12 Aug 2024 14:54:14 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 84DD0140349 for ; Mon, 12 Aug 2024 18:54:14 +0000 (UTC) X-FDA: 82444493628.06.E27B76F Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf26.hostedemail.com (Postfix) with ESMTP id C30EC140005 for ; Mon, 12 Aug 2024 18:54:12 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=cad7xSwi; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf26.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1723488801; a=rsa-sha256; cv=none; b=7qqFOSwvz05V9cJpW5q0GnXrUk7O+dsU1PDAOfW607tGiWCtOGctbFGhI4Uv8d4BnRlfaY 6naKrEUfJeqD1lDepLl34e7V3eQAAownO+4yRfriUYK3hfoaB0NyfOvIrAC2o5UICxvIjJ VDW/2g2xXehA98+/ioIhifpj4PhrHT4= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=cad7xSwi; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf26.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1723488801; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ZDpoQi/nQT75j9pcWOrs0JnDV2ussj4TQCnyrmJM5Vs=; b=TKOXSI8WyHKR6KS4s3283uQe77s3cwVhKiCz1ra5ybA8l0Y/a0HaX4N+4f+iGJi2lyojFB vHYk6XP1iFOQxKX701HvzL6afFK6HMtmBYr/JonyoEM3IcGjfuA1gI6EFzi+z7x1CAerMa VPP6ktwk9YphRR5KTAifdlxrb9Cvyp8= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id CE27061464; Mon, 12 Aug 2024 18:54:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DC1EC32782; Mon, 12 Aug 2024 18:54:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1723488851; bh=2bny6AfsAGMYdxVlCPF5Px8+T2P7E6H7Ahh+CH8PgJI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=cad7xSwiJHQQlYF9O8N8m28AQFO/40Pbr/SPt4cS3c9yviejwxN2Oh4jRDCA149Tc g6AWHPfQgtxKQvxVY0+ndJyeAh8FS4fYs+bE3XBOPXwHKdHdgoF+wRwAUGn4MP2SQd pCyvVmwR81HI5w18JI5KLLhm3sFJCIIyo5/H2ftxzBcNNOvvQ01p9s31Fp28Vha5i8 vC1VOVVHfk+huKs1+oCVlueCm7RSu0+TW9ROmHXc8TCDlbRCDLko+dZnJ1HCRPGval ET7rwB0MoGcyAtOTIpqZSNXe/+doSqaj/K+GnnzJJzvSa2U4eon92luifigS8hXAoZ sIH7XtR+IZbQQ== Date: Mon, 12 Aug 2024 11:54:11 -0700 From: Kees Cook To: Erhard Furtner Cc: linux-mm@kvack.org, linuxppc-dev@lists.ozlabs.org, David Gow , kunit-dev@googlegroups.com Subject: Re: OVERFLOW_KUNIT_TEST fails with BUG: KASAN: stack-out-of-bounds in string_nocheck+0x168/0x1c8 (kernel 6.11-rc2, PowerMac G4 DP) Message-ID: <202408121146.1D02EB6E@keescook> References: <20240809231537.7c9ee7ea@yea> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240809231537.7c9ee7ea@yea> X-Rspamd-Queue-Id: C30EC140005 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: gh6j3s8a1fn8dcsrz5foyn85j1r5cenc X-HE-Tag: 1723488852-522254 X-HE-Meta: U2FsdGVkX1+FGuMQj1QDmzJK94cUVaJntqK4sas9YV9DTnGsO21nqfQNqC5lZMkahxUuaYIaWNUGUb+lQj3Ud8m6s4f3Yj16pTZpSKDQTykGSb+Xxf3JdhCrOOG8vTKfalkw+rsJRAdXMqOz2Ve0aewc2eqg7L6xnh5keQmoIsnbVk7s2XNvXskL/SJuBqw7KzCQM8sRH2JrhAwSLXPcnTkgwZS9MoUD7QJDpReXme9tr+O2ObVuA/W97DmYBejbeNZ4fhRcHKEDNB7BaK/HFB8z04afpO/4xL3UMkHCLMbNcU7HhZtlLhcBDdiENlll3aXxMtuz9MbpOlrDGzNsSxkUtbDj3OmNsuj8bUBnJxvqKp5taeDgu0F9aguXoTeZ/1xhi7In2zwZr+5TgmhpBOz6ok+/aUMclkfZOd/oAvCtRNOaMCDDiloxnmaBPgEboctK1MZ0MgwE8x6nbjXZrFjhkhoXPajrMeuuMI98c9CQFG7OUeIE8EBoeeEBxZiTb3PfKWmSOCGDN47p7onCJD5Ayh+XcQx9B1tDm0lZVMuH6KjN3BmTPaoNG4PXcP6HcgrLCW/6gja39OeomV9rmUq9nH4L+6fkP38io1Juadgasx+nPqTgbfL7FIbIp1sQDBF7RRchn5TqXmJOyfrwWIxngN02pXNRvyp8/9yavj/mOyxgaWBB1FuYN6W2v3PkbxbyQQWk/46UeKlu7jGUiUjsZLuSg9pIDOadZ93bO9qkXk23UcNrv/gaTPifXqS/dFv+CgwOur5Wx7MW9o5JbzK1Mssd1u5FQtV5GJiTv748Qd1/o6nJw8iVAZ1V1EckJ9IkBVbcPf+DzMT137hrmtVMQrHAX0WlDXFK03EE/CldhR3/YGTyjg+nLiMokDePMfyDS7T/92pkcms3JSuaOhX83W8ezv/YJBQD6nTvo6v2YcUHJV10DPLUx4PGJg2dRl/4y/eG44tdv3+gjoV 0Ez4MgS3 BGixFif+A4Lj3ep8BUFvw+o9g/dl10eimm4UXZoVniQhskdLBRcB5eR/jF+XnamgA84kYx4TSSwrslM+q5Ni+KwrsPTM2CC4tMRNKAzzb+dd1EUrLxW44pVew1cDN6LlQqSeZVjYGiN4AAwOl95jbUhX/9DmLEa9I5GjywnVlmonZsM69PHuZd1yAI+DxxLlGU8XJNzsF0Rab/5nOeFjLiMxH8EoFA5Vmj4nnmJ48NY+zmCmfl98NIXcN/d66mYTiHj8pDoXpSG54/3U= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000013, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Fri, Aug 09, 2024 at 11:15:37PM +0200, Erhard Furtner wrote: > Greetings! > > When KASAN is enabled the Overflow KUnit test fails: > > [...] > ok 16 shift_nonsense_test > # overflow_allocation_test: 11 allocation overflow tests finished > ================================================================== > BUG: KASAN: stack-out-of-bounds in string_nocheck+0x168/0x1c8 > Read of size 1 at addr c976be40 by task kunit_try_catch/1843 > > CPU: 0 UID: 0 PID: 1843 Comm: kunit_try_catch Tainted: G N 6.11.0-rc2-PMacG4 #1 > Tainted: [N]=TEST > Hardware name: PowerMac3,6 7455 0x80010303 PowerMac > Call Trace: > [c992fb80] [c16651c0] dump_stack_lvl+0x80/0xac (unreliable) > [c992fba0] [c04e0420] print_report+0xdc/0x504 > [c992fc00] [c04e01d8] kasan_report+0xf8/0x108 > [c992fc80] [c16ae4c8] string_nocheck+0x168/0x1c8 > [c992fcf0] [c16b37a4] string+0xa8/0xbc > [c992fd60] [c16b8134] vsnprintf+0x868/0x1750 > [c992fdf0] [c0b8490c] kvasprintf+0xa4/0x13c > [c992fe60] [c0b84c3c] kasprintf+0xb4/0xc8 > [c992fed0] [c0f4c954] module_remove_driver+0x1f0/0x2fc > [c992ff00] [c0f21628] bus_remove_driver+0x1d0/0x240 > [c992ff30] [bfd0cd40] kunit_put_resource+0x128/0x134 [kunit] > [c992ff50] [bfd0a120] kunit_cleanup+0x140/0x144 [kunit] > [c992ff90] [bfd10d64] kunit_generic_run_threadfn_adapter+0xf8/0x148 [kunit] > [c992ffc0] [c00f57e0] kthread+0x36c/0x37c > [c992fff0] [c0028304] start_kernel_thread+0x10/0x14 > > The buggy address belongs to the physical page: > page: refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x976b > flags: 0x0(zone=0) > raw: 00000000 00000000 eef2bb10 00000000 00000000 00000000 ffffffff 00000000 > raw: 00000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > c976bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > c976bd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >c976be00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 04 f2 > ^ > c976be80: 00 04 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 > c976bf00: 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 > ================================================================== > Disabling lock debugging due to kernel taint > not ok 17 overflow_allocation_test > # overflow_size_helpers_test: 43 overflow size helper tests finished > ok 18 overflow_size_helpers_test > # overflows_type_test: 378 overflows_type() tests finished > ok 19 overflows_type_test > # same_type_test: 0 __same_type() tests finished > ok 20 same_type_test > # castable_to_type_test: 75 castable_to_type() tests finished > ok 21 castable_to_type_test > ok 22 DEFINE_FLEX_test > # overflow: pass:21 fail:1 skip:0 total:22 > # Totals: pass:21 fail:1 skip:0 total:22 > not ok 1 overflow > > > This is reproducible on my machine and always happens when running the test via 'modprobe -v overflow_kunit'. Without KASAN enabled (but KFENCE) overflow_allocation_test passes. Hmm, this implies some kind of corruption is sneaking in and the kunit resource freeing code is exploding. I don't immediately see the problem, though. -- Kees Cook