From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A474C00140 for ; Mon, 8 Aug 2022 20:53:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EB34A8E0001; Mon, 8 Aug 2022 16:53:38 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E61B66B0073; Mon, 8 Aug 2022 16:53:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D02798E0001; Mon, 8 Aug 2022 16:53:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id C1BBD6B0071 for ; Mon, 8 Aug 2022 16:53:38 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 9A3BB80950 for ; Mon, 8 Aug 2022 20:53:38 +0000 (UTC) X-FDA: 79777626516.13.AC13177 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by imf24.hostedemail.com (Postfix) with ESMTP id 0665618005E for ; Mon, 8 Aug 2022 20:53:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1659992017; x=1691528017; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=1Ue2xN40eUBwKJ8OkKXT1hJPXDlo2/nde1JLXmk8FQ0=; b=S7TBuCubiGbnevfM42tyRWqEQaXkK88tyJM/Xn8mfHw4U6VjCGvP6/p3 7D/k64e+Z0c2Ef+xxmHRaDP4EHcfNs3+OpcGltYJ/RIKbH9RctZapnGcf 3801iOFzs+cFBbZMy86NQpV6UEFi7v9+n7OIO8OEGN4L0EukuPvzHH4QK 1FaAvKSmSzhDWSDxVwR3R3BIkcPgjMDSdq13MB0g3OyzRuJKmki/ANpVE J6tIOF1lQ2EMWhIr6B/itLREsXZEMfqtABeCWSUFAoupnL4AEoNNJZWxG MQWrwnZ2lecVJS50lyBzNKFc/gEFjefGABN/UoLJpys2PljEXjqgc3z51 Q==; X-IronPort-AV: E=McAfee;i="6400,9594,10433"; a="273739710" X-IronPort-AV: E=Sophos;i="5.93,222,1654585200"; d="scan'208";a="273739710" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Aug 2022 13:53:35 -0700 X-IronPort-AV: E=Sophos;i="5.93,222,1654585200"; d="scan'208";a="850224595" Received: from punajuuri.fi.intel.com (HELO paasikivi.fi.intel.com) ([10.237.72.43]) by fmsmga006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Aug 2022 13:53:32 -0700 Received: from paasikivi.fi.intel.com (localhost [127.0.0.1]) by paasikivi.fi.intel.com (Postfix) with SMTP id 00C38200F1; Mon, 8 Aug 2022 23:53:30 +0300 (EEST) Date: Mon, 8 Aug 2022 20:53:30 +0000 From: Sakari Ailus To: "Rafael J. Wysocki" Cc: LKML , Linux Memory Management List , linux-acpi@vger.kernel.org, lkp@lists.01.org, lkp@intel.com, kernel test robot Subject: Re: [ACPI] 1d52f10917: BUG:KASAN:use-after-free_in_strlen Message-ID: References: <57f48ba3-d01c-f3d8-8e33-65d3cd9a349e@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <57f48ba3-d01c-f3d8-8e33-65d3cd9a349e@intel.com> ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1659992018; a=rsa-sha256; cv=none; b=Y6BVFdSZcRY7ryGaLLYwkX5V0YPIqMRW5H707N97ggxNLIoLg90wMxF0frpTUi0pfXnKz2 Jpu9QQxzUQyCkBug4sblBcYOnfgBT6HALpbJX/cjepu6fsQu5t6HcVPcmKObQvkjcQYliN IHohhOCxi51WRTqDTRCkoc0sake9fok= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1659992018; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=JG+l53oeSgjHJS9LHSxZ0HSXy+/tNqQslghRNLa9Ylk=; b=cgXOF7yCJugo7fXECfihDEnxDgy0iIG8yxtGgZvUO20UQb5N4t+y1reU5kdmAN7lEk/XDi SOBoUtOPuL/tDWxqA4D3mME9pupUlrqx8HMZBASZWKOtj7J3HVTLlVdPCC69g0DkXl4Bl6 P1jAULzrioZFB8HvMnG+RW5Y87MPdII= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=S7TBuCub; spf=none (imf24.hostedemail.com: domain of sakari.ailus@linux.intel.com has no SPF policy when checking 134.134.136.126) smtp.mailfrom=sakari.ailus@linux.intel.com; dmarc=fail reason="No valid SPF" header.from=intel.com (policy=none) X-Stat-Signature: tsanypszgftog8m9sk3f9kjt17zscqzy X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 0665618005E Authentication-Results: imf24.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=S7TBuCub; spf=none (imf24.hostedemail.com: domain of sakari.ailus@linux.intel.com has no SPF policy when checking 134.134.136.126) smtp.mailfrom=sakari.ailus@linux.intel.com; dmarc=fail reason="No valid SPF" header.from=intel.com (policy=none) X-HE-Tag: 1659992016-876323 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi Rafael, On Mon, Aug 08, 2022 at 06:54:49PM +0200, Rafael J. Wysocki wrote: > Hi Sakari, > > On 8/7/2022 2:45 PM, kernel test robot wrote: > > > > Greeting, > > > > FYI, we noticed the following commit (built with gcc-11): > > > > commit: 1d52f10917a751f90e269a0ed9b6cca60dbe0300 ("ACPI: property: Tie data nodes to acpi handles") > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > in testcase: xsave-test > > version: xsave-test-x86_64-c2e44fa-1_20220609 > > with following parameters: > > > > ucode: 0xec > > > > > > > > on test machine: 12 threads 1 sockets Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz with 16G memory > > > > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): > > > > > > > > If you fix the issue, kindly add following tag > > Reported-by: kernel test robot > > The crash below occurs right after a "Can't tag data node" message from > acpi_tie_nondev_subnodes() and I'm really unsure why acpi_attach_data() has > failed here, because none of the arguments is NULL. > > Can you have a look at this, please? Thanks for forwarding this to me. Faulty error handling code appears to be the direct cause for the crash. It releases buf.pointer which was still being used by the properties --- even if tagging data nodes failed (for whatever reason). It'd be cool if someone could send me DSDT/SSDT from this machine. I wonder if there's a data node that is referred to from more than one location, and whether that could lead to two references to the same acpi_handle. I'd hope this could be disallowed in DSD Guide. I'll send a patch soon. -- Kind regards, Sakari Ailus