From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7D3BC001DB for ; Fri, 4 Aug 2023 17:36:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231349AbjHDRgg (ORCPT ); Fri, 4 Aug 2023 13:36:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229731AbjHDRgY (ORCPT ); Fri, 4 Aug 2023 13:36:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0542C4EF1 for ; Fri, 4 Aug 2023 10:36:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0C9BF620D3 for ; Fri, 4 Aug 2023 17:36:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20455C433C7; Fri, 4 Aug 2023 17:36:04 +0000 (UTC) Date: Fri, 4 Aug 2023 13:36:01 -0400 From: Steven Rostedt To: Sven Schnelle Cc: linux-kernel@vger.kernel.org Subject: Re: BUG: KASAN: slab-out-of-bounds in print_synth_event+0xa68/0xa78 Message-ID: <20230804133601.40cb5fe9@gandalf.local.home> In-Reply-To: References: <20230804115033.34c2b5af@gandalf.local.home> X-Mailer: Claws Mail 3.19.1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 04 Aug 2023 18:32:48 +0200 Sven Schnelle wrote: > > Can you show where exactly the above line is? > > It is: > > (gdb) list *(print_synth_event+0xa68) > 0x5e4f60 is in print_synth_event (/home/svens/ibmgit/linux/kernel/trace/trace_events_synth.c:410). > 405 p = (void *)entry + data_offset; > 406 end = (void *)p + len - (sizeof(long) - 1); > 407 > 408 trace_seq_printf(s, "%s=STACK:\n", se->fields[i]->name); > 409 > 410 for (; *p && p < end; p++) I think that conditional needs to be swapped. Can you test the following change and see if the problem disappears? > 411 trace_seq_printf(s, "=> %pS\n", (void *)*p); > 412 n_u64++; > 413 > 414 } else { -- Steve diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c index dd398afc8e25..1e266e6436a0 100644 --- a/kernel/trace/trace_events_synth.c +++ b/kernel/trace/trace_events_synth.c @@ -407,7 +407,7 @@ static enum print_line_t print_synth_event(struct trace_iterator *iter, trace_seq_printf(s, "%s=STACK:\n", se->fields[i]->name); - for (; *p && p < end; p++) + for (; p < end && *p; p++) trace_seq_printf(s, "=> %pS\n", (void *)*p); n_u64++;