From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757535AbdKGMDl (ORCPT ); Tue, 7 Nov 2017 07:03:41 -0500 Received: from mail-db5eur01on0099.outbound.protection.outlook.com ([104.47.2.99]:8863 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752931AbdKGMDj (ORCPT ); Tue, 7 Nov 2017 07:03:39 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170 To: Fengguang Wu , linux-kernel@vger.kernel.org Cc: Petr Mladek , Sergey Senozhatsky , Steven Rostedt , Linus Torvalds , Andrew Morton , Aleksey Makarov , Ingo Molnar , Nicolas Pitre , Dmitry Vyukov , Alexander Potapenko References: <20171107093921.ulnjqoaycig5qqoy@wfg-t540p.sh.intel.com> From: Andrey Ryabinin Message-ID: <51c8afc1-263a-ed9a-855a-761e44a6f158@virtuozzo.com> Date: Tue, 7 Nov 2017 15:06:53 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20171107093921.ulnjqoaycig5qqoy@wfg-t540p.sh.intel.com> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1P189CA0004.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:2a::17) To AM4PR08MB2819.eurprd08.prod.outlook.com (2603:10a6:205:d::25) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f0a684d0-6d5e-4598-5ca2-08d525d792ff X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603199);SRVR:AM4PR08MB2819; X-Microsoft-Exchange-Diagnostics: 1;AM4PR08MB2819;3:1aXpuGIHa3zxOKuKjaESzGgh26Sn0bkHYINaroLpVVbxKpFK+Hkhx+s9aRLpSZwkcGz+yLgZkOqvoXhjhXgrETXEYWNiEA1EuPszIoH2qXui9ULm5DoPpw7lWO9cTKebehN839zuUJmrnMFG4/L/hUNibqtznGeSNkG4gEHDzMuUXQ4MD2G0hte8/ES+bkv12gVKZQoWUbwgTQovjRKUOF7ZH+Z3k3sgEtkZPT2S12t9Tz8hCsXSzZjTgfJTe07F;25:0WSJElwxCkWfGXjEi0X2PWYeYkpK7wq290bCHywCnGNLmxG18Af7sHkfwnZYo7Qb0wNE++Ctaj5y9pKwSVCa8DNaOkIgo9txnP8fOjzu3DBdAYbv7qpTOHa301WFo7hIiyrZmppOkLMsHYV6alr96Z5LZqfrcRB13GhfQOGsWGaDfvNMpcMMTTIk9YelngCMN0ZpSaD3MM2hfBADmqh7XA3sdQRte/cMrS80qWL5rUdJ+PX4e4aj0jMRhVbuoleeX22M5LCvxWKMJdLHVKIDVBXY7AeOAtaghumEvwi5FRABs4tJZQx5tGAmo8PPkcuS8THK6eQAgSVxbUBmV6hJjw==;31:nloud1y0jPqgsNnBj5spId9aB9o3Bh+0q3gYNxehoOK3lRUETXACPoknU8z17LW3c/TffAOZU1pL4FQ/ioq5IAKFv3EthhHT5RaBDfVj0x+YXSvBuSDpgON9JbuLA93RYHiMoco/Y3AVSnHAFeTw4gdtijtcy9q3bR2xhjkXpmoa5xDsSWVf4T65hp/H2joMcoQcB2hFvTqDfAQwOJxkngbeqtM8fFHiE1ld7nZQBSU= X-MS-TrafficTypeDiagnostic: AM4PR08MB2819: X-Microsoft-Exchange-Diagnostics: 1;AM4PR08MB2819;20:HrvARBjJAPcCLJ4dOvRkkIY1VurEt1CqNkOcCs0+HLQfeanSsZv9Y14z64iuuiayTUmPJNvzBPkZNHvCh5nf+t/FuAwf9weO5Z6KUnpv31DzgPbG2eoyghYS2r1tmNEr8ua42pf4YId2OWLjE6sAsC1Ilvgl7aJiuoxWAYHa7oLlMgHdriidd9bf+/1QbTP/xPeF/kO6vUDLR4Qek7mJU84cM1B67fKYPkhP4BWlbS0+FXPIPxA8vRr67zcrDfIFEirqVBc6Y2hM/7EErosbogxXKROLPM5oHFef8SEmhTleU/tJ4/1LtZmAEnUOqq5f7wPS89b29D0E5BRKp9beYDmczQDwU3UjdmP3ASH3geMsKYv+o69lNf5O+qO7h402BFA7I/MHtmJgr3/T5a+OqEEHLAOMoMWUEHBaxwpEryE=;4:vEn2hLDBo1ttdQhx/k/MPNnNhS1IxewuFSbddN61majrpiUqgZqZZrSdaE2PFrVgSwS+JURYwNFjDMFKqjhg5GMP4lB/AzcTcAFxemMMPXSXJUiUK4ivUzgjb80urOz8LcEztCVkmUXvkxzu5K48yUn+LPkQWPCHv6wpKAOb7HRLPrdCqpvFVciQJKwlipnWHPZQgpUwTNaO1ttIvHLhw+v9SXMgjmis1BXl47UJnA4fVAdvZjLXquXyzot3VwwL5oEJA1e/gjTkoQ9U12Y2CBFOOOgxDu/tg+HTo5OLbeezUQoTvAP+Ji8YLsvygVAhYat3nEwgo0G3arsVwmkGl7KZ9RVLT+8+Ukk98JNEBAk= X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(42068640409301); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(100000703101)(100105400095)(3231021)(10201501046)(3002001)(6041248)(20161123560025)(20161123562025)(20161123558100)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:AM4PR08MB2819;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:AM4PR08MB2819; X-Forefront-PRVS: 0484063412 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6049001)(6009001)(376002)(346002)(39830400002)(69234005)(199003)(24454002)(189002)(54356999)(97736004)(101416001)(16526018)(305945005)(76176999)(7736002)(50986999)(230700001)(83506002)(3846002)(6116002)(189998001)(23746002)(8676002)(8936002)(105586002)(81166006)(81156014)(36756003)(33646002)(68736007)(6486002)(6666003)(2950100002)(77096006)(25786009)(65826007)(5660300001)(106356001)(229853002)(31686004)(54906003)(58126008)(316002)(16576012)(230783001)(966005)(53546010)(50466002)(478600001)(64126003)(86362001)(575784001)(47776003)(4326008)(31696002)(53936002)(6246003)(2906002)(7416002)(65806001)(39060400002)(66066001)(65956001)(6306002);DIR:OUT;SFP:1102;SCL:1;SRVR:AM4PR08MB2819;H:[172.16.25.12];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;AM4PR08MB2819;23:os3W4uLI5/R+xKQTokNaPDoMJ4a03i+aLyJRN?= =?Windows-1252?Q?zXFq4tbaRRRjc+d9H74nHBKAT/zOuyC8KHJswyshXunpzNf1np+otKwI?= =?Windows-1252?Q?ZKFszK66K/MvoYe1+b5VJwXf9U4FA+BxyqUJb2Y48R0MV+qbSsMILXIE?= =?Windows-1252?Q?QxoJUlfTWmkp7jZPJVBNOup/D29kBoFC8+s8ImpRnBbwAwqxkd1xhL/h?= =?Windows-1252?Q?Mw1eQulwbNTkgICmS7arBAx8/Hc101GwLk+pqz64RxFWwgey2ZyFScAx?= =?Windows-1252?Q?hdhhq+1yV6M8xXVdPNa/d7jmu6m2ua8URt9d95DjakgZmt0zp+5NkD8F?= =?Windows-1252?Q?dnQmp5iWFqM82ZhE47UnKhEXwNSCIznbBLMoXi9QxquioVBNOu+rarS5?= =?Windows-1252?Q?t1GNDUD17PzNf7aFWLJyqPkUfHk6MIy9Zfp9b1njtx+Y+yHH0CS2a9+4?= =?Windows-1252?Q?VIpeQOfC/RMGLxCSGC+eMbdPBc7xFxnD5G4NmdcrC2mp9pvBtn8sIuLQ?= =?Windows-1252?Q?gGYt2OmHyc/UMXKgWd2dMPwAM7awuxJU7tbJi70hnlxwX5J+IdBh3nax?= =?Windows-1252?Q?6XKT9CiB8wOWHsPLcRhKqtRfUnaAuC4SkvaD2TxW0YRGjx1B/0pEeVUn?= =?Windows-1252?Q?M6Hc1lJRZdGuHbazmytZ9p+5PNzoKuU3YFvRsDHl0J3hOkZSQc3QmXYd?= =?Windows-1252?Q?onSBxmyssI/Lixj2ikDOnvy3bQGZYjPrXNq/XmWFcNc9W2DzeonQkCbx?= =?Windows-1252?Q?JqtSzCb36vOqqUN5HArB/a9DkZzjwYYy8z1o42aPj7kPACS231vRXl/v?= =?Windows-1252?Q?YQomob7UppnEu9TQNMfiLXRw3+wdTxWKD6VnMPi832fK6T05MRWx6kyt?= =?Windows-1252?Q?EoNrENNXD1Qfwa3wEzjTc2wpNUzSAlMBMdMjUnApcEiGJFLvmSit9BDV?= =?Windows-1252?Q?KMz/1HJztGMdsG022FYaCIF9dxDM0OS0zMRC3+/HuZV1nCYLF6zOcMd/?= =?Windows-1252?Q?mepTrYqssWxTi3g0qjUFIjpAVf2eqMgV/bxceUpfVXtbT7Uk/WkEMCRh?= =?Windows-1252?Q?3UnKCRAm8Q2esOMaYy0WuFgH79DEPyvKC0gQexSprjhd4h8Tha4D8vwe?= =?Windows-1252?Q?DLbEOm4sW7IcEEL1Z3CAYeRrT10JLtEadwEC5P1FqOPo8Ts1Pn10Unn4?= =?Windows-1252?Q?svIkdyOuF8L8/6F5yFaaPJuqZuXYq1M/r6uKSfjlm9+IWlR7iAdqdaOQ?= =?Windows-1252?Q?gPlf4ZOL7jAS2tXsfY55AQMZO7EGDijSIn7umWD0rO5ftou2wUvSehFL?= =?Windows-1252?Q?NWFsvfNZswiOKwFWNJpNGZaWzQS4sKIbQJ/qN33XYgfCQ+VfeX5slQUt?= =?Windows-1252?Q?YtkK32KDaGgfCfFlb09l7gSMfm0at1IczFtUbrMTt2EpG+9W5P9U/Oqu?= =?Windows-1252?Q?864sE+veVx6SJ/tQ6lwgA+QH4KhmLvNcJ73vsXn9RXZEoTKX/UxJsAeP?= =?Windows-1252?Q?esQgLlgSV8ulq8g75l2k1DOPLQtDjHWkybMZOQOXRILVPPwfwPHOpqi0?= =?Windows-1252?Q?VntfUraHmk7YoDjmXEuwJJXmFui/oMRWQioiui0YLd2Ca1Fkjy0C8a/4?= =?Windows-1252?B?QT09?= X-Microsoft-Exchange-Diagnostics: 1;AM4PR08MB2819;6:mYOvEVbWQFok+xij1PRWoy62kC9ELf5dgKHtnTAXWPgY5OFXibNEONXaaTAnQQZkU3OfI53NO8nKmGsXz/NMJsVsDPmL4cG/OiGcvc5g4Xj1Q4kkiGlR884VWXfKkrfHhFHAbQMMeRaxIs/SL3gaj8ndgzU4W5Xz0fh0sI7m1CwkR0zt+izWC/AuKs0Ev8817/vbwJx3YA9UaRDa2o3USo9wqq7kuowBtik79w27GMwSXLg+jbfcRNqA8tFMhqsZiEVXXz40RIPu6KIFysi0qF+OihRwKrxsN1ZukKxxYQbsmma1rOifjkpeg1N8dCwj/VEk7u2urm1oOfI0JZAi5IoINLRhp+Yz5Y5Y14wLGnQ=;5:PrqS7vfsOj+CaEuxQAYjAmmAh0CQu9Kq3CWv8/x3CEnhMuZmEHgpC8gAJFIlG0glEm+dse2ePmGjHrLSkXDSsAvLzxhqTCsw/hpC6iQZa1qITXDz2JmExqdL4wkdA/dEeLGN9lxI74sMLaHwbMgKFquGlxT+5Ney4UpUISarjsw=;24:iKqk5Gj1GF8ymsqwXOEPjHGrY3jc5H26njPASVCpogT4Ag6uJXWYGtXbdzayJYt3WanYpbiR6oplo9mOMyMflopP4sCCv6d4mtSX9RPJ9Pw=;7:oB6pVGsDpZaySdrXQynXhFa/8009MXis4N8ALiTF3BAG1JI1wgyeTFDk2JxQ7qbaIy7/Utq1Ci714fuwmSdBtKTv+83n/1ugRvZro+gE53WmGntSUNoV96gibBe12S+h42FXgh9j0PcN+34VcECOfijYtW6VH1xvlcJgZXKPhy+ItGzGzJC+wbN17aX6jdx6x/9jLm1dYanWxW8ICPwcfE5gFc4bbMUTA8ZWa+eUnDe3PClXPtn6uK2w18mSw6tR SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM4PR08MB2819;20:RfSaJtqfhIh5mJ1s15gpN0eXvSj96ARoHC6+KStuJ0DPUG2vH1+h09Yz+LmWE+fOsSmYmELIk8CnpVBmxPAq6ZwhO2n5LF3Yscyiua/R9zT/4Ji0e26myU0IQpM/ZZkOKuxpAt9r35+z9TxzCRv6dM55aAiQXxWIIftD3ppiYJE= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Nov 2017 12:03:34.5792 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f0a684d0-6d5e-4598-5ca2-08d525d792ff X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR08MB2819 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/07/2017 12:39 PM, Fengguang Wu wrote: > Hello, > > FYI this happens in v4.14-rc8 -- it's not necessarily a new bug. > > [ 22.184920] Freeing unused kernel memory: 824K > [ 22.199198] Freeing unused kernel memory: 1436K > [ 22.228460] x86/mm: Checked W+X mappings: passed, no W+X pages found. > [ 22.230474] rodata_test: all tests were successful > [ 22.254830] ================================================================== > [ 22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170 > [ 22.258648] Write of size 26 at addr ffff880013432540 by task init/1 > [ 22.260272] It says that we write 26 bytes starting from ffff880013432540. But according to the dump of shadow memory: [ 22.297667] >ffff880013432500: fc fc fb fb fb fb fc fc 00 00 00 03 fc fc fb fb [ 22.298581] ^ we have allocated 27 bytes at address stating from ffff880013432540. So this looks like a false positive. I've seen reports like this before: https://lkml.kernel.org/r/<5163c242-4bbe-7fec-ab58-9c360abf0afd@virtuozzo.com> https://lkml.kernel.org/r/<899f0c39-81b5-5d02-5ced-937884d22c89@gmail.com> This happens only on old gcc versions, in your case it's 4.6: [ 0.000000] Linux version 4.14.0-rc8 (kbuild@lkp-wsx01) (gcc version 4.6.4 (Debian 4.6.4-7)) #14 SMP PREEMPT Tue Nov 7 06:50:21 CST 2017 Old GCC is misscompiling something in check_memory_region() which cause false-positive like this one. I never bothered to dig it deeper, because I've never seen this with GCC versions (>= 4.9.2) that actually support KASAN. It's almost pointless to use KASAN=y kernel built with old GCC. All memory accesses, except manually instrumented with kasan_check_[read|write](), won't be checked.