From: Sasha Levin <sasha.levin@oracle.com>
To: Dave Hansen <dave.hansen@intel.com>, Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: BUG: KASAN: stack-out-of-bounds in sched_show_task
Date: Tue, 26 Jan 2016 08:47:01 -0500 [thread overview]
Message-ID: <56A778D5.2050508@oracle.com> (raw)
Hi all,
I've added a little "heartbeat" code to my testing which simply sysrq-t every two
minutes to get a snapshot of what's going on, which I added in hopes of tracking
down an odd lockup.
However, this sysrq call seems to produce the following quite often:
[4628498.116069] BUG: KASAN: stack-out-of-bounds in sched_show_task+0x28a/0x3b0 at addr ffff8802c9a47e08
[4628498.116933] Read of size 8 by task runtrin.sh/8510
[4628498.117431] page:ffffea000b2691c0 count:0 mapcount:0 mapping: (null) index:0x0
[4628498.118232] flags: 0x26fffff80000000()
[4628498.118637] page dumped because: kasan: bad access detected
[4628498.119229] CPU: 3 PID: 8510 Comm: runtrin.sh Not tainted 4.4.0-next-20160125-sasha-12175-gc123483-dirty #2836
[4628498.120288] 1ffff100510e0f3c 0000000056bd98e4 ffff880288707a60 ffffffffa34489f1
[4628498.121119] 0000000041b58ab3 ffffffffaf6f3d88 ffffffffa3448926 0000000000000000
[4628498.121885] ffff880200000000 0000000000000000 0000000000000000 ffffea000b2691c0
[4628498.122655] Call Trace:
[4628498.122930] dump_stack (lib/dump_stack.c:52)
[4628498.123459] ? _atomic_dec_and_lock (lib/dump_stack.c:27)
[4628498.124081] kasan_report_error (mm/kasan/report.c:150 mm/kasan/report.c:236)
[4628498.124671] ? vprintk_default (kernel/printk/printk.c:1879)
[4628498.125246] ? rt_mutex_top_waiter.part.7 (kernel/printk/printk.c:1904)
[4628498.125881] ? sched_show_task (kernel/sched/core.c:5021)
[4628498.126452] __asan_report_load8_noabort (mm/kasan/report.c:259 mm/kasan/report.c:280)
[4628498.127068] ? sched_show_task (kernel/sched/core.c:5021)
[4628498.127641] sched_show_task (kernel/sched/core.c:5021)
[4628498.128202] show_state_filter (kernel/sched/core.c:5058)
[4628498.128805] sysrq_handle_showstate (drivers/tty/sysrq.c:281)
[4628498.129396] __handle_sysrq (include/linux/rcupdate.h:929 drivers/tty/sysrq.c:573)
[4628498.129959] ? __might_sleep (kernel/sched/core.c:7666 (discriminator 14))
[4628498.130607] write_sysrq_trigger (drivers/tty/sysrq.c:1097)
[4628498.131198] proc_reg_write (fs/proc/inode.c:217)
[4628498.131764] ? sysrq_filter (drivers/tty/sysrq.c:1091)
[4628498.132318] __vfs_write (fs/read_write.c:529)
[4628498.132855] ? proc_reg_poll (fs/proc/inode.c:210)
[4628498.133420] ? vfs_iter_write (fs/read_write.c:527)
[4628498.133993] ? __fd_install (fs/file.c:606 (discriminator 3))
[4628498.134548] ? check_preemption_disabled (lib/smp_processor_id.c:52)
[4628498.135194] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[4628498.135824] ? update_fast_ctr (./arch/x86/include/asm/preempt.h:92 kernel/locking/percpu-rwsem.c:57)
[4628498.136385] vfs_write (fs/read_write.c:579)
[4628498.136895] SyS_write (fs/read_write.c:626 fs/read_write.c:617)
[4628498.137398] ? SyS_read (fs/read_write.c:617)
[4628498.137915] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
[4628498.138528] Memory state around the buggy address:
[4628498.139010] ffff8802c9a47d00: f4 f2 f2 f2 f2 00 f4 f4 f4 f3 f3 f3 f3 00 00 00
[4628498.139710] ffff8802c9a47d80: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
[4628498.140554] >ffff8802c9a47e00: f4 f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00
[4628498.141301] ^
[4628498.141652] ffff8802c9a47e80: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 f4
[4628498.142372] ffff8802c9a47f00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
This is pointing to:
void sched_show_task(struct task_struct *p)
{
unsigned long free = 0;
int ppid;
unsigned long state = p->state;
if (state)
state = __ffs(state) + 1;
printk(KERN_INFO "%-15.15s %c", p->comm,
state < sizeof(stat_nam) - 1 ? stat_nam[state] : '?');
#if BITS_PER_LONG == 32
if (state == TASK_RUNNING)
printk(KERN_CONT " running ");
else
printk(KERN_CONT " %08lx ", thread_saved_pc(p));
#else
if (state == TASK_RUNNING)
printk(KERN_CONT " running task ");
else
printk(KERN_CONT " %016lx ", thread_saved_pc(p)); <=== HERE
Thanks,
Sasha
reply other threads:[~2016-01-26 13:49 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56A778D5.2050508@oracle.com \
--to=sasha.levin@oracle.com \
--cc=dave.hansen@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome