From: Mike Galbraith <efault@gmx.de>
To: LKML <linux-kernel@vger.kernel.org>
Subject: BUG: KASAN: slab-out-of-bounds in acpi_cppc_processor_probe+0x15c/0xa50
Date: Fri, 16 Apr 2021 16:15:57 +0200 [thread overview]
Message-ID: <cdd087832f06a10d4c8f753c37cf2afec2cf1b6d.camel@gmx.de> (raw)
[ 6.343387] BUG: KASAN: slab-out-of-bounds in acpi_cppc_processor_probe+0x15c/0xa50
[ 6.343474] Read of size 4 at addr ffff888120cf1630 by task swapper/0/1
[ 6.343565] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G I 5.12.0.g8b1fdf9-tip #2
[ 6.343654] Hardware name: HP HP Spectre x360 Convertible/804F, BIOS F.47 11/22/2017
[ 6.343735] Call Trace:
[ 6.343766] ? acpi_cppc_processor_probe+0x15c/0xa50
[ 6.343824] dump_stack+0x8a/0xb5
[ 6.343865] print_address_description.constprop.0+0x16/0xa0
[ 6.343931] kasan_report+0xcb/0x110
[ 6.343974] ? acpi_cppc_processor_probe+0x15c/0xa50
[ 6.344032] acpi_cppc_processor_probe+0x15c/0xa50
[ 6.344086] ? mutex_unlock+0x1d/0x40
[ 6.344130] ? kernfs_add_one+0x1b1/0x210
[ 6.344177] ? __might_sleep+0x31/0xd0
[ 6.344223] ? acpi_get_psd_map+0x2d0/0x2d0
[ 6.344271] ? mutex_lock+0x91/0xd0
[ 6.344313] __acpi_processor_start+0x4e/0x150
[ 6.344364] acpi_processor_start+0x3d/0x60
[ 6.344412] really_probe+0x182/0x6c0
[ 6.344458] driver_probe_device+0x13f/0x1d0
[ 6.346259] device_driver_attach+0x110/0x120
[ 6.347081] ? device_driver_attach+0x120/0x120
[ 6.347081] __driver_attach+0xae/0x190
[ 6.347081] ? device_driver_attach+0x120/0x120
[ 6.347081] bus_for_each_dev+0xd8/0x120
[ 6.347081] ? subsys_dev_iter_exit+0x10/0x10
[ 6.347081] bus_add_driver+0x1f8/0x2e0
[ 6.347081] driver_register+0x10f/0x190
[ 6.347081] acpi_processor_driver_init+0x2f/0xc3
[ 6.347081] ? acpi_pci_slot_init+0x11/0x11
[ 6.347081] do_one_initcall+0x71/0x260
[ 6.347081] ? trace_event_raw_event_initcall_finish+0x120/0x120
[ 6.347081] ? parameq+0x90/0x90
[ 6.347081] ? kasan_unpoison+0x21/0x50
[ 6.347081] ? __kasan_slab_alloc+0x24/0x70
[ 6.347081] do_initcalls+0xff/0x129
[ 6.347081] kernel_init_freeable+0x19c/0x1ce
[ 6.347081] ? rest_init+0xc6/0xc6
[ 6.347081] kernel_init+0xd/0x11a
[ 6.347081] ret_from_fork+0x1f/0x30
[ 6.347081] Allocated by task 1:
[ 6.347081] kasan_save_stack+0x1b/0x40
[ 6.347081] __kasan_kmalloc+0x7a/0x90
[ 6.347081] acpi_ut_initialize_buffer+0x41/0x8b
[ 6.347081] acpi_evaluate_object+0x306/0x395
[ 6.347081] acpi_evaluate_object_typed+0xd4/0x201
[ 6.347081] acpi_cppc_processor_probe+0xa0/0xa50
[ 6.347081] __acpi_processor_start+0x4e/0x150
[ 6.347081] acpi_processor_start+0x3d/0x60
[ 6.347081] really_probe+0x182/0x6c0
[ 6.347081] driver_probe_device+0x13f/0x1d0
[ 6.347081] device_driver_attach+0x110/0x120
[ 6.347081] __driver_attach+0xae/0x190
[ 6.347081] bus_for_each_dev+0xd8/0x120
[ 6.347081] bus_add_driver+0x1f8/0x2e0
[ 6.347081] driver_register+0x10f/0x190
[ 6.347081] acpi_processor_driver_init+0x2f/0xc3
[ 6.347081] do_one_initcall+0x71/0x260
[ 6.347081] do_initcalls+0xff/0x129
[ 6.347081] kernel_init_freeable+0x19c/0x1ce
[ 6.347081] kernel_init+0xd/0x11a
[ 6.347081] ret_from_fork+0x1f/0x30
[ 6.347081] The buggy address belongs to the object at ffff888120cf1600
which belongs to the cache kmalloc-64 of size 64
[ 6.347081] The buggy address is located 48 bytes inside of
64-byte region [ffff888120cf1600, ffff888120cf1640)
[ 6.347081] The buggy address belongs to the page:
[ 6.347081] page:000000001f073982 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120cf1
[ 6.347081] flags: 0x8000000000000200(slab)
[ 6.347081] raw: 8000000000000200 dead000000000100 dead000000000122 ffff888100042640
[ 6.347081] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[ 6.347081] page dumped because: kasan: bad access detected
[ 6.347081] Memory state around the buggy address:
[ 6.347081] ffff888120cf1500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 6.347081] ffff888120cf1580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 6.347081] >ffff888120cf1600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 6.347081] ^
[ 6.347081] ffff888120cf1680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 6.347081] ffff888120cf1700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
reply other threads:[~2021-04-16 14:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cdd087832f06a10d4c8f753c37cf2afec2cf1b6d.camel@gmx.de \
--to=efault@gmx.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®