linux-kernel - [lkp] [x86/mm] 48913aacc7: BUG: KASAN: stack-out-of-bounds in reserve_bootmem_region+0x7e/0x92 at addr ffffea00000cfce8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 29 Dec 2015 09:05:09 +0800
From:	kernel test robot <ying.huang@...ux.intel.com>
TO:	Andy Lutomirski <luto@...nel.org>
CC:	LKML <linux-kernel@...r.kernel.org>
Subject: [lkp] [x86/mm] 48913aacc7: BUG: KASAN: stack-out-of-bounds in
 reserve_bootmem_region+0x7e/0x92 at addr ffffea00000cfce8

FYI, we noticed the below changes on

https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git x86/pcid
commit 48913aacc754c8ed74a4ffb4f97dc4c1462106ff ("x86/mm: If INVPCID is available, use it to flush global mappings")


+----------------+------------+------------+
|                | a36de2a72b | 48913aacc7 |
+----------------+------------+------------+
| boot_successes | 63         | 0          |
+----------------+------------+------------+



[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
[    0.000000] ==================================================================
[    0.000000] BUG: KASAN: stack-out-of-bounds in reserve_bootmem_region+0x7e/0x92 at addr ffffea00000cfce8
[    0.000000] Write of size 8 by task swapper/0
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.4.0-rc5-00003-g48913aa #3
[    0.000000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[    0.000000]  0000000000000000 ffffffff83ec7d20 ffffffff83630136 1ffffd4000019f9d
[    0.000000]  ffffffff83ec7d98 ffffffff833d61c4 ffffffff843106e4 0000000000000082
[    0.000000]  0000000000000000 ffffffff8428d680 ffffffff83ec7d60 ffffffff8321a8bf
[    0.000000] Call Trace:
[    0.000000]  [<ffffffff83630136>] dump_stack+0x4b/0x6c
[    0.000000]  [<ffffffff833d61c4>] kasan_report+0x347/0x48b
[    0.000000]  [<ffffffff843106e4>] ? reserve_bootmem_region+0x7e/0x92
[    0.000000]  [<ffffffff8321a8bf>] ? wrmsrl+0x10/0x12
[    0.000000]  [<ffffffff833d5608>] __asan_store8+0x26/0x68
[    0.000000]  [<ffffffff843106e4>] reserve_bootmem_region+0x7e/0x92
[    0.000000]  [<ffffffff842e9ea7>] free_all_bootmem+0xdb/0x1d0
[    0.000000]  [<ffffffff842e9dcc>] ? reset_all_zones_managed_pages+0x3e/0x3e
[    0.000000]  [<ffffffff842ccf18>] ? sort_iommu_table+0x8c/0x106
[    0.000000]  [<ffffffff842cce8c>] ? find_dependents_of+0x59/0x59
[    0.000000]  [<ffffffff842dc21b>] ? add_pcspkr+0xae/0xae
[    0.000000]  [<ffffffff842dc299>] ? pci_xen_swiotlb_detect+0x8/0x8
[    0.000000]  [<ffffffff842dc2c6>] ? pci_swiotlb_init+0x2d/0x2d
[    0.000000]  [<ffffffff842cce6e>] ? find_dependents_of+0x3b/0x59
[    0.000000]  [<ffffffff842cd01c>] ? check_iommu_entries+0x8a/0xd3
[    0.000000]  [<ffffffff842dd2d0>] mem_init+0xe/0x4a
[    0.000000]  [<ffffffff842c4f6e>] start_kernel+0x2d3/0x522
[    0.000000]  [<ffffffff842c4c9b>] ? thread_info_cache_init+0x6/0x6
[    0.000000]  [<ffffffff84312aa1>] ? memblock_reserve+0x4a/0x4f
[    0.000000]  [<ffffffff842c4120>] ? early_idt_handler_array+0x120/0x120
[    0.000000]  [<ffffffff842c4120>] ? early_idt_handler_array+0x120/0x120
[    0.000000]  [<ffffffff842c4328>] x86_64_start_reservations+0x2a/0x2c
[    0.000000]  [<ffffffff842c443e>] x86_64_start_kernel+0x114/0x121
[    0.000000] Memory state around the buggy address:
[    0.000000]  ffffea00000cfb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    0.000000]  ffffea00000cfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00





Thanks,
Kernel Test Robot

View attachment "config-4.4.0-rc5-00003-g48913aa" of type "text/plain" (86876 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (5368 bytes)