linux-kernel - Re: [PATCH 1/3] usb: host: add xhci hooks for USB offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202211021601.17d63640-yujie.liu@intel.com>
Date:   Thu, 3 Nov 2022 09:25:31 +0800
From:   kernel test robot <yujie.liu@...el.com>
To:     Albert Wang <albertccwang@...gle.com>
CC:     <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
        Greg Kroah-Harktman <gregkh@...gle.com>,
        <linux-usb@...r.kernel.org>, <mathias.nyman@...el.com>,
        <gregkh@...uxfoundation.org>, <badhri@...gle.com>,
        <howardyen@...gle.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/3] usb: host: add xhci hooks for USB offload

Greeting,

FYI, we noticed BUG:KASAN:slab-out-of-bounds_in_xhci_offload_get_ops due to commit (built with gcc-11):

commit: 45fd37984e97f2392fa6a4ebc7367965cb55ef7f ("[PATCH 1/3] usb: host: add xhci hooks for USB offload")
url: https://github.com/intel-lab-lkp/linux/commits/Albert-Wang/add-xhci-hooks-for-USB-offload/20221027-084252
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/lkml/20221027004050.4192111-2-albertccwang@google.com
patch subject: [PATCH 1/3] usb: host: add xhci hooks for USB offload

in testcase: kernel-selftests
version: kernel-selftests-x86_64-9313ba54-1_20221017
with following parameters:

	sc_nr_hugepages: 2
	group: vm

test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel.
test-url: https://www.kernel.org/doc/Documentation/kselftest.txt

on test machine: 88 threads 2 sockets Intel(R) Xeon(R) Gold 6238M CPU @ 2.10GHz (Cascade Lake) with 128G memory

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


kern :err : [   35.546226] BUG: KASAN: slab-out-of-bounds in xhci_offload_get_ops (??:?) 
kern  :err   : [   35.546226] Read of size 8 at addr ffff88816f6d3cf0 by task kworker/0:3/642

kern  :err   : [   35.546226] CPU: 0 PID: 642 Comm: kworker/0:3 Not tainted 6.1.0-rc1-00023-g45fd37984e97 #1
kern  :err   : [   35.546226] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.070720200218 07/07/2020
kern  :err   : [   35.546226] Workqueue: events work_for_cpu_fn
kern  :err   : [   35.546226] Call Trace:
kern  :err   : [   35.546226]  <TASK>
kern :err : [   35.546226] dump_stack_lvl (??:?) 
kern :err : [   35.546226] print_address_description+0x87/0x2a1 
kern :err : [   35.546226] print_report (report.c:?) 
kern :err : [   35.546226] ? kasan_addr_to_slab (??:?) 
kern :err : [   35.546226] ? xhci_offload_get_ops (??:?) 
kern :err : [   35.546226] kasan_report (??:?) 
kern :err : [   35.546226] ? xhci_offload_get_ops (??:?) 
kern :err : [   35.546226] xhci_offload_get_ops (??:?) 
kern :err : [   35.546226] xhci_mem_init (??:?) 
kern :err : [   35.546226] ? lockdep_hardirqs_on_prepare (lockdep.c:?) 
kern :err : [   35.546226] ? xhci_mem_cleanup (??:?) 
kern :err : [   35.546226] ? lockdep_init_map_type (??:?) 
kern :err : [   35.546226] xhci_init (xhci.c:?) 
kern :err : [   35.546226] xhci_gen_setup (??:?) 
kern :err : [   35.546226] ? xhci_pci_suspend (xhci-pci.c:?) 
kern :err : [   35.546226] xhci_pci_setup (xhci-pci.c:?) 
kern :err : [   35.546226] usb_add_hcd.cold (hcd.c:?) 
kern :err : [   35.546226] usb_hcd_pci_probe (??:?) 
kern :err : [   35.546226] ? lockdep_hardirqs_on_prepare (lockdep.c:?) 
kern :err : [   35.546226] ? xhci_pci_resume (xhci-pci.c:?) 
kern :err : [   35.546226] xhci_pci_probe (xhci-pci.c:?) 
kern :err : [   35.546226] ? xhci_pci_resume (xhci-pci.c:?) 
kern :err : [   35.546226] local_pci_probe (pci-driver.c:?) 
kern :err : [   35.546226] ? lock_is_held_type (??:?) 
kern :err : [   35.546226] ? pci_device_shutdown (pci-driver.c:?) 
kern :err : [   35.546226] work_for_cpu_fn (workqueue.c:?) 
kern :err : [   35.546226] process_one_work (workqueue.c:?) 
kern :err : [   35.546226] ? rcu_read_unlock (main.c:?) 
kern :err : [   35.546226] ? pwq_dec_nr_in_flight (workqueue.c:?) 
kern :err : [   35.546226] ? rwlock_bug+0x90/0x90 
kern :err : [   35.546226] ? move_linked_works (workqueue.c:?) 
kern :err : [   35.546226] worker_thread (workqueue.c:?) 
kern :err : [   35.546226] ? process_one_work (workqueue.c:?) 
kern :err : [   35.546226] ? process_one_work (workqueue.c:?) 
kern :err : [   35.546226] kthread (kthread.c:?) 
kern :err : [   35.546226] ? kthread_complete_and_exit (kthread.c:?) 
kern :err : [   35.546226] ret_from_fork (??:?) 
kern  :err   : [   35.546226]  </TASK>

kern  :err   : [   35.546226] The buggy address belongs to the physical page:
kern  :warn  : [   35.546226] page:000000005a3d962c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16f6d0
kern  :warn  : [   35.546226] head:000000005a3d962c order:2 compound_mapcount:0 compound_pincount:0
kern  :warn  : [   35.546226] flags: 0x17ffffc0010000(head|node=0|zone=2|lastcpupid=0x1fffff)
kern  :warn  : [   35.546226] raw: 0017ffffc0010000 0000000000000000 dead000000000122 0000000000000000
kern  :warn  : [   35.546226] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
kern  :warn  : [   35.546226] page dumped because: kasan: bad access detected

kern  :err   : [   35.546226] Memory state around the buggy address:
kern  :err   : [   35.546226]  ffff88816f6d3b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern  :err   : [   35.546226]  ffff88816f6d3c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern  :err   : [   35.546226] >ffff88816f6d3c80: 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe fe
kern  :err   : [   35.546226]                                                              ^
kern  :err   : [   35.546226]  ffff88816f6d3d00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
kern  :err   : [   35.546226]  ffff88816f6d3d80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
kern  :err   : [   35.546226] ==================================================================
kern  :warn  : [   35.905561] Disabling lock debugging due to kernel taint
kern  :info  : [   35.911736] xhci_hcd 0000:00:14.0: hcc params 0x200077c1 hci version 0x100 quirks 0x0000000000009810
kern  :info  : [   35.923138] xhci_hcd 0000:00:14.0: xHCI Host Controller
kern  :info  : [   35.929321] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 2
kern  :info  : [   35.937431] xhci_hcd 0000:00:14.0: Host supports USB 3.0 SuperSpeed


If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202211021601.17d63640-yujie.liu@intel.com


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        sudo bin/lkp install job.yaml           # job file is attached in this email
        bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run
        sudo bin/lkp run generated-yaml-file

        # if come across any failure that blocks the test,
        # please remove ~/.lkp and /lkp dir to run from a clean state.


-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

View attachment "config-6.1.0-rc1-00023-g45fd37984e97" of type "text/plain" (172283 bytes)

View attachment "job-script" of type "text/plain" (6045 bytes)

Download attachment "kmsg.xz" of type "application/x-xz" (35648 bytes)

View attachment "kernel-selftests" of type "text/plain" (267267 bytes)

View attachment "job.yaml" of type "text/plain" (4909 bytes)

View attachment "reproduce" of type "text/plain" (273 bytes)