| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 3 Nov 2022 09:25:31 +0800
From: kernel test robot <yujie.liu@...el.com>
To: Albert Wang <albertccwang@...gle.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
Greg Kroah-Harktman <gregkh@...gle.com>,
<linux-usb@...r.kernel.org>, <mathias.nyman@...el.com>,
<gregkh@...uxfoundation.org>, <badhri@...gle.com>,
<howardyen@...gle.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/3] usb: host: add xhci hooks for USB offload
Greeting,
FYI, we noticed BUG:KASAN:slab-out-of-bounds_in_xhci_offload_get_ops due to commit (built with gcc-11):
commit: 45fd37984e97f2392fa6a4ebc7367965cb55ef7f ("[PATCH 1/3] usb: host: add xhci hooks for USB offload")
url: https://github.com/intel-lab-lkp/linux/commits/Albert-Wang/add-xhci-hooks-for-USB-offload/20221027-084252
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/lkml/20221027004050.4192111-2-albertccwang@google.com
patch subject: [PATCH 1/3] usb: host: add xhci hooks for USB offload
in testcase: kernel-selftests
version: kernel-selftests-x86_64-9313ba54-1_20221017
with following parameters:
sc_nr_hugepages: 2
group: vm
test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel.
test-url: https://www.kernel.org/doc/Documentation/kselftest.txt
on test machine: 88 threads 2 sockets Intel(R) Xeon(R) Gold 6238M CPU @ 2.10GHz (Cascade Lake) with 128G memory
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
kern :err : [ 35.546226] BUG: KASAN: slab-out-of-bounds in xhci_offload_get_ops (??:?)
kern :err : [ 35.546226] Read of size 8 at addr ffff88816f6d3cf0 by task kworker/0:3/642
kern :err : [ 35.546226] CPU: 0 PID: 642 Comm: kworker/0:3 Not tainted 6.1.0-rc1-00023-g45fd37984e97 #1
kern :err : [ 35.546226] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0012.070720200218 07/07/2020
kern :err : [ 35.546226] Workqueue: events work_for_cpu_fn
kern :err : [ 35.546226] Call Trace:
kern :err : [ 35.546226] <TASK>
kern :err : [ 35.546226] dump_stack_lvl (??:?)
kern :err : [ 35.546226] print_address_description+0x87/0x2a1
kern :err : [ 35.546226] print_report (report.c:?)
kern :err : [ 35.546226] ? kasan_addr_to_slab (??:?)
kern :err : [ 35.546226] ? xhci_offload_get_ops (??:?)
kern :err : [ 35.546226] kasan_report (??:?)
kern :err : [ 35.546226] ? xhci_offload_get_ops (??:?)
kern :err : [ 35.546226] xhci_offload_get_ops (??:?)
kern :err : [ 35.546226] xhci_mem_init (??:?)
kern :err : [ 35.546226] ? lockdep_hardirqs_on_prepare (lockdep.c:?)
kern :err : [ 35.546226] ? xhci_mem_cleanup (??:?)
kern :err : [ 35.546226] ? lockdep_init_map_type (??:?)
kern :err : [ 35.546226] xhci_init (xhci.c:?)
kern :err : [ 35.546226] xhci_gen_setup (??:?)
kern :err : [ 35.546226] ? xhci_pci_suspend (xhci-pci.c:?)
kern :err : [ 35.546226] xhci_pci_setup (xhci-pci.c:?)
kern :err : [ 35.546226] usb_add_hcd.cold (hcd.c:?)
kern :err : [ 35.546226] usb_hcd_pci_probe (??:?)
kern :err : [ 35.546226] ? lockdep_hardirqs_on_prepare (lockdep.c:?)
kern :err : [ 35.546226] ? xhci_pci_resume (xhci-pci.c:?)
kern :err : [ 35.546226] xhci_pci_probe (xhci-pci.c:?)
kern :err : [ 35.546226] ? xhci_pci_resume (xhci-pci.c:?)
kern :err : [ 35.546226] local_pci_probe (pci-driver.c:?)
kern :err : [ 35.546226] ? lock_is_held_type (??:?)
kern :err : [ 35.546226] ? pci_device_shutdown (pci-driver.c:?)
kern :err : [ 35.546226] work_for_cpu_fn (workqueue.c:?)
kern :err : [ 35.546226] process_one_work (workqueue.c:?)
kern :err : [ 35.546226] ? rcu_read_unlock (main.c:?)
kern :err : [ 35.546226] ? pwq_dec_nr_in_flight (workqueue.c:?)
kern :err : [ 35.546226] ? rwlock_bug+0x90/0x90
kern :err : [ 35.546226] ? move_linked_works (workqueue.c:?)
kern :err : [ 35.546226] worker_thread (workqueue.c:?)
kern :err : [ 35.546226] ? process_one_work (workqueue.c:?)
kern :err : [ 35.546226] ? process_one_work (workqueue.c:?)
kern :err : [ 35.546226] kthread (kthread.c:?)
kern :err : [ 35.546226] ? kthread_complete_and_exit (kthread.c:?)
kern :err : [ 35.546226] ret_from_fork (??:?)
kern :err : [ 35.546226] </TASK>
kern :err : [ 35.546226] The buggy address belongs to the physical page:
kern :warn : [ 35.546226] page:000000005a3d962c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16f6d0
kern :warn : [ 35.546226] head:000000005a3d962c order:2 compound_mapcount:0 compound_pincount:0
kern :warn : [ 35.546226] flags: 0x17ffffc0010000(head|node=0|zone=2|lastcpupid=0x1fffff)
kern :warn : [ 35.546226] raw: 0017ffffc0010000 0000000000000000 dead000000000122 0000000000000000
kern :warn : [ 35.546226] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
kern :warn : [ 35.546226] page dumped because: kasan: bad access detected
kern :err : [ 35.546226] Memory state around the buggy address:
kern :err : [ 35.546226] ffff88816f6d3b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern :err : [ 35.546226] ffff88816f6d3c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern :err : [ 35.546226] >ffff88816f6d3c80: 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe fe
kern :err : [ 35.546226] ^
kern :err : [ 35.546226] ffff88816f6d3d00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
kern :err : [ 35.546226] ffff88816f6d3d80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
kern :err : [ 35.546226] ==================================================================
kern :warn : [ 35.905561] Disabling lock debugging due to kernel taint
kern :info : [ 35.911736] xhci_hcd 0000:00:14.0: hcc params 0x200077c1 hci version 0x100 quirks 0x0000000000009810
kern :info : [ 35.923138] xhci_hcd 0000:00:14.0: xHCI Host Controller
kern :info : [ 35.929321] xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 2
kern :info : [ 35.937431] xhci_hcd 0000:00:14.0: Host supports USB 3.0 SuperSpeed
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202211021601.17d63640-yujie.liu@intel.com
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
sudo bin/lkp install job.yaml # job file is attached in this email
bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run
sudo bin/lkp run generated-yaml-file
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-6.1.0-rc1-00023-g45fd37984e97" of type "text/plain" (172283 bytes)
View attachment "job-script" of type "text/plain" (6045 bytes)
Download attachment "kmsg.xz" of type "application/x-xz" (35648 bytes)
View attachment "kernel-selftests" of type "text/plain" (267267 bytes)
View attachment "job.yaml" of type "text/plain" (4909 bytes)
View attachment "reproduce" of type "text/plain" (273 bytes)
Powered by blists - more mailing lists