| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202212161133.8876fda2-yujie.liu@intel.com>
Date: Fri, 16 Dec 2022 14:15:17 +0800
From: kernel test robot <yujie.liu@...el.com>
To: Albert Wang <albertccwang@...gle.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
<linux-usb@...r.kernel.org>, <mathias.nyman@...el.com>,
<gregkh@...uxfoundation.org>, <badhri@...gle.com>,
<howardyen@...gle.com>, <pumahsu@...gle.com>, <raychi@...gle.com>,
<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3 1/3] usb: host: add xhci hooks for USB offload
Greeting,
FYI, we noticed BUG:KASAN:slab-out-of-bounds_in_xhci_offload_get_ops due to commit (built with gcc-11):
commit: 213d3f01e2e4c64d543594b4727bc8bef1772c90 ("[PATCH v3 1/3] usb: host: add xhci hooks for USB offload")
url: https://github.com/intel-lab-lkp/linux/commits/Albert-Wang/add-xhci-hooks-for-USB-offload/20221213-221410
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/all/20221213141005.3068792-2-albertccwang@google.com/
patch subject: [PATCH v3 1/3] usb: host: add xhci hooks for USB offload
in testcase: kernel-selftests
version: kernel-selftests-x86_64-2ed09c3b-1_20221128
with following parameters:
group: user_events
test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel.
test-url: https://www.kernel.org/doc/Documentation/kselftest.txt
on test machine: 4 threads Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz (Skylake) with 16G memory
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
[ 10.836823][ T9] BUG: KASAN: slab-out-of-bounds in xhci_offload_get_ops (??:?)
[ 10.836823][ T9] Read of size 8 at addr ffff88816d77bcf0 by task kworker/u8:0/9
[ 10.836823][ T9]
[ 10.836823][ T9] CPU: 1 PID: 9 Comm: kworker/u8:0 Not tainted 6.1.0-rc7-00160-g213d3f01e2e4 #1
[ 10.857572][ T1] serio: i8042 AUX port at 0x60,0x64 irq 12
[ 10.836823][ T9] Hardware name: HP HP Z238 Microtower Workstation/8183, BIOS N51 Ver. 01.63 10/05/2017
[ 10.836823][ T9] Workqueue: events_unbound async_run_entry_fn
[ 10.836823][ T9] Call Trace:
[ 10.871868][ T1] initcall i8042_init+0x0/0x135 returned 0 after 45065 usecs
[ 10.836823][ T9] <TASK>
[ 10.836823][ T9] dump_stack_lvl (??:?)
[ 10.836823][ T9] print_address_description+0x87/0x2a1
[ 10.886397][ T1] calling serport_init+0x0/0x2c @ 1
[ 10.836823][ T9] print_report (report.c:?)
[ 10.836823][ T9] ? kasan_addr_to_slab (??:?)
[ 10.897467][ T1] initcall serport_init+0x0/0x2c returned 0 after 1 usecs
[ 10.836823][ T9] ? xhci_offload_get_ops (??:?)
[ 10.836823][ T9] kasan_report (??:?)
[ 10.912792][ T1] calling input_leds_init+0x0/0x11 @ 1
[ 10.836823][ T9] ? xhci_offload_get_ops (??:?)
[ 10.836823][ T9] xhci_offload_get_ops (??:?)
[ 10.921995][ T1] initcall input_leds_init+0x0/0x11 returned 0 after 46 usecs
[ 10.836823][ T9] xhci_mem_init (??:?)
[ 10.836823][ T9] ? lockdep_hardirqs_on_prepare (lockdep.c:?)
[ 10.836823][ T9] ? xhci_mem_cleanup (??:?)
[ 10.836823][ T9] ? lockdep_init_map_type (??:?)
[ 10.836823][ T9] xhci_init (xhci.c:?)
[ 10.932015][ T1] calling mousedev_init+0x0/0x5f @ 1
[ 10.836823][ T9] xhci_gen_setup (??:?)
[ 10.836823][ T9] ? xhci_pci_suspend (xhci-pci.c:?)
[ 10.943237][ T1] mousedev: PS/2 mouse device common for all mice
[ 10.836823][ T9] ? trace_hardirqs_on (??:?)
[ 10.836823][ T9] xhci_pci_setup (xhci-pci.c:?)
[ 10.836823][ T9] usb_add_hcd.cold (hcd.c:?)
[ 10.952345][ T1] initcall mousedev_init+0x0/0x5f returned 0 after 9518 usecs
[ 10.836823][ T9] usb_hcd_pci_probe (??:?)
[ 10.836823][ T9] ? lockdep_hardirqs_on_prepare (lockdep.c:?)
[ 10.964107][ T1] calling evdev_init+0x0/0x11 @ 1
[ 10.836823][ T9] ? xhci_pci_resume (xhci-pci.c:?)
[ 10.836823][ T9] xhci_pci_probe (xhci-pci.c:?)
[ 10.974550][ T1] initcall evdev_init+0x0/0x11 returned 0 after 1119 usecs
[ 10.836823][ T9] ? xhci_pci_resume (xhci-pci.c:?)
[ 10.836823][ T9] local_pci_probe (pci-driver.c:?)
[ 10.836823][ T9] pci_call_probe (pci-driver.c:?)
[ 10.983920][ T1] calling atkbd_init+0x0/0x26 @ 1
[ 10.836823][ T9] ? lock_is_held_type (??:?)
[ 10.836823][ T9] ? pci_pm_suspend_noirq (pci-driver.c:?)
[ 10.836823][ T9] ? pci_match_device (pci-driver.c:?)
[ 10.996241][ T1] initcall atkbd_init+0x0/0x26 returned 0 after 117 usecs
[ 10.836823][ T9] ? pci_match_device (pci-driver.c:?)
[ 10.836823][ T9] ? kernfs_put (??:?)
[ 11.007109][ T1] calling psmouse_init+0x0/0x86 @ 1
[ 10.836823][ T9] pci_device_probe (pci-driver.c:?)
[ 10.836823][ T9] really_probe (dd.c:?)
[ 11.018064][ T1] initcall psmouse_init+0x0/0x86 returned 0 after 581 usecs
[ 10.836823][ T9] ? ktime_get (??:?)
[ 10.836823][ T9] ? driver_probe_device (dd.c:?)
[ 10.836823][ T9] __driver_probe_device (dd.c:?)
[ 11.026737][ T1] calling cmos_init+0x0/0x70 @ 1
[ 10.836823][ T9] driver_probe_device (dd.c:?)
[ 10.836823][ T9] __driver_attach_async_helper (dd.c:?)
[ 11.036281][ T1] rtc_cmos 00:03: RTC can wake from S4
[ 10.836823][ T9] async_run_entry_fn (async.c:?)
[ 10.836823][ T9] process_one_work (workqueue.c:?)
[ 11.049786][ T1] rtc_cmos 00:03: registered as rtc0
[ 10.836823][ T9] ? rcu_read_unlock (main.c:?)
[ 10.836823][ T9] ? pwq_dec_nr_in_flight (workqueue.c:?)
[ 10.836823][ T9] ? rwlock_bug+0x90/0x90
[ 11.056724][ T1] rtc_cmos 00:03: setting system clock to 2022-12-15T23:47:28 UTC (1671148048)
[ 10.836823][ T9] worker_thread (workqueue.c:?)
[ 10.836823][ T9] ? process_one_work (workqueue.c:?)
[ 10.836823][ T9] kthread (kthread.c:?)
[ 10.836823][ T9] ? kthread_complete_and_exit (kthread.c:?)
[ 11.068886][ T1] rtc_cmos 00:03: alarms up to one month, y3k, 242 bytes nvram
[ 10.836823][ T9] ret_from_fork (??:?)
[ 10.836823][ T9] </TASK>
[ 11.080121][ T1] initcall cmos_init+0x0/0x70 returned 0 after 43971 usecs
[ 10.836823][ T9]
[ 10.836823][ T9] The buggy address belongs to the physical page:
[ 10.836823][ T9] page:0000000081d85dee refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16d778
[ 10.836823][ T9] head:0000000081d85dee order:2 compound_mapcount:0 compound_pincount:0
[ 11.089266][ T1] calling thermal_throttle_init_device+0x0/0x4f @ 1
[ 10.836823][ T9] flags: 0x17ffffc0010000(head|node=0|zone=2|lastcpupid=0x1fffff)
[ 10.836823][ T9] raw: 0017ffffc0010000 0000000000000000 dead000000000122 0000000000000000
[ 11.335927][ T9] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 11.345903][ T9] page dumped because: kasan: bad access detected
[ 11.350905][ T9]
[ 11.355905][ T9] Memory state around the buggy address:
[ 11.360904][ T9] ffff88816d77bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 11.370903][ T9] ffff88816d77bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 11.375903][ T9] >ffff88816d77bc80: 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe fe
[ 11.385902][ T9] ^
[ 11.390907][ T9] ffff88816d77bd00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[ 11.400904][ T9] ffff88816d77bd80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[ 11.405905][ T9] ==================================================================
[ 11.418806][ T9] Disabling lock debugging due to kernel taint
[ 11.425206][ T1] initcall thermal_throttle_init_device+0x0/0x4f returned 0 after 324091 usecs
[ 11.425310][ T9] xhci_hcd 0000:00:14.0: hcc params 0x200077c1 hci version 0x100 quirks 0x0000000001109810
[ 11.434035][ T1] calling esb_driver_init+0x0/0x1a @ 1
[ 11.434142][ T1] initcall esb_driver_init+0x0/0x1a returned 0 after 102 usecs
[ 11.449912][ T9] xhci_hcd 0000:00:14.0: xHCI Host Controller
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202212161133.8876fda2-yujie.liu@intel.com
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
sudo bin/lkp install job.yaml # job file is attached in this email
bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run
sudo bin/lkp run generated-yaml-file
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-6.1.0-rc7-00160-g213d3f01e2e4" of type "text/plain" (171173 bytes)
View attachment "job-script" of type "text/plain" (6561 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (41276 bytes)
View attachment "kernel-selftests" of type "text/plain" (3894 bytes)
View attachment "job.yaml" of type "text/plain" (5403 bytes)
View attachment "reproduce" of type "text/plain" (277 bytes)
Powered by blists - more mailing lists