linux-kernel - Re: BUG: KASAN: slab-out-of-bounds in print_synth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 08 Aug 2023 07:58:59 +0200
From:   Sven Schnelle <svens@...ux.ibm.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: BUG: KASAN: slab-out-of-bounds in print_synth_event+0xa68/0xa78

Steven Rostedt <rostedt@...dmis.org> writes:

> On Fri, 04 Aug 2023 08:20:23 +0200
> Sven Schnelle <svens@...ux.ibm.com> wrote:
>
>> Hi Steven,
>>
>> i noticed the following KASAN splat in CI (on s390):
>
> Could this actually be a bug in KASAN?
>
> The reason I ask, is because of the report.

I don't think so. I looked into the trace file when the problem occurred
yesterday, and it looked like this:

kworker/0:2-83      [000] d..4.    59.260107: wake_lat: pid=2654624 delta=55 stack=STACK:
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
[..]

Somtimes the number is 0xcc, which is POISON_FREE_INITMEM instead of POISON_FREE.

In other entries delta and pid are also wrong:

swapper/0-1       [002] .....     5.864575: wake_lat: pid=5437496 delta=7880749591624456 stack=STACK:

Of course PID could have gone away, but that delta looks interesting. So
it looks like the whole entry is just random data not owned by tracing,
and not the data that was allocated in the ringbuffer code.