linux-kernel - Re: [PATCH] kernel: Add Mount Option For Efivarfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202308291443.ea96ac66-oliver.sang@intel.com>
Date:   Tue, 29 Aug 2023 14:24:53 +0800
From:   kernel test robot <oliver.sang@...el.com>
To:     Jiao Zhou <jiaozhou@...gle.com>
CC:     <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
        <linux-efi@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>,
        Jiao Zhou <jiaozhou@...gle.com>,
        "Ard Biesheuvel" <ardb@...nel.org>, Jeremy Kerr <jk@...abs.org>,
        <linux-kernel@...r.kernel.org>, <oliver.sang@...el.com>
Subject: Re: [PATCH] kernel: Add Mount Option For Efivarfs



Hello,

kernel test robot noticed "BUG:KASAN:global-out-of-bounds_in_fs_validate_description" on:

commit: 635056da10724c7af59483a8251f8e6432b50faa ("[PATCH] kernel: Add Mount Option For Efivarfs")
url: https://github.com/intel-lab-lkp/linux/commits/Jiao-Zhou/kernel-Add-Mount-Option-For-Efivarfs/20230823-002613
base: https://git.kernel.org/cgit/linux/kernel/git/efi/efi.git next
patch link: https://lore.kernel.org/all/20230822162350.1.I96423a31e88428004c2f4a28ccad13828adf433e@changeid/
patch subject: [PATCH] kernel: Add Mount Option For Efivarfs

in testcase: boot

compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202308291443.ea96ac66-oliver.sang@intel.com



[   17.276007][    T1] ==================================================================
[   17.277001][    T1] BUG: KASAN: global-out-of-bounds in fs_validate_description+0x1c2/0x1e0
[   17.278097][    T1] Read of size 8 at addr ffffffff84f20b80 by task swapper/1
[   17.278821][    T1] 
[   17.278821][    T1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.5.0-rc1-00012-g635056da1072 #1
[   17.278821][    T1] Call Trace:
[   17.278821][    T1]  <TASK>
[   17.278821][    T1]  dump_stack_lvl+0x32/0xa0
[   17.278821][    T1]  print_address_description+0x33/0x3c0
[   17.278821][    T1]  ? fs_validate_description+0x1c2/0x1e0
[   17.278821][    T1]  print_report+0xc1/0x280
[   17.278821][    T1]  ? kasan_addr_to_slab+0x11/0x80
[   17.278821][    T1]  ? fs_validate_description+0x1c2/0x1e0
[   17.278821][    T1]  kasan_report+0x154/0x190
[   17.278821][    T1]  ? fs_validate_description+0x1c2/0x1e0
[   17.278821][    T1]  __asan_report_load8_noabort+0x18/0x20
[   17.278821][    T1]  fs_validate_description+0x1c2/0x1e0
[   17.278821][    T1]  register_filesystem+0x73/0x2b0
[   17.278821][    T1]  ? pstore_blk_init+0x720/0x720
[   17.278821][    T1]  efivarfs_init+0x24/0x50
[   17.278821][    T1]  do_one_initcall+0xfc/0x480
[   17.278821][    T1]  ? trace_event_raw_event_initcall_level+0x1c0/0x1c0
[   17.278821][    T1]  ? __kasan_kmalloc+0x96/0xa0
[   17.278821][    T1]  ? do_initcalls+0x47/0x5b0
[   17.278821][    T1]  do_initcalls+0x2ae/0x5b0
[   17.278821][    T1]  kernel_init_freeable+0x313/0x570
[   17.278821][    T1]  ? rest_init+0x260/0x260
[   17.278821][    T1]  kernel_init+0x23/0x240
[   17.278821][    T1]  ? rest_init+0x260/0x260
[   17.278821][    T1]  ret_from_fork+0x22/0x30
[   17.278821][    T1]  </TASK>
[   17.278821][    T1] 
[   17.278821][    T1] The buggy address belongs to the variable:
[   17.278821][    T1]  efivarfs_parameters+0x40/0x80
[   17.278821][    T1] 
[   17.278821][    T1] The buggy address belongs to the physical page:
[   17.278821][    T1] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f20
[   17.278821][    T1] flags: 0x4000000000001000(reserved|zone=1)
[   17.278821][    T1] page_type: 0xffffffff()
[   17.278821][    T1] raw: 4000000000001000 ffffea000013c808 ffffea000013c808 0000000000000000
[   17.278821][    T1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   17.278821][    T1] page dumped because: kasan: bad access detected
[   17.278821][    T1] page_owner info is not present (never set?)
[   17.278821][    T1] 
[   17.278821][    T1] Memory state around the buggy address:
[   17.278821][    T1]  ffffffff84f20a80: 00 00 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
[   17.278821][    T1]  ffffffff84f20b00: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
[   17.278821][    T1] >ffffffff84f20b80: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
[   17.278821][    T1]                    ^
[   17.278821][    T1]  ffffffff84f20c00: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
[   17.278821][    T1]  ffffffff84f20c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.278821][    T1] ==================================================================
[   17.311721][    T1] Disabling lock debugging due to kernel taint



The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20230829/202308291443.ea96ac66-oliver.sang@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki