lkml.org 
[lkml]   [2020]   [Sep]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectKASAN: global-out-of-bounds in console_unlock
Hi printk maintainers,

I've got the following out-of-bounds in printk code.
This is on next-20200925. Config is attached.
This is just on pr_cont("\n"). Something overreads the string.

==================================================================
BUG: KASAN: global-out-of-bounds in memchr+0x65/0x80 lib/string.c:1058
Read of size 1 at addr ffffffff8c68c860 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc6-next-20200925+ #43
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x14b/0x18f lib/dump_stack.c:118
print_address_description.constprop.0.cold+0x5/0x4c5 mm/kasan/report.c:385
__kasan_report mm/kasan/report.c:545 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
memchr+0x65/0x80 lib/string.c:1058
memchr include/linux/string.h:450 [inline]
record_print_text+0x22d/0x310 kernel/printk/printk.c:1369
console_unlock+0x350/0xbc0 kernel/printk/printk.c:2477
vprintk_emit+0x348/0x4b0 kernel/printk/printk.c:2021
vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
printk+0xba/0xed kernel/printk/printk.c:2069
show_pwq+0x74d/0x7ee kernel/workqueue.c:4745
show_workqueue_state.cold+0xd0/0x3c9 kernel/workqueue.c:4784
wq_watchdog_timer_fn+0x2e5/0x370 kernel/workqueue.c:5798
call_timer_fn+0x38/0x2d0 kernel/time/timer.c:1413
expire_timers kernel/time/timer.c:1458 [inline]
__run_timers kernel/time/timer.c:1755 [inline]
__run_timers kernel/time/timer.c:1731 [inline]
run_timer_softirq+0xad2/0x1440 kernel/time/timer.c:1770
__do_softirq+0x1f0/0x6c4 kernel/softirq.c:298
asm_call_irq_on_stack+0xf/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x58/0x70 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:393 [inline]
__irq_exit_rcu kernel/softirq.c:423 [inline]
irq_exit_rcu+0x137/0x170 kernel/softirq.c:435
sysvec_apic_timer_interrupt+0x34/0xb0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: ff cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d b4
9f 5e 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d a4 9f 5e 00 fb f4 <c3> cc
41 54 55 53 e8 57 b5 fd ff 0f 1f 44 00 00 e8 ed 88 72 f9 48
RSP: 0018:ffffffff89a07e20 EFLAGS: 00000282
RAX: 1ffffffff136c688 RBX: ffffffff89a3bc40 RCX: ffffffff87e7dae8
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffed100dd469e9
R10: ffff88806ea34f43 R11: ffffed100dd469e8 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8b15e748 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:150 [inline]
default_idle+0x2a/0x40 arch/x86/kernel/process.c:688
default_idle_call+0x9c/0x280 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:168 [inline]
do_idle+0x3b5/0x690 kernel/sched/idle.c:273
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:369
start_kernel+0x435/0x456 init/main.c:1049
secondary_startup_64_no_verify+0xa6/0xab

The buggy address belongs to the variable:
text.49461+0x400/0x420

Memory state around the buggy address:
ffffffff8c68c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff8c68c780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff8c68c800: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
^
ffffffff8c68c880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff8c68c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
[unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2020-09-27 11:13    [W:0.074 / U:0.956 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site