BUG: KASAN: slab-out-of-bounds in swiotlb_tbl_sync_single

From: Naresh Kamboju
Date: Mon Dec 14 2020 - 05:07:13 EST

Next message: Marco Elver: "Re: WARNING in sk_stream_kill_queues (5)"
Previous message: Geert Uytterhoeven: "Re: [RFC] ravb: Add support for optional txc_refclk"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

While booting qemu_x86_64 KASAN enabled kernel version 5.10.0-rc7-next-20201211
the following kernel BUG reported.
This bug reproduced 3 times out of 14 runs.

metadata:
git branch: master
git repo: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next
git describe: next-20201211
make_kernelversion: 5.10.0-rc7
kernel-config: https://builds.tuxbuild.com/1lVdrFbcgado8oNkCnff3PyKwr8/config

Crash log:
-----------
[ 5.788405] ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100
[ 5.790244] ata1.00: 6217030 sectors, multi 16: LBA48
[ 5.792453] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[ 5.797823] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK
2.5+ PQ: 0 ANSI: 5
[ 5.803276] sd 0:0:0:0: Attached scsi generic sg0 type 0
[ 5.804310] sd 0:0:0:0: [sda] 6217030 512-byte logical blocks:
(3.18 GB/2.96 GiB)
[ 5.807632] sd 0:0:0:0: [sda] Write Protect is off
[ 5.808940] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM
2.5+ PQ: 0 ANSI: 5
[ 5.811086] sd 0:0:0:0: [sda] Write cache: enabled, read cache:
enabled, doesn't support DPO or FUA
[ 5.816238] ==================================================================
[ 5.817148] BUG: KASAN: slab-out-of-bounds in
swiotlb_tbl_sync_single+0xc0/0xe0
[ 5.817148] Write of size 2048 at addr ffff888104a7d000 by task swapper/3/0
[ 5.817148]
[ 5.817148] CPU: 3 PID: 0 Comm: swapper/3 Not tainted
5.10.0-rc7-next-20201211 #2
[ 5.817148] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.12.0-1 04/01/2014
[ 5.817148] Call Trace:
[ 5.817148] <IRQ>
[ 5.817148] dump_stack+0xa4/0xd9
[ 5.817148] print_address_description.constprop.0+0x21/0x140
[ 5.817148] ? swiotlb_tbl_sync_single+0xc0/0xe0
[ 5.817148] kasan_report.cold+0x7d/0x10a
[ 5.817148] ? swiotlb_tbl_sync_single+0xc0/0xe0
[ 5.817148] check_memory_region+0x18c/0x1f0
[ 5.817148] memcpy+0x3c/0x60
[ 5.817148] swiotlb_tbl_sync_single+0xc0/0xe0
[ 5.817148] dma_direct_unmap_sg+0x241/0x290
[ 5.817148] ? put_cred_rcu+0x114/0x180
[ 5.817148] dma_unmap_sg_attrs+0x78/0xc0
[ 5.817148] __ata_qc_complete+0x215/0x270
[ 5.817148] ata_qc_complete+0x1a5/0x4c0
[ 5.817148] ata_hsm_qc_complete+0x6d/0x120
[ 5.817148] ata_sff_hsm_move+0x201/0xb10
[ 5.817148] ? quarantine_put+0xed/0x180
[ 5.817148] ? ____kasan_slab_free+0xfe/0x120
[ 5.817148] ? get_task_cred+0x90/0x90
[ 5.817148] ? trace_hardirqs_on+0x38/0x100
[ 5.817148] __ata_sff_port_intr+0x105/0x1c0
[ 5.817148] ata_bmdma_port_intr+0x63/0x190
[ 5.817148] ata_bmdma_interrupt+0x160/0x2e0
[ 5.817148] ? ata_bmdma_port_intr+0x190/0x190
[ 5.817148] __handle_irq_event_percpu+0xbf/0x2b0
[ 5.817148] handle_irq_event_percpu+0x70/0xf0
[ 5.844430] ? __handle_irq_event_percpu+0x2b0/0x2b0
[ 5.844430] ? __kasan_check_write+0x14/0x20
[ 5.844430] ? _raw_spin_lock+0x82/0xd0
[ 5.844430] handle_irq_event+0x68/0xa0
[ 5.844430] handle_edge_irq+0x108/0x2f0
[ 5.844430] asm_call_irq_on_stack+0x12/0x20
[ 5.844430] </IRQ>
[ 5.844430] common_interrupt+0xc3/0x130
[ 5.844430] asm_common_interrupt+0x1e/0x40
[ 5.844430] RIP: 0010:default_idle+0x17/0x20
[ 5.844430] Code: ff eb c2 e8 4b 30 ff ff cc cc cc cc cc cc cc cc
cc cc cc 0f 1f 44 00 00 55 48 89 e5 e9 07 00 00 00 0f 00 2d 0b 63 59
00 fb f4 <5d> c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 be 08 00 00 00
48 89
[ 5.844430] RSP: 0018:ffff888100327da8 EFLAGS: 00000206
[ 5.844430] RAX: ffffffffb50b3c00 RBX: ffff8881002d4ec0 RCX: ffffffffb50a6e1e
[ 5.844430] RDX: 0000000000004dd2 RSI: 0000000000000004 RDI: ffff8881179b2720
[ 5.844430] RBP: ffff888100327da8 R08: 0000000000000001 R09: ffffed1022f364e5
[ 5.844430] R10: ffff8881179b2723 R11: ffffed1022f364e4 R12: 0000000000000003
[ 5.844430] R13: ffffffffb688d388 R14: 0000000000000000 R15: ffff8881002d4ec0
[ 5.844430] ? __cpuidle_text_start+0x8/0x8
[ 5.844430] ? rcu_eqs_enter.constprop.0+0x9e/0xc0
[ 5.844430] arch_cpu_idle+0x15/0x20
[ 5.844430] default_idle_call+0x6f/0x180
[ 5.844430] do_idle+0x396/0x450
[ 5.844430] ? _raw_spin_unlock_irqrestore+0x34/0x40
[ 5.844430] ? arch_cpu_idle_exit+0x40/0x40
[ 5.844430] ? complete+0x47/0x50
[ 5.844430] cpu_startup_entry+0x20/0x30
[ 5.844430] start_secondary+0x1ca/0x220
[ 5.844430] ? set_cpu_sibling_map+0xc90/0xc90
[ 5.844430] secondary_startup_64_no_verify+0xc2/0xcb
[ 5.844430]
[ 5.844430] Allocated by task 258:
[ 5.844430] kasan_save_stack+0x23/0x50
[ 5.844430] ____kasan_kmalloc.constprop.0+0x88/0xb0
[ 5.844430] __kasan_slab_alloc+0xe/0x10
[ 5.844430] kmem_cache_alloc_node+0x161/0x4c0
[ 5.844430] create_task_io_context+0x25/0x1f0
[ 5.844430] submit_bio_checks+0x853/0x9e0
[ 5.844430] submit_bio_noacct+0x7d/0x6c0
[ 5.844430] submit_bio+0xba/0x2e0
[ 5.844430] submit_bh_wbc+0x357/0x390
[ 5.844430] block_read_full_page+0x3e5/0x6d0
[ 5.844430] blkdev_readpage+0x18/0x20
[ 5.844430] do_read_cache_page+0x48b/0xb30
[ 5.844430] read_cache_page+0x3c/0x50
[ 5.844430] read_part_sector+0x97/0x1b0
[ 5.844430] read_lba+0x1f5/0x2a0
[ 5.844430] efi_partition+0x313/0xab0
[ 5.844430] blk_add_partitions+0x1f5/0x600
[ 5.844430] bdev_disk_changed+0xc2/0x150
[ 5.844430] __blkdev_get+0x14a/0x4d0
[ 5.876332] blkdev_get_by_dev+0xe9/0x280
[ 5.876332] __device_add_disk+0x786/0x8a0
[ 5.876332] device_add_disk+0x13/0x20
[ 5.876332] sd_probe+0x55b/0x6a0
[ 5.876332] really_probe+0x179/0x5a0
[ 5.876332] driver_probe_device+0x14a/0x1d0
[ 5.876332] __device_attach_driver+0xbd/0x110
[ 5.876332] bus_for_each_drv+0xfd/0x160
[ 5.876332] __device_attach_async_helper+0x144/0x1a0
[ 5.876332] async_run_entry_fn+0x70/0x2a0
[ 5.876332] process_one_work+0x488/0x790
[ 5.876332] worker_thread+0x80/0x6d0
[ 5.876332] kthread+0x1bd/0x210
[ 5.876332] ret_from_fork+0x22/0x30
[ 5.876332]
[ 5.876332] The buggy address belongs to the object at ffff888104a7d000
[ 5.876332] which belongs to the cache blkdev_ioc of size 88
[ 5.876332] The buggy address is located 0 bytes inside of
[ 5.876332] 88-byte region [ffff888104a7d000, ffff888104a7d058)
[ 5.876332] The buggy address belongs to the page:
[ 5.876332] page:000000004397bed6 refcount:1 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x104a7d
[ 5.876332] flags: 0x200000000000200(slab)
[ 5.876332] raw: 0200000000000200 dead000000000100 dead000000000122
ffff888100dbbc80
[ 5.876332] raw: 0000000000000000 0000000080220022 00000001ffffffff
0000000000000000
[ 5.876332] page dumped because: kasan: bad access detected
[ 5.876332]
[ 5.876332] Memory state around the buggy address:
[ 5.876332] ffff888104a7cf00: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 5.876332] ffff888104a7cf80: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 5.876332] >ffff888104a7d000: 00 00 00 00 00 00 00 00 00 00 00 fc
fc fc fc fc
[ 5.876332] ^
[ 5.876332] ffff888104a7d080: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 5.876332] ffff888104a7d100: fc fc fc fc fc fc fc fc fc fc fc fc
fc fc fc fc
[ 5.876332] ==================================================================
[ 5.876332] Disabling lock debugging due to kernel taint
[ 5.906281] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray

Reported-by: Naresh kamboju <naresh.kamboju@xxxxxxxxxx>

Full test log link,
-------------------
https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20201211/testrun/3571515/suite/linux-log-parser/test/check-kernel-bug-2037535/log
https://lkft.validation.linaro.org/scheduler/job/2037535#L588
https://lkft.validation.linaro.org/scheduler/job/2037534#L588
https://lkft.validation.linaro.org/scheduler/job/2037539#L589

--
Linaro LKFT
https://lkft.linaro.org

Next message: Marco Elver: "Re: WARNING in sk_stream_kill_queues (5)"
Previous message: Geert Uytterhoeven: "Re: [RFC] ravb: Add support for optional txc_refclk"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]