From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B48DC433F5 for ; Mon, 15 Nov 2021 10:45:46 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5772B630EF for ; Mon, 15 Nov 2021 10:45:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 5772B630EF Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=xbSCw7DUrCB4AFDaqnDuYp0fdmV4WhX0D90vDSoKzcE=; b=bw/W76ouNWe6Bz fZnl8vGT6VvRF8Wc/GOj+Amp7XWy2k8lpMLDK8zjv9258XW4kNIldRXqt9/6ctaiXOHBeIVI9LmF1 xIXW7vyXZoxYdpSHm+V/EbJ/vOWi8y7VfMNadV4OWvUnNGRjTgBEwNANZUz65Zg4Zau6Dr2BVAvi3 OtkbQ1G966cBGsUOfXqRTXCxVLO9kuOsV6SwrBZ5T3ksUyLBDw6daPN5qrG4RqC6d2yg26WbZydfJ Iiaf47tki5DzFT3k7FadvB77aLxft4mynZzvEMiInVF+W2OaC5EZj4QIps4aK0RPNDI6WyO9HYUnm HlQOxcve+sKuCuAoA2Iw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mmZTP-00FFUg-Ou; Mon, 15 Nov 2021 10:44:28 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mmZTL-00FFT0-7S for linux-arm-kernel@lists.infradead.org; Mon, 15 Nov 2021 10:44:25 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 365081FB; Mon, 15 Nov 2021 02:44:20 -0800 (PST) Received: from FVFF77S0Q05N (unknown [10.57.56.46]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id C2E473F70D; Mon, 15 Nov 2021 02:44:18 -0800 (PST) Date: Mon, 15 Nov 2021 10:44:11 +0000 From: Mark Rutland To: Qian Cai , Valentin Schneider Cc: Will Deacon , Catalin Marinas , linux-arm-kernel@lists.infradead.org, Dmitry Vyukov , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com Subject: Re: KASAN + CPU soft-hotplug = stack-out-of-bounds at cpuinfo_store_cpu Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211115_024423_442193_D6A009B3 X-CRM114-Status: GOOD ( 18.25 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi, On Fri, Nov 12, 2021 at 11:50:16PM -0500, Qian Cai wrote: > FYI, running CPU soft-hotplug with KASAN on arm64 defconfig will > always trigger a stack-out-of-bounds below. I am not right sure where > exactly KASAN pointed at, so I am just doing the brute-force > bisect. The progress so far: >From below it looks like this is on linux-next; I can reproduce this on v5.16-rc1 using your config, when hotplugging CPU0 back in. We used to have issues with stale poison being left on the stack across a hotplug, and we fixed that with commit: e1b77c92981a5222 ("sched/kasan: remove stale KASAN poison after hotplug") ... but it looks like we no longer call init_idle() for each hotplug since commit: f1a0a376ca0c4ef1 ("sched/core: Initialize the idle task with preemption disabled") ... and so don't get the kasan_unpoison_task_stack() call which we want when bringing up a CPU, which we used to get by way of idle_thread_get() calling init_idle(). Adding a call to kasan_unpoison_task_stack(idle) within bringup_cpu() gets rid of that, and I reckon we want that explciitly *somewhere* on the CPU bringup path. Thanks, Mark. > # git bisect log > git bisect start > # bad: [e73f0f0ee7541171d89f2e2491130c7771ba58d3] Linux 5.14-rc1 > git bisect bad e73f0f0ee7541171d89f2e2491130c7771ba58d3 > # good: [62fb9874f5da54fdb243003b386128037319b219] Linux 5.13 > git bisect good 62fb9874f5da54fdb243003b386128037319b219 > # bad: [e058a84bfddc42ba356a2316f2cf1141974625c9] Merge tag 'drm-next-2021-07-01' of git://anongit.freedesktop.org/drm/drm > git bisect bad e058a84bfddc42ba356a2316f2cf1141974625c9 > # bad: [a6eaf3850cb171c328a8b0db6d3c79286a1eba9d] Merge tag 'sched-urgent-2021-06-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip > git bisect bad a6eaf3850cb171c328a8b0db6d3c79286a1eba9d > # bad: [31e798fd6f0ff0acdc49c1a358b581730936a09a] Merge tag 'media/v5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media > git bisect bad 31e798fd6f0ff0acdc49c1a358b581730936a09a > > I am going to test the "arm64-upstream" merge request next which has > some interesting arm64/cpuinfo patches. > > BUG: KASAN: stack-out-of-bounds in vsnprintf > Read of size 8 at addr ffff800016297db8 by task swapper/0/0 > > CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-next-20211110 #157 > Hardware name: MiTAC RAPTOR EV-883832-X3-0001/RAPTOR, BIOS 1.6 06/28/2020 > Call trace: > dump_backtrace > show_stack > dump_stack_lvl > print_address_description.constprop.0 > kasan_report > __asan_report_load8_noabort > vsnprintf > vsnprintf at /root/linux-next/lib/vsprintf.c:2807 > vprintk_store > vprintk_store at /root/linux-next/kernel/printk/printk.c:2138 (discriminator 5) > vprintk_emit > vprintk_emit at /root/linux-next/kernel/printk/printk.c:2232 > vprintk_default > vprintk_default at /root/linux-next/kernel/printk/printk.c:2260 > vprintk > vprintk at /root/linux-next/kernel/printk/printk_safe.c:50 > _printk > printk at /root/linux-next/kernel/printk/printk.c:2264 > __cpuinfo_store_cpu > __cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:412 > cpuinfo_store_cpu > cpuinfo_store_cpu at /root/linux-next/arch/arm64/kernel/cpuinfo.c:418 > secondary_start_kernel > secondary_start_kernel at /root/linux-next/arch/arm64/kernel/smp.c:241 > __secondary_switched > > > addr ffff800016297db8 is located in stack of task swapper/0/0 at offset 136 in frame: > _printk > > this frame has 1 object: > [32, 64) 'args' > > Memory state around the buggy address: > ffff800016297c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff800016297d00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 > >ffff800016297d80: f3 f3 00 00 00 00 f3 f3 00 00 00 00 00 00 00 00 > ^ > ffff800016297e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff800016297e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel