[peterz-queue:perf/core] [perf/x86/rapl] 90942140bb: UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c

[peterz-queue:perf/core] [perf/x86/rapl] 90942140bb: UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c

[kernel test robot]

Hello,

kernel test robot noticed "UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c" on:

commit: 90942140bb6cc7e9a41d5927c7617ee522896f7a ("perf/x86/rapl: Move the pmu allocation out of CPU hotplug")
https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git perf/core

in testcase: boot

compiler: clang-18
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+-----------------------------------------------------------+------------+------------+
|                                                           | c206df6d69 | 90942140bb |
+-----------------------------------------------------------+------------+------------+
| UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c | 0          | 12         |
+-----------------------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202409111521.c7c6d56f-lkp@intel.com


[   22.115286][    T1] ------------[ cut here ]------------
[   22.115957][    T1] UBSAN: array-index-out-of-bounds in arch/x86/events/rapl.c:685:3
[   22.116970][    T1] index 0 is out of range for type 'struct rapl_pmu *[]'
[   22.117779][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc5-00045-g90942140bb6c #1
[   22.118811][    T1] Call Trace:
[   22.119182][    T1]  <TASK>
[ 22.121759][ T1] dump_stack_lvl (lib/dump_stack.c:121) 
[ 22.121759][ T1] __ubsan_handle_out_of_bounds (lib/ubsan.c:232 lib/ubsan.c:429) 
[ 22.121759][ T1] init_rapl_pmu (arch/x86/events/rapl.c:?) 
[ 22.121759][ T1] init_rapl_pmus (arch/x86/events/rapl.c:701) 
[ 22.121759][ T1] rapl_pmu_init (arch/x86/events/rapl.c:855) 
[ 22.121759][ T1] do_one_initcall (init/main.c:1267) 
[ 22.121759][ T1] ? pmu_check_apic (arch/x86/events/rapl.c:840) 
[ 22.121759][ T1] ? _raw_spin_unlock_irqrestore (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:97 arch/x86/include/asm/irqflags.h:155 include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194) 
[ 22.121759][ T1] ? stack_depot_save_flags (lib/stackdepot.c:664) 
[ 22.121759][ T1] ? kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) 
[ 22.121759][ T1] ? kasan_save_track (mm/kasan/common.c:48 mm/kasan/common.c:68) 
[ 22.121759][ T1] ? __kasan_kmalloc (mm/kasan/common.c:391) 
[ 22.121759][ T1] ? __kmalloc_noprof (mm/slub.c:4159) 
[ 22.121759][ T1] ? do_initcalls (init/main.c:1339) 
[ 22.121759][ T1] ? kernel_init_freeable (init/main.c:1580) 
[ 22.121759][ T1] ? kernel_init (init/main.c:1469) 
[ 22.121759][ T1] ? asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:702) 
[ 22.121759][ T1] ? strlen (lib/string.c:402) 
[ 22.121759][ T1] ? parameq (kernel/params.c:99) 
[ 22.121759][ T1] ? parse_args (kernel/params.c:153) 
[ 22.121759][ T1] do_initcall_level (init/main.c:1328) 
[ 22.121759][ T1] do_initcalls (init/main.c:1342) 
[ 22.121759][ T1] kernel_init_freeable (init/main.c:1580) 
[ 22.121759][ T1] ? rest_init (init/main.c:1465) 
[ 22.121759][ T1] kernel_init (init/main.c:1469) 
[ 22.121759][ T1] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 22.121759][ T1] ? rest_init (init/main.c:1465) 
[ 22.121759][ T1] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) 
[   22.121759][    T1]  </TASK>
[   22.145056][    T1] ---[ end trace ]---


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240911/202409111521.c7c6d56f-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [peterz-queue:perf/core] [perf/x86/rapl] 90942140bb: UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c

[Peter Zijlstra]

On Wed, Sep 11, 2024 at 04:32:13PM +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c" on:
> 
> commit: 90942140bb6cc7e9a41d5927c7617ee522896f7a ("perf/x86/rapl: Move the pmu allocation out of CPU hotplug")
> https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git perf/core
> 
> in testcase: boot
> 
> compiler: clang-18
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +-----------------------------------------------------------+------------+------------+
> |                                                           | c206df6d69 | 90942140bb |
> +-----------------------------------------------------------+------------+------------+
> | UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c | 0          | 12         |
> +-----------------------------------------------------------+------------+------------+
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202409111521.c7c6d56f-lkp@intel.com
> 
> 
> [   22.115286][    T1] ------------[ cut here ]------------
> [   22.115957][    T1] UBSAN: array-index-out-of-bounds in arch/x86/events/rapl.c:685:3

That is:

		rapl_pmus->pmus[topology_logical_die_id(cpu)] = pmu;

Which is scaled like:

	int nr_rapl_pmu = topology_max_packages() * topology_max_dies_per_package();

And that isn't new in that patch, just moved around.

Kan, as it happens these two patches got zapped by Ingo because they
conflict with that rapl patch from perf/urgent and he merged perf/urgent
into perf/core.

I was going to rebase these two patches on top, but given the above, can
you have a look instead?

Re: [peterz-queue:perf/core] [perf/x86/rapl] 90942140bb: UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c

[Liang, Kan]

On 2024-09-11 5:45 a.m., Peter Zijlstra wrote:
> On Wed, Sep 11, 2024 at 04:32:13PM +0800, kernel test robot wrote:
>>
>>
>> Hello,
>>
>> kernel test robot noticed "UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c" on:
>>
>> commit: 90942140bb6cc7e9a41d5927c7617ee522896f7a ("perf/x86/rapl: Move the pmu allocation out of CPU hotplug")
>> https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git perf/core
>>
>> in testcase: boot
>>
>> compiler: clang-18
>> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>>
>> (please refer to attached dmesg/kmsg for entire log/backtrace)
>>
>>
>> +-----------------------------------------------------------+------------+------------+
>> |                                                           | c206df6d69 | 90942140bb |
>> +-----------------------------------------------------------+------------+------------+
>> | UBSAN:array-index-out-of-bounds_in_arch/x86/events/rapl.c | 0          | 12         |
>> +-----------------------------------------------------------+------------+------------+
>>
>>
>> If you fix the issue in a separate patch/commit (i.e. not just a new version of
>> the same patch/commit), kindly add following tags
>> | Reported-by: kernel test robot <oliver.sang@intel.com>
>> | Closes: https://lore.kernel.org/oe-lkp/202409111521.c7c6d56f-lkp@intel.com
>>
>>
>> [   22.115286][    T1] ------------[ cut here ]------------
>> [   22.115957][    T1] UBSAN: array-index-out-of-bounds in arch/x86/events/rapl.c:685:3
> 
> That is:
> 
> 		rapl_pmus->pmus[topology_logical_die_id(cpu)] = pmu;
> 
> Which is scaled like:
> 
> 	int nr_rapl_pmu = topology_max_packages() * topology_max_dies_per_package();
> 
> And that isn't new in that patch, just moved around.
>

The error commit is still the old one which doesn't include the fix of
the issue reported by Dhananjay.
https://lore.kernel.org/lkml/88fa2064-c054-4833-872c-0cf5ff1e3609@amd.com/

I think it should be the same issue.

> Kan, as it happens these two patches got zapped by Ingo because they
> conflict with that rapl patch from perf/urgent and he merged perf/urgent
> into perf/core.
> 
> I was going to rebase these two patches on top, but given the above, can
> you have a look instead?
> 
> 

Sure, I will work with Oliver on the issue, and resend the patch to
support rapl.

Thanks,
Kan