* Re: [PATCH v2 14/29] arch: add pkey and rseq syscall numbers everywhere
From: Arnd Bergmann @ 2019-01-21 20:28 UTC (permalink / raw)
To: Geert Uytterhoeven
Cc: Rich Felker, linux-ia64@vger.kernel.org, Linux-sh list,
Heiko Carstens, linux-mips, Max Filippov, netdev, Deepa Dinamani,
H. Peter Anvin, sparclinux, Linux-Arch, linux-s390,
y2038 Mailman List, Helge Deller, the arch/x86 maintainers,
Russell King, Ingo Molnar, Firoz Khan, Catalin Marinas,
Matt Turner, Fenghua Yu, Will Deacon, Linux FS Devel, linux-m68k,
Andy Lutomirski, Thomas Gleixner, Linux ARM, Michal Simek,
Tony Luck, Parisc List, Linux API, Linux Kernel Mailing List,
Paul Burton, Eric W. Biederman, alpha, Martin Schwidefsky,
Andrew Morton, linuxppc-dev, David S. Miller
In-Reply-To: <CAMuHMdWaJyNqUeq4qu3AgU0fYrQdZ_zbo0DFFiM97Y5HESYYnA@mail.gmail.com>
On Mon, Jan 21, 2019 at 9:56 AM Geert Uytterhoeven <geert@linux-m68k.org> wrote:
>
> Note that all architectures that already define pkey syscalls, list
> pkey_mprotect first.
It's easy enough to change, so I've reordered them for consistency now.
> Regardless, for m68k:
> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Thanks,
Arnd
^ permalink raw reply
* Re: [PATCH v2 19/21] treewide: add checks for the return value of memblock_alloc*()
From: Rob Herring @ 2019-01-21 17:18 UTC (permalink / raw)
To: Mike Rapoport
Cc: Rich Felker, linux-ia64, devicetree, Catalin Marinas,
Heiko Carstens, x86, linux-mips, Max Filippov, Guo Ren,
sparclinux, Christoph Hellwig, linux-s390, linux-c6x-dev,
Yoshinori Sato, Richard Weinberger, linux-sh, Russell King,
kasan-dev, Geert Uytterhoeven, Mark Salter, Dennis Zhou,
Matt Turner, linux-snps-arc, uclinux-h8-devel, Petr Mladek,
linux-xtensa, linux-alpha, linux-um, linux-m68k, openrisc,
Greentime Hu, xen-devel, Stafford Horne, Guan Xuetao,
linux-arm-kernel, Michal Simek, Tony Luck, linux-mm,
Greg Kroah-Hartman, linux-usb, linux-kernel, Paul Burton,
Vineet Gupta, Andrew Morton, linuxppc-dev, David S. Miller
In-Reply-To: <1548057848-15136-20-git-send-email-rppt@linux.ibm.com>
On Mon, Jan 21, 2019 at 10:04:06AM +0200, Mike Rapoport wrote:
> Add check for the return value of memblock_alloc*() functions and call
> panic() in case of error.
> The panic message repeats the one used by panicing memblock allocators with
> adjustment of parameters to include only relevant ones.
>
> The replacement was mostly automated with semantic patches like the one
> below with manual massaging of format strings.
>
> @@
> expression ptr, size, align;
> @@
> ptr = memblock_alloc(size, align);
> + if (!ptr)
> + panic("%s: Failed to allocate %lu bytes align=0x%lx\n", __func__,
> size, align);
>
> Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
> Reviewed-by: Guo Ren <ren_guo@c-sky.com> # c-sky
> Acked-by: Paul Burton <paul.burton@mips.com> # MIPS
> Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # s390
> Reviewed-by: Juergen Gross <jgross@suse.com> # Xen
> ---
> arch/alpha/kernel/core_cia.c | 3 +++
> arch/alpha/kernel/core_marvel.c | 6 ++++++
> arch/alpha/kernel/pci-noop.c | 13 +++++++++++--
> arch/alpha/kernel/pci.c | 11 ++++++++++-
> arch/alpha/kernel/pci_iommu.c | 12 ++++++++++++
> arch/arc/mm/highmem.c | 4 ++++
> arch/arm/kernel/setup.c | 6 ++++++
> arch/arm/mm/mmu.c | 14 +++++++++++++-
> arch/arm64/kernel/setup.c | 8 +++++---
> arch/arm64/mm/kasan_init.c | 10 ++++++++++
> arch/c6x/mm/dma-coherent.c | 4 ++++
> arch/c6x/mm/init.c | 3 +++
> arch/csky/mm/highmem.c | 5 +++++
> arch/h8300/mm/init.c | 3 +++
> arch/m68k/atari/stram.c | 4 ++++
> arch/m68k/mm/init.c | 3 +++
> arch/m68k/mm/mcfmmu.c | 6 ++++++
> arch/m68k/mm/motorola.c | 9 +++++++++
> arch/m68k/mm/sun3mmu.c | 6 ++++++
> arch/m68k/sun3/sun3dvma.c | 3 +++
> arch/microblaze/mm/init.c | 8 ++++++--
> arch/mips/cavium-octeon/dma-octeon.c | 3 +++
> arch/mips/kernel/setup.c | 3 +++
> arch/mips/kernel/traps.c | 3 +++
> arch/mips/mm/init.c | 5 +++++
> arch/nds32/mm/init.c | 12 ++++++++++++
> arch/openrisc/mm/ioremap.c | 8 ++++++--
> arch/powerpc/kernel/dt_cpu_ftrs.c | 5 +++++
> arch/powerpc/kernel/pci_32.c | 3 +++
> arch/powerpc/kernel/setup-common.c | 3 +++
> arch/powerpc/kernel/setup_64.c | 4 ++++
> arch/powerpc/lib/alloc.c | 3 +++
> arch/powerpc/mm/hash_utils_64.c | 3 +++
> arch/powerpc/mm/mmu_context_nohash.c | 9 +++++++++
> arch/powerpc/mm/pgtable-book3e.c | 12 ++++++++++--
> arch/powerpc/mm/pgtable-book3s64.c | 3 +++
> arch/powerpc/mm/pgtable-radix.c | 9 ++++++++-
> arch/powerpc/mm/ppc_mmu_32.c | 3 +++
> arch/powerpc/platforms/pasemi/iommu.c | 3 +++
> arch/powerpc/platforms/powermac/nvram.c | 3 +++
> arch/powerpc/platforms/powernv/opal.c | 3 +++
> arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
> arch/powerpc/platforms/ps3/setup.c | 3 +++
> arch/powerpc/sysdev/msi_bitmap.c | 3 +++
> arch/s390/kernel/setup.c | 13 +++++++++++++
> arch/s390/kernel/smp.c | 5 ++++-
> arch/s390/kernel/topology.c | 6 ++++++
> arch/s390/numa/mode_emu.c | 3 +++
> arch/s390/numa/numa.c | 6 +++++-
> arch/sh/mm/init.c | 6 ++++++
> arch/sh/mm/numa.c | 4 ++++
> arch/um/drivers/net_kern.c | 3 +++
> arch/um/drivers/vector_kern.c | 3 +++
> arch/um/kernel/initrd.c | 2 ++
> arch/um/kernel/mem.c | 16 ++++++++++++++++
> arch/unicore32/kernel/setup.c | 4 ++++
> arch/unicore32/mm/mmu.c | 15 +++++++++++++--
> arch/x86/kernel/acpi/boot.c | 3 +++
> arch/x86/kernel/apic/io_apic.c | 5 +++++
> arch/x86/kernel/e820.c | 3 +++
> arch/x86/platform/olpc/olpc_dt.c | 3 +++
> arch/x86/xen/p2m.c | 11 +++++++++--
> arch/xtensa/mm/kasan_init.c | 4 ++++
> arch/xtensa/mm/mmu.c | 3 +++
> drivers/clk/ti/clk.c | 3 +++
> drivers/macintosh/smu.c | 3 +++
> drivers/of/fdt.c | 8 +++++++-
> drivers/of/unittest.c | 8 +++++++-
Acked-by: Rob Herring <robh@kernel.org>
> drivers/xen/swiotlb-xen.c | 7 +++++--
> kernel/power/snapshot.c | 3 +++
> lib/cpumask.c | 3 +++
> mm/kasan/init.c | 10 ++++++++--
> mm/sparse.c | 19 +++++++++++++++++--
> 73 files changed, 409 insertions(+), 28 deletions(-)
^ permalink raw reply
* Re: [PATCH v2 29/29] y2038: add 64-bit time_t syscalls to all 32-bit architectures
From: Arnd Bergmann @ 2019-01-21 17:08 UTC (permalink / raw)
To: Geert Uytterhoeven
Cc: Rich Felker, linux-ia64@vger.kernel.org, Linux-sh list,
Heiko Carstens, linux-mips, Max Filippov, Network Development,
Deepa Dinamani, H. Peter Anvin, sparclinux, linux-arch,
linux-s390, y2038 Mailman List, Helge Deller, X86 ML,
Russell King - ARM Linux admin, Ingo Molnar, Firoz Khan,
Catalin Marinas, Matt Turner, Fenghua Yu, Will Deacon,
Linux FS Devel, linux-m68k, Andy Lutomirski, Thomas Gleixner,
linux-arm-kernel, Michal Simek, Tony Luck, Parisc List, Linux API,
LKML, Paul Burton, Eric W. Biederman, alpha, Martin Schwidefsky,
Andrew Morton, linuxppc-dev, David S. Miller
In-Reply-To: <CAMuHMdXzQNEEDjWrmTph8Krovj1g2WhnBUaM=FvKB+J2fZqctA@mail.gmail.com>
On Mon, Jan 21, 2019 at 9:19 AM Geert Uytterhoeven <geert@linux-m68k.org> wrote:
> On Sat, Jan 19, 2019 at 3:29 PM Russell King - ARM Linux admin
> <linux@armlinux.org.uk> wrote:
> > On Fri, Jan 18, 2019 at 11:53:25AM -0800, Andy Lutomirski wrote:
> > > On Fri, Jan 18, 2019 at 11:33 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > > > On Fri, Jan 18, 2019 at 7:50 PM Andy Lutomirski <luto@kernel.org> wrote:
> > >
> > > Can we perhaps just start the consistent numbers above 547 or maybe
> > > block out 512..547 in the new regime?
> >
> > I don't think you gain much with that kind of scheme - it won't take
> > very long before an architecture misses having a syscall added, and
> > then someone else adds their own. Been there with ARM - I was keeping
> > the syscall table in the same order as x86 for new syscalls, but now
>
> Same for m68k, and probably other architectures.
>
> > that others have been adding syscalls to the table since I converted
> > ARM to the tabular form, that's now gone out the window.
> >
> > So, I think it's completely pointless to do what you're suggesting.
> > We'll just end up with a big hole in the middle of the syscall table
> > and then revert back to random numbering of syscalls thereafter again.
>
> I believe the plan is to add future syscalls for all architectures in a
> single commit, to keep everything in sync.
Yes, that is the idea. This was not realistic before, since each one
of the old architectures had its own way of describing the system call
tables, and many needed a different set of quirks.
Since (almost) everything is now converted to the syscall.tbl format,
we have removed all obsolete architectures, and a lot of the quirks
(x32, spu, s390-31) won't matter as much in the future, I think it is
now possible to do it.
We could even extend scripts/checksyscalls.sh to warn if a new
syscall above 423 is not added to all 16 tables at the same time.
> Regardless, I'm wondering what to do with the holes marked "room for
> arch specific calls".
> When is a syscall really arch-specific, and can it be added there, and
> when does it turn out (later) that it isn't, breaking the
> synchronization again?
We've had a bit of that already, with cacheflush(), which exists on
a couple of architectures, including some that use the first
'arch specific' slot (244) of the asm-generic table. I think this
will be rare enough that we can figure out a solution when we
get there.
> The pkey syscalls may be a bad example, as AFAIU they can be implemented
> on some architectures, but not on some others. Still, I had skipped them
> when adding new syscalls to m68k.
>
> Perhaps we should get rid of the notion of "arch-specific syscalls", and
> reserve a slot everywhere anyway?
I don't mind calling the hole something else if that helps. Out of
principle I would already assume that anything we add for x86
or the generic table should be added everywhere, but we can
make it broader than that.
Arnd
^ permalink raw reply
* Re: [PATCH v2 29/29] y2038: add 64-bit time_t syscalls to all 32-bit architectures
From: Arnd Bergmann @ 2019-01-21 16:31 UTC (permalink / raw)
To: y2038 Mailman List, Linux API, Linux Kernel Mailing List,
linux-arch
Cc: Rich Felker, linux-ia64, Linux-sh list, Catalin Marinas,
Heiko Carstens, Max Filippov, Deepa Dinamani, H. Peter Anvin,
sparclinux, linux-s390, Helge Deller, the arch/x86 maintainers,
Russell King - ARM Linux, Ingo Molnar, Geert Uytterhoeven,
Firoz Khan, Matt Turner, Fenghua Yu, Will Deacon,
Linux FS-devel Mailing List, linux-m68k, Andy Lutomirski,
Thomas Gleixner, Linux ARM, Michal Simek, Tony Luck, Parisc List,
Networking, linux-mips, Paul Burton, Eric W . Biederman, alpha,
Martin Schwidefsky, Andrew Morton, linuxppc-dev, David Miller
In-Reply-To: <20190118161835.2259170-30-arnd@arndb.de>
On Fri, Jan 18, 2019 at 5:25 PM Arnd Bergmann <arnd@arndb.de> wrote:
>
> This adds 21 new system calls on each ABI that has 32-bit time_t
> today. All of these have the exact same semantics as their existing
> counterparts, and the new ones all have macro names that end in 'time64'
> for clarification.
>
> This gets us to the point of being able to safely use a C library
> that has 64-bit time_t in user space. There are still a couple of
> loose ends to tie up in various areas of the code, but this is the
> big one, and should be entirely uncontroversial at this point.
I've successfully tested this with musl and LTP now, using an
i386 kernel. The musl port I used is at
https://git.linaro.org/people/arnd.bergmann/musl-y2038.git/
This is just an updated version of what I used for testing last
year, using the current syscall assignment, and going back
to the time32 versions of getitimer/setitimer and
wait4/waitid/getusage.
It's certainly not intended for merging like this, but a proper
musl port is under discussion now, and this should be
sufficient if anyone else wants to try out the new syscall
ABI before we merge it.
The LTP I have is heavily hacked, and has a number of
failures resulting from differences between musl and glibc,
or from the way we convert between the kernel types and
the user space types.
The testing found one minor bug in all the kernel syscall tables:
> +418 common mq_timedsend_time64 sys_mq_timedsend
> +419 common mq_timedreceiv_time64 sys_mq_timedreceive
While this would have fit in with umount(), creat() and mknod(),
it was unintentional, and I've changed it back to
mq_timedreceive_time64 (with an added 'e').
Arnd
^ permalink raw reply
* Re: [PATCH v2 3/4] kbuild: add real-prereqs shorthand for $(filter-out FORCE,$^)
From: Rob Herring @ 2019-01-21 15:53 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Mark Rutland, linux-s390, Michal Marek, linux-kbuild, James Hogan,
x86, Heiko Carstens, linux-mips, Ralf Baechle, linux-kernel,
devicetree, Ingo Molnar, Borislav Petkov, Paul Burton,
H. Peter Anvin, Martin Schwidefsky, Paul Mackerras,
Thomas Gleixner, linuxppc-dev
In-Reply-To: <1547719364-18849-3-git-send-email-yamada.masahiro@socionext.com>
On Thu, Jan 17, 2019 at 07:02:43PM +0900, Masahiro Yamada wrote:
> In Kbuild, if_changed and friends must have FORCE as a prerequisite.
>
> Hence, $(filter-out FORCE,$^) or $(filter-out $(PHONY),$^) is a common
> pattern to get the names of all the prerequisites except phony targets.
>
> Add real-prereqs as a shorthand.
>
> Note:
> We cannot replace $(filter %.o,$^) in cmd_link_multi-m because $^ may
> include auto-generated dependencies from the .*.cmd file when a single
> object module is changed into a multi object module. Refer to commit
> 69ea912fda74 ("kbuild: remove unneeded link_multi_deps"). I added some
> comment to avoid accidental breakage.
>
> Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
> ---
>
> The patch context depends on some other ones.
> Please use 'git am -C1' if you want to test this
> on Linus' tree.
>
>
> Changes in v2:
> - clean up arch/s390/boot/Makefile as well
>
> Documentation/devicetree/bindings/Makefile | 2 +-
Acked-by: Rob Herring <robh@kernel.org>
> arch/mips/boot/Makefile | 2 +-
> arch/powerpc/boot/Makefile | 2 +-
> arch/s390/boot/Makefile | 2 +-
> arch/x86/realmode/rm/Makefile | 3 +--
> scripts/Kbuild.include | 4 ++++
> scripts/Makefile.build | 9 ++++++---
> scripts/Makefile.lib | 18 +++++++++---------
> scripts/Makefile.modpost | 2 +-
> 9 files changed, 25 insertions(+), 19 deletions(-)
^ permalink raw reply
* Re: [PATCH v3 0/4] Add NXP AUDMIX device and machine drivers
From: Rob Herring @ 2019-01-21 15:23 UTC (permalink / raw)
To: Nicolin Chen
Cc: mark.rutland@arm.com, devicetree@vger.kernel.org,
alsa-devel@alsa-project.org, timur@kernel.org,
Xiubo.Lee@gmail.com, lgirdwood@gmail.com, S.j. Wang,
linux-kernel@vger.kernel.org, Daniel Baluta, tiwai@suse.com,
viorel.suman@gmail.com, Fabio Estevam, broonie@kernel.org,
dl-linux-imx, Viorel Suman, Cosmin Samoila, perex@perex.cz,
linuxppc-dev@lists.ozlabs.org
In-Reply-To: <20190118194642.GA11798@Asurada-Nvidia.nvidia.com>
On Fri, Jan 18, 2019 at 11:46:42AM -0800, Nicolin Chen wrote:
> On Fri, Jan 18, 2019 at 01:16:24PM +0000, Viorel Suman wrote:
> > > > 1. Moved "dais" node from machine driver DTS node to device driver
> > > > DTS node
> > > > as suggested by Rob.
> > > That was not what I suggested. You still have a virtual node which
> > > looks to me to be unnecessary.
> >
> > To me removing virtual node implies that AUDMIX machine driver (imx-
> > audmix.c + virtual node) shall be removed and machine driver code
> > merged into device driver (fsl_audmix.c + device node) - please let me
> > know if my understanding is wrong.
>
> We could use a non-DT configuration right? From the driver logic,
> DT just registers a device corresponding to the machine driver so
> that it can probe(). We could register one in fsl_audmix instead.
> Please refer to how fsl_ssi registers the sound card device. The
> machine driver can get audmix_np from the parent device pointer,
> and I think that's all you need.
Yes.
> Or maybe someone else would provide a better way. But it'd work.
Or the machine driver could create the audmix device. That probably
makes less sense, but either way there doesn't have to be a 1-1
correspondence of DT nodes and (platform) devices.
I'm not an ASoC expert, but why can't the machine driver just control
the audmix directly (with DAIs as separate drivers)? Is the audmix ever
going to a be a component for a different machine driver?
Rob
^ permalink raw reply
* Re: use generic DMA mapping code in powerpc V4
From: Christian Zigotzky @ 2019-01-21 14:38 UTC (permalink / raw)
To: Christoph Hellwig
Cc: linux-arch, Darren Stevens, linux-kernel, Julian Margetson,
linux-mm, iommu, Paul Mackerras, Olof Johansson, linuxppc-dev
In-Reply-To: <20190119140452.GA25198@lst.de>
Hello Christoph,
Thanks for your reply. I successfully compiled a kernel (uImage) for the
X5000 from your Git 'powerpc-dma.6-debug' (both patches) today.
It detects the SATA hard disk drive and boots without any problems. I
will test the first patch in next days.
Thanks for your help,
Christian
On 19 January 2019 at 3:04PM, Christoph Hellwig wrote:
> On Sat, Jan 19, 2019 at 02:02:22PM +0100, Christoph Hellwig wrote:
>> Interesting. This suggest it is related to the use of ZONE_DMA by
>> the FSL SOCs that your board uses. Let me investigate this a bit more.
> As a hack to check that theory I've pushed a new commit to the
> powerpc-dma.6-debug branch to use old powerpc GFP_DMA selection
> with the new dma direct code:
>
> http://git.infradead.org/users/hch/misc.git/commitdiff/5c532d07c2f3c3972104de505d06b8d85f403f06
>
> And another one that drops the addressability checks that powerpc
> never had:
>
> http://git.infradead.org/users/hch/misc.git/commitdiff/18e7629b38465ca98f8e7eed639123a13ac3b669
>
> Can you first test with both patches, and then just with the first
> in case that worked?
>
>
^ permalink raw reply
* Re: [PATCHv5 1/4] dt-bindings: add DT binding for the layerscape PCIe controller with EP mode
From: Rob Herring @ 2019-01-21 14:37 UTC (permalink / raw)
To: Xiaowei Bao
Cc: mark.rutland, roy.zang, lorenzo.pieralisi, arnd, devicetree,
gregkh, kstewart, niklas.cassel, linux-pci, linux-kernel, kishon,
minghuan.Lian, cyrille.pitchen, linux-arm-kernel, pombredanne,
bhelgaas, leoyang.li, shawnguo, shawn.lin, mingkai.hu,
linuxppc-dev
In-Reply-To: <20190121094500.10657-1-xiaowei.bao@nxp.com>
On Mon, Jan 21, 2019 at 05:44:57PM +0800, Xiaowei Bao wrote:
> Add the documentation for the Device Tree binding for the layerscape PCIe
> controller with EP mode.
>
> Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
> Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
> Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
> ---
> v2:
> - Add the SoC specific compatibles.
> v3:
> - modify the commit message.
> v4:
> - no change.
> v5:
> - no change.
Still missing my R-by tag from v3.
>
> .../devicetree/bindings/pci/layerscape-pci.txt | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
^ permalink raw reply
* Re: [PATCHv5 3/4] pci: layerscape: Add the EP mode support.
From: Kishon Vijay Abraham I @ 2019-01-21 11:01 UTC (permalink / raw)
To: Xiaowei Bao, bhelgaas, robh+dt, mark.rutland, shawnguo,
leoyang.li, lorenzo.pieralisi, arnd, gregkh, minghuan.Lian,
mingkai.hu, roy.zang, kstewart, cyrille.pitchen, pombredanne,
shawn.lin, niklas.cassel, linux-pci, devicetree, linux-kernel,
linux-arm-kernel, linuxppc-dev
In-Reply-To: <20190121094500.10657-3-xiaowei.bao@nxp.com>
Hi Xiaowei,
On 21/01/19 3:14 PM, Xiaowei Bao wrote:
> Add the PCIe EP mode support for layerscape platform.
>
> Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
> Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
> Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
This patch looks good to me, except for using epc->features which I've tried to
get rid of in [1]. After Lorenzo's review, one of us have to change it to the
new design.
Thanks
Kishon
[1] -> https://patchwork.kernel.org/project/linux-pci/list/?series=66177
> ---
> v2:
> - remove the EP mode check function.
> v3:
> - modif the return value when enter default case.
> v4:
> - no change.
> v5:
> - no change.
>
> drivers/pci/controller/dwc/Makefile | 2 +-
> drivers/pci/controller/dwc/pci-layerscape-ep.c | 146 ++++++++++++++++++++++++
> 2 files changed, 147 insertions(+), 1 deletions(-)
> create mode 100644 drivers/pci/controller/dwc/pci-layerscape-ep.c
>
> diff --git a/drivers/pci/controller/dwc/Makefile b/drivers/pci/controller/dwc/Makefile
> index 7bcdcdf..b5f3b83 100644
> --- a/drivers/pci/controller/dwc/Makefile
> +++ b/drivers/pci/controller/dwc/Makefile
> @@ -8,7 +8,7 @@ obj-$(CONFIG_PCI_EXYNOS) += pci-exynos.o
> obj-$(CONFIG_PCI_IMX6) += pci-imx6.o
> obj-$(CONFIG_PCIE_SPEAR13XX) += pcie-spear13xx.o
> obj-$(CONFIG_PCI_KEYSTONE) += pci-keystone.o
> -obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o
> +obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o pci-layerscape-ep.o
> obj-$(CONFIG_PCIE_QCOM) += pcie-qcom.o
> obj-$(CONFIG_PCIE_ARMADA_8K) += pcie-armada8k.o
> obj-$(CONFIG_PCIE_ARTPEC6) += pcie-artpec6.o
> diff --git a/drivers/pci/controller/dwc/pci-layerscape-ep.c b/drivers/pci/controller/dwc/pci-layerscape-ep.c
> new file mode 100644
> index 0000000..dafb528
> --- /dev/null
> +++ b/drivers/pci/controller/dwc/pci-layerscape-ep.c
> @@ -0,0 +1,146 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * PCIe controller EP driver for Freescale Layerscape SoCs
> + *
> + * Copyright (C) 2018 NXP Semiconductor.
> + *
> + * Author: Xiaowei Bao <xiaowei.bao@nxp.com>
> + */
> +
> +#include <linux/kernel.h>
> +#include <linux/init.h>
> +#include <linux/of_pci.h>
> +#include <linux/of_platform.h>
> +#include <linux/of_address.h>
> +#include <linux/pci.h>
> +#include <linux/platform_device.h>
> +#include <linux/resource.h>
> +
> +#include "pcie-designware.h"
> +
> +#define PCIE_DBI2_OFFSET 0x1000 /* DBI2 base address*/
> +
> +struct ls_pcie_ep {
> + struct dw_pcie *pci;
> +};
> +
> +#define to_ls_pcie_ep(x) dev_get_drvdata((x)->dev)
> +
> +static int ls_pcie_establish_link(struct dw_pcie *pci)
> +{
> + return 0;
> +}
> +
> +static const struct dw_pcie_ops ls_pcie_ep_ops = {
> + .start_link = ls_pcie_establish_link,
> +};
> +
> +static const struct of_device_id ls_pcie_ep_of_match[] = {
> + { .compatible = "fsl,ls-pcie-ep",},
> + { },
> +};
> +
> +static void ls_pcie_ep_init(struct dw_pcie_ep *ep)
> +{
> + struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
> + struct pci_epc *epc = ep->epc;
> + enum pci_barno bar;
> +
> + for (bar = BAR_0; bar <= BAR_5; bar++)
> + dw_pcie_ep_reset_bar(pci, bar);
> +
> + epc->features |= EPC_FEATURE_NO_LINKUP_NOTIFIER;
> +}
> +
> +static int ls_pcie_ep_raise_irq(struct dw_pcie_ep *ep, u8 func_no,
> + enum pci_epc_irq_type type, u16 interrupt_num)
> +{
> + struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
> +
> + switch (type) {
> + case PCI_EPC_IRQ_LEGACY:
> + return dw_pcie_ep_raise_legacy_irq(ep, func_no);
> + case PCI_EPC_IRQ_MSI:
> + return dw_pcie_ep_raise_msi_irq(ep, func_no, interrupt_num);
> + case PCI_EPC_IRQ_MSIX:
> + return dw_pcie_ep_raise_msix_irq(ep, func_no, interrupt_num);
> + default:
> + dev_err(pci->dev, "UNKNOWN IRQ type\n");
> + return -EINVAL;
> + }
> +}
> +
> +static struct dw_pcie_ep_ops pcie_ep_ops = {
> + .ep_init = ls_pcie_ep_init,
> + .raise_irq = ls_pcie_ep_raise_irq,
> +};
> +
> +static int __init ls_add_pcie_ep(struct ls_pcie_ep *pcie,
> + struct platform_device *pdev)
> +{
> + struct dw_pcie *pci = pcie->pci;
> + struct device *dev = pci->dev;
> + struct dw_pcie_ep *ep;
> + struct resource *res;
> + int ret;
> +
> + ep = &pci->ep;
> + ep->ops = &pcie_ep_ops;
> +
> + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "addr_space");
> + if (!res)
> + return -EINVAL;
> +
> + ep->phys_base = res->start;
> + ep->addr_size = resource_size(res);
> +
> + ret = dw_pcie_ep_init(ep);
> + if (ret) {
> + dev_err(dev, "failed to initialize endpoint\n");
> + return ret;
> + }
> +
> + return 0;
> +}
> +
> +static int __init ls_pcie_ep_probe(struct platform_device *pdev)
> +{
> + struct device *dev = &pdev->dev;
> + struct dw_pcie *pci;
> + struct ls_pcie_ep *pcie;
> + struct resource *dbi_base;
> + int ret;
> +
> + pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
> + if (!pcie)
> + return -ENOMEM;
> +
> + pci = devm_kzalloc(dev, sizeof(*pci), GFP_KERNEL);
> + if (!pci)
> + return -ENOMEM;
> +
> + dbi_base = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
> + pci->dbi_base = devm_pci_remap_cfg_resource(dev, dbi_base);
> + if (IS_ERR(pci->dbi_base))
> + return PTR_ERR(pci->dbi_base);
> +
> + pci->dbi_base2 = pci->dbi_base + PCIE_DBI2_OFFSET;
> + pci->dev = dev;
> + pci->ops = &ls_pcie_ep_ops;
> + pcie->pci = pci;
> +
> + platform_set_drvdata(pdev, pcie);
> +
> + ret = ls_add_pcie_ep(pcie, pdev);
> +
> + return ret;
> +}
> +
> +static struct platform_driver ls_pcie_ep_driver = {
> + .driver = {
> + .name = "layerscape-pcie-ep",
> + .of_match_table = ls_pcie_ep_of_match,
> + .suppress_bind_attrs = true,
> + },
> +};
> +builtin_platform_driver_probe(ls_pcie_ep_driver, ls_pcie_ep_probe);
>
^ permalink raw reply
* Re: [Bug 202149] New: NULL Pointer Dereference in __split_huge_pmd on PPC64LE
From: Aneesh Kumar K.V @ 2019-01-21 12:35 UTC (permalink / raw)
To: Matt Corallo; +Cc: linux-mm, Andrew Morton, bugzilla-daemon, linuxppc-dev
In-Reply-To: <A61367CF-277E-4E74-8A9D-C94C5E53817B@bluematt.me>
Can you test this patch?
From e511e79af9a314854848ea8fda9dfa6d7e07c5e4 Mon Sep 17 00:00:00 2001
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Date: Mon, 21 Jan 2019 16:43:17 +0530
Subject: [PATCH] arch/powerpc/radix: Fix kernel crash with mremap
With support for split pmd lock, we use pmd page pmd_huge_pte pointer to store
the deposited page table. In those config when we move page tables we need to
make sure we move the depoisted page table to the right pmd page. Otherwise this
can result in crash when we withdraw of deposited page table because we can find
the pmd_huge_pte NULL.
c0000000004a1230 __split_huge_pmd+0x1070/0x1940
c0000000004a0ff4 __split_huge_pmd+0xe34/0x1940 (unreliable)
c0000000004a4000 vma_adjust_trans_huge+0x110/0x1c0
c00000000042fe04 __vma_adjust+0x2b4/0x9b0
c0000000004316e8 __split_vma+0x1b8/0x280
c00000000043192c __do_munmap+0x13c/0x550
c000000000439390 sys_mremap+0x220/0x7e0
c00000000000b488 system_call+0x5c/0x70
Fixes: 675d995297d4 ("powerpc/book3s64: Enable split pmd ptlock.")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
---
arch/powerpc/include/asm/book3s/64/pgtable.h | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 92eaea164700..86e62384256d 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1262,8 +1262,6 @@ static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
struct spinlock *old_pmd_ptl,
struct vm_area_struct *vma)
{
- if (radix_enabled())
- return false;
/*
* Archs like ppc64 use pgtable to store per pmd
* specific information. So when we switch the pmd,
--
2.20.1
^ permalink raw reply related
* Re: [PATCH v3 3/3] powerpc/32: Add KASAN support
From: Dmitry Vyukov @ 2019-01-21 12:33 UTC (permalink / raw)
To: Christophe Leroy
Cc: Aneesh Kumar K.V, LKML, Nicholas Piggin, Linux-MM, Paul Mackerras,
kasan-dev, Andrey Ryabinin, Alexander Potapenko, linuxppc-dev
In-Reply-To: <fbb4451f-293e-4f2d-2928-da8d8c1f7ef4@c-s.fr>
On Mon, Jan 21, 2019 at 11:36 AM Christophe Leroy
<christophe.leroy@c-s.fr> wrote:
>
>
>
> Le 15/01/2019 à 18:23, Andrey Ryabinin a écrit :
> >
> >
> > On 1/12/19 2:16 PM, Christophe Leroy wrote:
> >
> >> +KASAN_SANITIZE_early_32.o := n
> >> +KASAN_SANITIZE_cputable.o := n
> >> +KASAN_SANITIZE_prom_init.o := n
> >> +
> >
> > Usually it's also good idea to disable branch profiling - define DISABLE_BRANCH_PROFILING
> > either in top of these files or via Makefile. Branch profiling redefines if() statement and calls
> > instrumented ftrace_likely_update in every if().
> >
> >
> >
> >> diff --git a/arch/powerpc/mm/kasan_init.c b/arch/powerpc/mm/kasan_init.c
> >> new file mode 100644
> >> index 000000000000..3edc9c2d2f3e
> >
> >> +void __init kasan_init(void)
> >> +{
> >> + struct memblock_region *reg;
> >> +
> >> + for_each_memblock(memory, reg)
> >> + kasan_init_region(reg);
> >> +
> >> + pr_info("KASAN init done\n");
> >
> > Without "init_task.kasan_depth = 0;" kasan will not repot bugs.
> >
> > There is test_kasan module. Make sure that it produce reports.
> >
>
> I get the following report with test_kasan module.
>
> Could you have a look at it and tell if everything is as expected ?
Unfortunately kernel does not support tests that could check this.
This is called a test, but it does not actually test anything. There
is bug open for this:
https://bugzilla.kernel.org/show_bug.cgi?id=198441
You need to look at each test and understand if it is supposed to
produce a report or not, and then check if it actually produced the
report or not. In most cases this can be understood from the test name
(hopefully).
> [ 667.298897] kasan test: kmalloc_oob_right out-of-bounds to right
> [ 667.299036]
> ==================================================================
> [ 667.306263] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_right+0x74/0x94 [test_kasan]
> [ 667.313929] Write of size 1 at addr c53996fb by task exe/340
> [ 667.319451]
> [ 667.321021] CPU: 0 PID: 340 Comm: exe Not tainted
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 667.321072] Call Trace:
> [ 667.321248] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 667.321452] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 667.321741] [c5649ce0] [c95d41d4] kmalloc_oob_right+0x74/0x94
> [test_kasan]
> [ 667.322022] [c5649d00] [c95d5510] kmalloc_tests_init+0x18/0x2d0
> [test_kasan]
> [ 667.322214] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 667.322428] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 667.322630] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 667.322834] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 667.323027] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 667.323193] --- interrupt: c01 at 0xfd6b914
> [ 667.323193] LR = 0x1001364c
> [ 667.323239]
> [ 667.324561] Allocated by task 340:
> [ 667.327993] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 667.328241] kmalloc_oob_right+0x44/0x94 [test_kasan]
> [ 667.328477] kmalloc_tests_init+0x18/0x2d0 [test_kasan]
> [ 667.328622] do_one_initcall+0x40/0x278
> [ 667.328792] do_init_module+0xcc/0x59c
> [ 667.328948] load_module+0x2bc4/0x320c
> [ 667.329107] sys_init_module+0x114/0x138
> [ 667.329250] ret_from_syscall+0x0/0x38
> [ 667.329298]
> [ 667.330580] Freed by task 335:
> [ 667.333667] __kasan_slab_free+0x120/0x22c
> [ 667.333788] kfree+0x74/0x270
> [ 667.333950] load_elf_binary+0xb0/0x162c
> [ 667.334129] search_binary_handler+0x120/0x374
> [ 667.334297] __do_execve_file+0x834/0xb20
> [ 667.334460] sys_execve+0x40/0x54
> [ 667.334605] ret_from_syscall+0x0/0x38
> [ 667.334652]
> [ 667.335954] The buggy address belongs to the object at c5399680
> [ 667.335954] which belongs to the cache kmalloc-128 of size 128
> [ 667.347675] The buggy address is located 123 bytes inside of
> [ 667.347675] 128-byte region [c5399680, c5399700)
> [ 667.357847] The buggy address belongs to the page:
> [ 667.362634] page:c7fd9cc0 count:1 mapcount:0 mapping:c5007a80 index:0x0
> [ 667.362745] flags: 0x200(slab)
> [ 667.362973] raw: 00000200 00000100 00000200 c5007a80 00000000
> 005500ab ffffffff 00000001
> [ 667.363043] page dumped because: kasan: bad access detected
> [ 667.363083]
> [ 667.364384] Memory state around the buggy address:
> [ 667.369190] c5399580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> [ 667.375645] c5399600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 667.382099] >c5399680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
> [ 667.388496] ^
> [ 667.394921] c5399700: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> [ 667.401377] c5399780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 667.407767]
> ==================================================================
> [ 667.414904] Disabling lock debugging due to kernel taint
> [ 667.421182] kasan test: kmalloc_oob_left out-of-bounds to left
> [ 667.421314]
> ==================================================================
> [ 667.428466] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_left+0x74/0x9c [test_kasan]
> [ 667.436045] Read of size 1 at addr c58e9ddf by task exe/340
> [ 667.441483]
> [ 667.443064] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 667.443115] Call Trace:
> [ 667.443290] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 667.443492] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 667.443779] [c5649ce0] [c95d4268] kmalloc_oob_left+0x74/0x9c [test_kasan]
> [ 667.444057] [c5649d00] [c95d5514] kmalloc_tests_init+0x1c/0x2d0
> [test_kasan]
> [ 667.444246] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 667.444458] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 667.444658] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 667.444859] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 667.445051] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 667.445215] --- interrupt: c01 at 0xfd6b914
> [ 667.445215] LR = 0x1001364c
> [ 667.445260]
> [ 667.446593] Allocated by task 340:
> [ 667.450025] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 667.450191] do_init_module+0x2c/0x59c
> [ 667.450346] load_module+0x2bc4/0x320c
> [ 667.450503] sys_init_module+0x114/0x138
> [ 667.450645] ret_from_syscall+0x0/0x38
> [ 667.450691]
> [ 667.452009] Freed by task 276:
> [ 667.455096] __kasan_slab_free+0x120/0x22c
> [ 667.455214] kfree+0x74/0x270
> [ 667.455344] single_release+0x54/0x6c
> [ 667.455516] close_pdeo+0x128/0x224
> [ 667.455680] proc_reg_release+0x110/0x128
> [ 667.455811] __fput+0xec/0x2d4
> [ 667.455934] task_work_run+0x13c/0x15c
> [ 667.456101] do_notify_resume+0x3d8/0x438
> [ 667.456248] do_user_signal+0x2c/0x34
> [ 667.456294]
> [ 667.457641] The buggy address belongs to the object at c58e9dc0
> [ 667.457641] which belongs to the cache kmalloc-16 of size 16
> [ 667.469191] The buggy address is located 15 bytes to the right of
> [ 667.469191] 16-byte region [c58e9dc0, c58e9dd0)
> [ 667.479708] The buggy address belongs to the page:
> [ 667.484495] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 667.484606] flags: 0x200(slab)
> [ 667.484833] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 667.484900] page dumped because: kasan: bad access detected
> [ 667.484940]
> [ 667.486244] Memory state around the buggy address:
> [ 667.491051] c58e9c80: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
> [ 667.497505] c58e9d00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
> [ 667.503959] >c58e9d80: 00 00 fc fc 00 00 fc fc 00 04 fc fc 00 07 fc fc
> [ 667.510354] ^
> [ 667.515748] c58e9e00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 667.522204] c58e9e80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 667.528595]
> ==================================================================
> [ 667.803662] kasan test: kmalloc_node_oob_right kmalloc_node():
> out-of-bounds to right
> [ 667.803806]
> ==================================================================
> [ 667.811008] BUG: KASAN: slab-out-of-bounds in
> kmalloc_node_oob_right+0x74/0x94 [test_kasan]
> [ 667.819105] Write of size 1 at addr c59a4300 by task exe/340
> [ 667.824627]
> [ 667.826209] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 667.826260] Call Trace:
> [ 667.826436] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 667.826640] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 667.826931] [c5649ce0] [c95d4304] kmalloc_node_oob_right+0x74/0x94
> [test_kasan]
> [ 667.827211] [c5649d00] [c95d5518] kmalloc_tests_init+0x20/0x2d0
> [test_kasan]
> [ 667.827402] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 667.827616] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 667.827818] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 667.828022] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 667.828216] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 667.828382] --- interrupt: c01 at 0xfd6b914
> [ 667.828382] LR = 0x1001364c
> [ 667.828428]
> [ 667.829737] Allocated by task 340:
> [ 667.833169] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 667.833420] kmalloc_node_oob_right+0x44/0x94 [test_kasan]
> [ 667.833656] kmalloc_tests_init+0x20/0x2d0 [test_kasan]
> [ 667.833801] do_one_initcall+0x40/0x278
> [ 667.833970] do_init_module+0xcc/0x59c
> [ 667.834125] load_module+0x2bc4/0x320c
> [ 667.834284] sys_init_module+0x114/0x138
> [ 667.834427] ret_from_syscall+0x0/0x38
> [ 667.834475]
> [ 667.835756] Freed by task 319:
> [ 667.838843] __kasan_slab_free+0x120/0x22c
> [ 667.838963] kfree+0x74/0x270
> [ 667.839137] kobject_uevent_env+0x15c/0x65c
> [ 667.839299] led_trigger_set+0x3f0/0x4fc
> [ 667.839451] led_trigger_store+0xd8/0x164
> [ 667.839593] kernfs_fop_write+0x18c/0x218
> [ 667.839721] __vfs_write+0x5c/0x258
> [ 667.839843] vfs_write+0xe4/0x248
> [ 667.839966] ksys_write+0x58/0xd8
> [ 667.840111] ret_from_syscall+0x0/0x38
> [ 667.840158]
> [ 667.841475] The buggy address belongs to the object at c59a3300
> [ 667.841475] which belongs to the cache kmalloc-4k of size 4096
> [ 667.853196] The buggy address is located 0 bytes to the right of
> [ 667.853196] 4096-byte region [c59a3300, c59a4300)
> [ 667.863798] The buggy address belongs to the page:
> [ 667.868586] page:c7fdcd00 count:1 mapcount:0 mapping:c50075a0
> index:0x0 compound_mapcount: 0
> [ 667.868727] flags: 0x10200(slab|head)
> [ 667.868956] raw: 00010200 00000100 00000200 c50075a0 00000000
> 000f001f ffffffff 00000001
> [ 667.869025] page dumped because: kasan: bad access detected
> [ 667.869065]
> [ 667.870334] Memory state around the buggy address:
> [ 667.875141] c59a4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 667.881595] c59a4280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 667.888049] >c59a4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 667.894436] ^
> [ 667.896998] c59a4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 667.903454] c59a4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 667.909845]
> ==================================================================
> [ 667.923434] kasan test: kmalloc_pagealloc_oob_right kmalloc pagealloc
> allocation: out-of-bounds to right
> [ 667.923647]
> ==================================================================
> [ 667.930896] BUG: KASAN: slab-out-of-bounds in
> kmalloc_pagealloc_oob_right+0x78/0x98 [test_kasan]
> [ 667.939503] Write of size 1 at addr c5bd800a by task exe/340
> [ 667.945024]
> [ 667.946607] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 667.946657] Call Trace:
> [ 667.946833] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 667.947035] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 667.947325] [c5649ce0] [c95d4674]
> kmalloc_pagealloc_oob_right+0x78/0x98 [test_kasan]
> [ 667.947603] [c5649d00] [c95d551c] kmalloc_tests_init+0x24/0x2d0
> [test_kasan]
> [ 667.947792] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 667.948004] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 667.948204] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 667.948406] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 667.948597] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 667.948760] --- interrupt: c01 at 0xfd6b914
> [ 667.948760] LR = 0x1001364c
> [ 667.948806]
> [ 667.950115] The buggy address belongs to the page:
> [ 667.954903] page:c7fdde80 count:1 mapcount:0 mapping:00000000
> index:0x0 compound_mapcount: 0
> [ 667.955038] flags: 0x10000(head)
> [ 667.955260] raw: 00010000 00000100 00000200 00000000 00000000
> 00000000 ffffffff 00000001
> [ 667.955327] page dumped because: kasan: bad access detected
> [ 667.955367]
> [ 667.956652] Memory state around the buggy address:
> [ 667.961458] c5bd7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 667.967912] c5bd7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 667.974367] >c5bd8000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> [ 667.980755] ^
> [ 667.983574] c5bd8080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> [ 667.990030] c5bd8100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> [ 667.996420]
> ==================================================================
> [ 668.222064] kasan test: kmalloc_pagealloc_uaf kmalloc pagealloc
> allocation: use-after-free
> [ 668.222349]
> ==================================================================
> [ 668.229525] BUG: KASAN: use-after-free in
> kmalloc_pagealloc_uaf+0x78/0x94 [test_kasan]
> [ 668.237274] Write of size 1 at addr c5bd0000 by task exe/340
> [ 668.242796]
> [ 668.244378] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 668.244429] Call Trace:
> [ 668.244606] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 668.244810] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 668.245100] [c5649ce0] [c95d470c] kmalloc_pagealloc_uaf+0x78/0x94
> [test_kasan]
> [ 668.245381] [c5649d00] [c95d5520] kmalloc_tests_init+0x28/0x2d0
> [test_kasan]
> [ 668.245573] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 668.245787] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 668.245989] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 668.246192] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 668.246386] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 668.246552] --- interrupt: c01 at 0xfd6b914
> [ 668.246552] LR = 0x1001364c
> [ 668.246598]
> [ 668.247886] The buggy address belongs to the page:
> [ 668.252671] page:c7fdde80 count:0 mapcount:-128 mapping:00000000
> index:0x0
> [ 668.252769] flags: 0x0()
> [ 668.252994] raw: 00000000 c7fdcf84 c0982ae8 00000000 00000000
> 00000002 ffffff7f 00000000
> [ 668.253062] page dumped because: kasan: bad access detected
> [ 668.253102]
> [ 668.254337] Memory state around the buggy address:
> [ 668.259143] c5bcff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.265597] c5bcff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.272052] >c5bd0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> [ 668.278439] ^
> [ 668.281001] c5bd0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> [ 668.287458] c5bd0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> [ 668.293847]
> ==================================================================
> [ 668.310744] kasan test: kmalloc_pagealloc_invalid_free kmalloc
> pagealloc allocation: invalid-free
> [ 668.310957]
> ==================================================================
> [ 668.318156] BUG: KASAN: double-free or invalid-free in
> kmalloc_tests_init+0x2c/0x2d0 [test_kasan]
> [ 668.326705]
> [ 668.328286] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 668.328337] Call Trace:
> [ 668.328512] [c5649c80] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 668.328724] [c5649cb0] [c0176c24] kasan_report_invalid_free+0x48/0x74
> [ 668.328888] [c5649ce0] [c0173c14] kfree+0x1f8/0x270
> [ 668.329176] [c5649d00] [c95d5524] kmalloc_tests_init+0x2c/0x2d0
> [test_kasan]
> [ 668.329365] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 668.329577] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 668.329777] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 668.329978] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 668.330170] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 668.330334] --- interrupt: c01 at 0xfd6b914
> [ 668.330334] LR = 0x1001364c
> [ 668.330379]
> [ 668.331622] The buggy address belongs to the page:
> [ 668.336410] page:c7fdde80 count:1 mapcount:0 mapping:00000000
> index:0x0 compound_mapcount: 0
> [ 668.336545] flags: 0x10000(head)
> [ 668.336767] raw: 00010000 00000100 00000200 00000000 00000000
> 00000000 ffffffff 00000001
> [ 668.336834] page dumped because: kasan: bad access detected
> [ 668.336873]
> [ 668.338158] Memory state around the buggy address:
> [ 668.342965] c5bcff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.349419] c5bcff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.355874] >c5bd0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 668.362260] ^
> [ 668.364822] c5bd0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 668.371279] c5bd0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 668.377668]
> ==================================================================
> [ 668.528086] kasan test: kmalloc_large_oob_right kmalloc large
> allocation: out-of-bounds to right
> [ 668.528279]
> ==================================================================
> [ 668.535471] BUG: KASAN: slab-out-of-bounds in
> kmalloc_large_oob_right+0x74/0x94 [test_kasan]
> [ 668.543735] Write of size 1 at addr c5498700 by task exe/340
> [ 668.549257]
> [ 668.550840] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 668.550891] Call Trace:
> [ 668.551068] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 668.551272] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 668.551561] [c5649ce0] [c95d4398] kmalloc_large_oob_right+0x74/0x94
> [test_kasan]
> [ 668.551842] [c5649d00] [c95d5528] kmalloc_tests_init+0x30/0x2d0
> [test_kasan]
> [ 668.552034] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 668.552248] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 668.552450] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 668.552655] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 668.552848] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 668.553013] --- interrupt: c01 at 0xfd6b914
> [ 668.553013] LR = 0x1001364c
> [ 668.553059]
> [ 668.554367] Allocated by task 340:
> [ 668.557799] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 668.558049] kmalloc_large_oob_right+0x44/0x94 [test_kasan]
> [ 668.558285] kmalloc_tests_init+0x30/0x2d0 [test_kasan]
> [ 668.558430] do_one_initcall+0x40/0x278
> [ 668.558599] do_init_module+0xcc/0x59c
> [ 668.558756] load_module+0x2bc4/0x320c
> [ 668.558915] sys_init_module+0x114/0x138
> [ 668.559058] ret_from_syscall+0x0/0x38
> [ 668.559106]
> [ 668.560386] Freed by task 173:
> [ 668.563473] __kasan_slab_free+0x120/0x22c
> [ 668.563595] kfree+0x74/0x270
> [ 668.563763] consume_skb+0x38/0x138
> [ 668.563935] skb_free_datagram+0x1c/0x80
> [ 668.564104] netlink_recvmsg+0x1d0/0x4d4
> [ 668.564270] ___sys_recvmsg+0xd8/0x194
> [ 668.564436] __sys_recvmsg+0x40/0x8c
> [ 668.564563] sys_socketcall+0xf8/0x210
> [ 668.564709] ret_from_syscall+0x0/0x38
> [ 668.564756]
> [ 668.566106] The buggy address belongs to the object at c5490800
> [ 668.566106] which belongs to the cache kmalloc-32k of size 32768
> [ 668.578000] The buggy address is located 32512 bytes inside of
> [ 668.578000] 32768-byte region [c5490800, c5498800)
> [ 668.588514] The buggy address belongs to the page:
> [ 668.593302] page:c7fda400 count:1 mapcount:0 mapping:c5007330
> index:0x0 compound_mapcount: 0
> [ 668.593443] flags: 0x10200(slab|head)
> [ 668.593672] raw: 00010200 00000100 00000200 c5007330 00000000
> 00030007 ffffffff 00000001
> [ 668.593741] page dumped because: kasan: bad access detected
> [ 668.593781]
> [ 668.595051] Memory state around the buggy address:
> [ 668.599857] c5498600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 668.606311] c5498680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 668.612765] >c5498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.619152] ^
> [ 668.621714] c5498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.628171] c5498800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 668.634561]
> ==================================================================
> [ 668.645940] kasan test: kmalloc_oob_krealloc_more out-of-bounds after
> krealloc more
> [ 668.646103]
> ==================================================================
> [ 668.653286] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_krealloc_more+0x8c/0xac [test_kasan]
> [ 668.661723] Write of size 1 at addr c53e8ca3 by task exe/340
> [ 668.667245]
> [ 668.668827] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 668.668877] Call Trace:
> [ 668.669052] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 668.669254] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 668.669543] [c5649ce0] [c95d4838] kmalloc_oob_krealloc_more+0x8c/0xac
> [test_kasan]
> [ 668.669823] [c5649d00] [c95d552c] kmalloc_tests_init+0x34/0x2d0
> [test_kasan]
> [ 668.670012] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 668.670225] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 668.670426] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 668.670627] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 668.670819] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 668.670982] --- interrupt: c01 at 0xfd6b914
> [ 668.670982] LR = 0x1001364c
> [ 668.671027]
> [ 668.672354] Allocated by task 340:
> [ 668.675786] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 668.675935] krealloc+0xb0/0xe8
> [ 668.676185] kmalloc_oob_krealloc_more+0x58/0xac [test_kasan]
> [ 668.676419] kmalloc_tests_init+0x34/0x2d0 [test_kasan]
> [ 668.676563] do_one_initcall+0x40/0x278
> [ 668.676730] do_init_module+0xcc/0x59c
> [ 668.676885] load_module+0x2bc4/0x320c
> [ 668.677042] sys_init_module+0x114/0x138
> [ 668.677185] ret_from_syscall+0x0/0x38
> [ 668.677231]
> [ 668.678543] Freed by task 0:
> [ 668.681460] __kasan_slab_free+0x120/0x22c
> [ 668.681579] kfree+0x74/0x270
> [ 668.681726] rcu_process_callbacks+0x384/0x620
> [ 668.681858] __do_softirq+0x134/0x48c
> [ 668.681904]
> [ 668.683231] The buggy address belongs to the object at c53e8c90
> [ 668.683231] which belongs to the cache kmalloc-32 of size 32
> [ 668.694778] The buggy address is located 19 bytes inside of
> [ 668.694778] 32-byte region [c53e8c90, c53e8cb0)
> [ 668.704780] The buggy address belongs to the page:
> [ 668.709568] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 668.709676] flags: 0x200(slab)
> [ 668.709903] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 668.709970] page dumped because: kasan: bad access detected
> [ 668.710010]
> [ 668.711317] Memory state around the buggy address:
> [ 668.716124] c53e8b80: 00 fc fc fc 00 00 00 fc fc fc fb fb fb fb fc fc
> [ 668.722579] c53e8c00: 00 00 00 04 fc fc 00 00 00 04 fc fc 00 00 00 00
> [ 668.729033] >c53e8c80: fc fc 00 00 03 fc fc fc 00 00 00 00 fc fc 00 00
> [ 668.735421] ^
> [ 668.739014] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
> [ 668.745470] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
> [ 668.751860]
> ==================================================================
> [ 669.016775] kasan test: kmalloc_oob_krealloc_less out-of-bounds after
> krealloc less
> [ 669.016942]
> ==================================================================
> [ 669.024120] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_krealloc_less+0x8c/0xac [test_kasan]
> [ 669.032474] Write of size 1 at addr c53e8bdf by task exe/340
> [ 669.037995]
> [ 669.039577] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 669.039628] Call Trace:
> [ 669.039803] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 669.040007] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 669.040299] [c5649ce0] [c95d48e4] kmalloc_oob_krealloc_less+0x8c/0xac
> [test_kasan]
> [ 669.040580] [c5649d00] [c95d5530] kmalloc_tests_init+0x38/0x2d0
> [test_kasan]
> [ 669.040771] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 669.040984] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 669.041187] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 669.041390] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 669.041584] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 669.041750] --- interrupt: c01 at 0xfd6b914
> [ 669.041750] LR = 0x1001364c
> [ 669.041796]
> [ 669.043105] Allocated by task 340:
> [ 669.046537] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 669.046687] krealloc+0xb0/0xe8
> [ 669.046940] kmalloc_oob_krealloc_less+0x58/0xac [test_kasan]
> [ 669.047176] kmalloc_tests_init+0x38/0x2d0 [test_kasan]
> [ 669.047321] do_one_initcall+0x40/0x278
> [ 669.047491] do_init_module+0xcc/0x59c
> [ 669.047648] load_module+0x2bc4/0x320c
> [ 669.047806] sys_init_module+0x114/0x138
> [ 669.047951] ret_from_syscall+0x0/0x38
> [ 669.047998]
> [ 669.049294] Freed by task 0:
> [ 669.052211] __kasan_slab_free+0x120/0x22c
> [ 669.052332] kfree+0x74/0x270
> [ 669.052479] rcu_process_callbacks+0x384/0x620
> [ 669.052612] __do_softirq+0x134/0x48c
> [ 669.052659]
> [ 669.053981] The buggy address belongs to the object at c53e8bd0
> [ 669.053981] which belongs to the cache kmalloc-32 of size 32
> [ 669.065529] The buggy address is located 15 bytes inside of
> [ 669.065529] 32-byte region [c53e8bd0, c53e8bf0)
> [ 669.075531] The buggy address belongs to the page:
> [ 669.080318] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 669.080428] flags: 0x200(slab)
> [ 669.080655] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 669.080724] page dumped because: kasan: bad access detected
> [ 669.080764]
> [ 669.082068] Memory state around the buggy address:
> [ 669.086874] c53e8a80: 00 00 00 fc fc fc 00 00 00 fc fc fc 00 00 00 00
> [ 669.093328] c53e8b00: fc fc 00 00 00 fc fc fc 00 00 00 fc fc fc 00 00
> [ 669.099783] >c53e8b80: 00 fc fc fc 00 00 00 fc fc fc 00 07 fc fc fc fc
> [ 669.106177] ^
> [ 669.111572] c53e8c00: 00 00 00 04 fc fc 00 00 00 04 fc fc 00 00 00 00
> [ 669.118028] c53e8c80: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc 00 00
> [ 669.124418]
> ==================================================================
> [ 669.137359] kasan test: kmalloc_oob_16 kmalloc out-of-bounds for
> 16-bytes access
> [ 669.137538]
> ==================================================================
> [ 669.144772] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_16+0x94/0xdc [test_kasan]
> [ 669.152181] Write of size 16 at addr c58eada0 by task exe/340
> [ 669.157790]
> [ 669.159371] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 669.159421] Call Trace:
> [ 669.159597] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 669.159799] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 669.160086] [c5649ce0] [c95d444c] kmalloc_oob_16+0x94/0xdc [test_kasan]
> [ 669.160365] [c5649d00] [c95d5534] kmalloc_tests_init+0x3c/0x2d0
> [test_kasan]
> [ 669.160554] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 669.160765] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 669.160966] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 669.161167] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 669.161360] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 669.161523] --- interrupt: c01 at 0xfd6b914
> [ 669.161523] LR = 0x1001364c
> [ 669.161569]
> [ 669.162900] Allocated by task 340:
> [ 669.166332] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 669.166578] kmalloc_oob_16+0x48/0xdc [test_kasan]
> [ 669.166812] kmalloc_tests_init+0x3c/0x2d0 [test_kasan]
> [ 669.166955] do_one_initcall+0x40/0x278
> [ 669.167121] do_init_module+0xcc/0x59c
> [ 669.167275] load_module+0x2bc4/0x320c
> [ 669.167432] sys_init_module+0x114/0x138
> [ 669.167575] ret_from_syscall+0x0/0x38
> [ 669.167620]
> [ 669.168919] Freed by task 338:
> [ 669.172004] __kasan_slab_free+0x120/0x22c
> [ 669.172122] kfree+0x74/0x270
> [ 669.172264] walk_component+0x150/0x478
> [ 669.172399] link_path_walk+0x374/0x63c
> [ 669.172535] path_openat+0xe4/0x15f8
> [ 669.172674] do_filp_open+0xd0/0x120
> [ 669.172843] do_open_execat+0x64/0x264
> [ 669.173010] __do_execve_file+0xa0c/0xb20
> [ 669.173172] sys_execve+0x40/0x54
> [ 669.173318] ret_from_syscall+0x0/0x38
> [ 669.173364]
> [ 669.174722] The buggy address belongs to the object at c58eada0
> [ 669.174722] which belongs to the cache kmalloc-16 of size 16
> [ 669.186269] The buggy address is located 0 bytes inside of
> [ 669.186269] 16-byte region [c58eada0, c58eadb0)
> [ 669.196187] The buggy address belongs to the page:
> [ 669.200974] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 669.201083] flags: 0x200(slab)
> [ 669.201310] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 669.201378] page dumped because: kasan: bad access detected
> [ 669.201417]
> [ 669.202723] Memory state around the buggy address:
> [ 669.207530] c58eac80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.213984] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.220438] >c58ead80: fb fb fc fc 00 05 fc fc 00 00 fc fc fb fb fc fc
> [ 669.226828] ^
> [ 669.230678] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.237134] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 669.243524]
> ==================================================================
> [ 669.521937] kasan test: kmalloc_oob_in_memset out-of-bounds in memset
> [ 669.522086]
> ==================================================================
> [ 669.529294] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_in_memset+0x78/0x90 [test_kasan]
> [ 669.537306] Write of size 671 at addr c5881b00 by task exe/340
> [ 669.543000]
> [ 669.544581] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 669.544632] Call Trace:
> [ 669.544808] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 669.545012] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 669.545186] [c5649cc0] [c0175700] memset+0x2c/0x4c
> [ 669.545477] [c5649ce0] [c95d497c] kmalloc_oob_in_memset+0x78/0x90
> [test_kasan]
> [ 669.545759] [c5649d00] [c95d5538] kmalloc_tests_init+0x40/0x2d0
> [test_kasan]
> [ 669.545949] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 669.546163] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 669.546366] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 669.546570] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 669.546764] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 669.546929] --- interrupt: c01 at 0xfd6b914
> [ 669.546929] LR = 0x1001364c
> [ 669.546976]
> [ 669.548281] Allocated by task 340:
> [ 669.551713] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 669.551963] kmalloc_oob_in_memset+0x44/0x90 [test_kasan]
> [ 669.552199] kmalloc_tests_init+0x40/0x2d0 [test_kasan]
> [ 669.552346] do_one_initcall+0x40/0x278
> [ 669.552515] do_init_module+0xcc/0x59c
> [ 669.552672] load_module+0x2bc4/0x320c
> [ 669.552831] sys_init_module+0x114/0x138
> [ 669.552976] ret_from_syscall+0x0/0x38
> [ 669.553023]
> [ 669.554300] Freed by task 131:
> [ 669.557387] __kasan_slab_free+0x120/0x22c
> [ 669.557508] kfree+0x74/0x270
> [ 669.557682] pskb_expand_head+0x2b0/0x434
> [ 669.557843] netlink_trim+0xfc/0x114
> [ 669.558009] netlink_broadcast_filtered+0x48/0x530
> [ 669.558169] nlmsg_notify+0x7c/0x128
> [ 669.558330] fib6_add+0xd44/0x11d4
> [ 669.558461] __ip6_ins_rt+0x5c/0x88
> [ 669.558598] ip6_ins_rt+0x34/0x44
> [ 669.558777] __ipv6_ifa_notify+0x388/0x38c
> [ 669.558945] ipv6_ifa_notify+0x68/0x88
> [ 669.559076] addrconf_dad_completed+0x54/0x49c
> [ 669.559201] addrconf_dad_work+0x558/0x84c
> [ 669.559369] process_one_work+0x408/0x78c
> [ 669.559524] worker_thread+0xb4/0x83c
> [ 669.559657] kthread+0x144/0x184
> [ 669.559811] ret_from_kernel_thread+0x14/0x1c
> [ 669.559858]
> [ 669.561223] The buggy address belongs to the object at c5881b00
> [ 669.561223] which belongs to the cache kmalloc-1k of size 1024
> [ 669.572943] The buggy address is located 0 bytes inside of
> [ 669.572943] 1024-byte region [c5881b00, c5881f00)
> [ 669.583031] The buggy address belongs to the page:
> [ 669.587818] page:c7fdc400 count:1 mapcount:0 mapping:c5007740 index:0x0
> [ 669.587929] flags: 0x200(slab)
> [ 669.588156] raw: 00000200 00000100 00000200 c5007740 00000000
> 000e001d ffffffff 00000001
> [ 669.588225] page dumped because: kasan: bad access detected
> [ 669.588265]
> [ 669.589567] Memory state around the buggy address:
> [ 669.594374] c5881c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 669.600828] c5881d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 669.607282] >c5881d80: 00 00 00 02 fc fc fc fc fc fc fc fc fc fc fc fc
> [ 669.613671] ^
> [ 669.617005] c5881e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 669.623462] c5881e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 669.629852]
> ==================================================================
> [ 669.643287] kasan test: kmalloc_oob_memset_2 out-of-bounds in memset2
> [ 669.643423]
> ==================================================================
> [ 669.650641] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_memset_2+0x7c/0x94 [test_kasan]
> [ 669.658563] Write of size 2 at addr c58eae07 by task exe/340
> [ 669.664085]
> [ 669.665668] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 669.665718] Call Trace:
> [ 669.665891] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 669.666095] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 669.666267] [c5649cc0] [c0175700] memset+0x2c/0x4c
> [ 669.666556] [c5649ce0] [c95d4a10] kmalloc_oob_memset_2+0x7c/0x94
> [test_kasan]
> [ 669.666836] [c5649d00] [c95d553c] kmalloc_tests_init+0x44/0x2d0
> [test_kasan]
> [ 669.667026] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 669.667239] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 669.667440] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 669.667643] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 669.667836] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 669.668002] --- interrupt: c01 at 0xfd6b914
> [ 669.668002] LR = 0x1001364c
> [ 669.668046]
> [ 669.669366] Allocated by task 340:
> [ 669.672799] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 669.673048] kmalloc_oob_memset_2+0x44/0x94 [test_kasan]
> [ 669.673283] kmalloc_tests_init+0x44/0x2d0 [test_kasan]
> [ 669.673426] do_one_initcall+0x40/0x278
> [ 669.673594] do_init_module+0xcc/0x59c
> [ 669.673750] load_module+0x2bc4/0x320c
> [ 669.673909] sys_init_module+0x114/0x138
> [ 669.674051] ret_from_syscall+0x0/0x38
> [ 669.674098]
> [ 669.675387] Freed by task 276:
> [ 669.678473] __kasan_slab_free+0x120/0x22c
> [ 669.678594] kfree+0x74/0x270
> [ 669.678724] single_release+0x54/0x6c
> [ 669.678897] close_pdeo+0x128/0x224
> [ 669.679064] proc_reg_release+0x110/0x128
> [ 669.679197] __fput+0xec/0x2d4
> [ 669.679320] task_work_run+0x13c/0x15c
> [ 669.679487] do_notify_resume+0x3d8/0x438
> [ 669.679636] do_user_signal+0x2c/0x34
> [ 669.679682]
> [ 669.681018] The buggy address belongs to the object at c58eae00
> [ 669.681018] which belongs to the cache kmalloc-16 of size 16
> [ 669.692565] The buggy address is located 7 bytes inside of
> [ 669.692565] 16-byte region [c58eae00, c58eae10)
> [ 669.702482] The buggy address belongs to the page:
> [ 669.707268] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 669.707380] flags: 0x200(slab)
> [ 669.707607] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 669.707674] page dumped because: kasan: bad access detected
> [ 669.707713]
> [ 669.709018] Memory state around the buggy address:
> [ 669.713825] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.720279] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.726734] >c58eae00: 00 fc fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.733120] ^
> [ 669.735941] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 669.742397] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 669.748787]
> ==================================================================
> [ 670.056503] kasan test: kmalloc_oob_memset_4 out-of-bounds in memset4
> [ 670.056640]
> ==================================================================
> [ 670.063818] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_memset_4+0x7c/0x94 [test_kasan]
> [ 670.071743] Write of size 4 at addr c58eae25 by task exe/340
> [ 670.077263]
> [ 670.078847] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 670.078898] Call Trace:
> [ 670.079074] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 670.079279] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 670.079452] [c5649cc0] [c0175700] memset+0x2c/0x4c
> [ 670.079743] [c5649ce0] [c95d4aa4] kmalloc_oob_memset_4+0x7c/0x94
> [test_kasan]
> [ 670.080025] [c5649d00] [c95d5540] kmalloc_tests_init+0x48/0x2d0
> [test_kasan]
> [ 670.080216] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 670.080431] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 670.080635] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 670.080839] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 670.081034] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 670.081201] --- interrupt: c01 at 0xfd6b914
> [ 670.081201] LR = 0x1001364c
> [ 670.081247]
> [ 670.082546] Allocated by task 340:
> [ 670.085978] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 670.086229] kmalloc_oob_memset_4+0x44/0x94 [test_kasan]
> [ 670.086465] kmalloc_tests_init+0x48/0x2d0 [test_kasan]
> [ 670.086611] do_one_initcall+0x40/0x278
> [ 670.086782] do_init_module+0xcc/0x59c
> [ 670.086941] load_module+0x2bc4/0x320c
> [ 670.087101] sys_init_module+0x114/0x138
> [ 670.087246] ret_from_syscall+0x0/0x38
> [ 670.087293]
> [ 670.088563] Freed by task 276:
> [ 670.091652] __kasan_slab_free+0x120/0x22c
> [ 670.091774] kfree+0x74/0x270
> [ 670.091906] single_release+0x54/0x6c
> [ 670.092080] close_pdeo+0x128/0x224
> [ 670.092249] proc_reg_release+0x110/0x128
> [ 670.092383] __fput+0xec/0x2d4
> [ 670.092509] task_work_run+0x13c/0x15c
> [ 670.092678] do_notify_resume+0x3d8/0x438
> [ 670.092828] do_user_signal+0x2c/0x34
> [ 670.092874]
> [ 670.094198] The buggy address belongs to the object at c58eae20
> [ 670.094198] which belongs to the cache kmalloc-16 of size 16
> [ 670.105743] The buggy address is located 5 bytes inside of
> [ 670.105743] 16-byte region [c58eae20, c58eae30)
> [ 670.115660] The buggy address belongs to the page:
> [ 670.120447] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 670.120560] flags: 0x200(slab)
> [ 670.120789] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 670.120858] page dumped because: kasan: bad access detected
> [ 670.120899]
> [ 670.122198] Memory state around the buggy address:
> [ 670.127004] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.133458] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.139912] >c58eae00: fb fb fc fc 00 fc fc fc fb fb fc fc fb fb fc fc
> [ 670.146302] ^
> [ 670.150152] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 670.156608] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.162998]
> ==================================================================
> [ 670.176210] kasan test: kmalloc_oob_memset_8 out-of-bounds in memset8
> [ 670.176342]
> ==================================================================
> [ 670.183528] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_memset_8+0x7c/0x94 [test_kasan]
> [ 670.191450] Write of size 8 at addr c58eae41 by task exe/340
> [ 670.196972]
> [ 670.198555] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 670.198605] Call Trace:
> [ 670.198779] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 670.198982] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 670.199153] [c5649cc0] [c0175700] memset+0x2c/0x4c
> [ 670.199443] [c5649ce0] [c95d4b38] kmalloc_oob_memset_8+0x7c/0x94
> [test_kasan]
> [ 670.199722] [c5649d00] [c95d5544] kmalloc_tests_init+0x4c/0x2d0
> [test_kasan]
> [ 670.199912] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 670.200125] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 670.200327] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 670.200530] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 670.200723] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 670.200887] --- interrupt: c01 at 0xfd6b914
> [ 670.200887] LR = 0x1001364c
> [ 670.200931]
> [ 670.202255] Allocated by task 340:
> [ 670.205686] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 670.205934] kmalloc_oob_memset_8+0x44/0x94 [test_kasan]
> [ 670.206168] kmalloc_tests_init+0x4c/0x2d0 [test_kasan]
> [ 670.206312] do_one_initcall+0x40/0x278
> [ 670.206480] do_init_module+0xcc/0x59c
> [ 670.206637] load_module+0x2bc4/0x320c
> [ 670.206794] sys_init_module+0x114/0x138
> [ 670.206937] ret_from_syscall+0x0/0x38
> [ 670.206983]
> [ 670.208274] Freed by task 276:
> [ 670.211360] __kasan_slab_free+0x120/0x22c
> [ 670.211479] kfree+0x74/0x270
> [ 670.211611] single_release+0x54/0x6c
> [ 670.211782] close_pdeo+0x128/0x224
> [ 670.211947] proc_reg_release+0x110/0x128
> [ 670.212079] __fput+0xec/0x2d4
> [ 670.212202] task_work_run+0x13c/0x15c
> [ 670.212368] do_notify_resume+0x3d8/0x438
> [ 670.212515] do_user_signal+0x2c/0x34
> [ 670.212561]
> [ 670.213904] The buggy address belongs to the object at c58eae40
> [ 670.213904] which belongs to the cache kmalloc-16 of size 16
> [ 670.225452] The buggy address is located 1 bytes inside of
> [ 670.225452] 16-byte region [c58eae40, c58eae50)
> [ 670.235368] The buggy address belongs to the page:
> [ 670.240155] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 670.240265] flags: 0x200(slab)
> [ 670.240493] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 670.240560] page dumped because: kasan: bad access detected
> [ 670.240599]
> [ 670.241906] Memory state around the buggy address:
> [ 670.246712] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.253167] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.259621] >c58eae00: fb fb fc fc fb fb fc fc 00 fc fc fc fb fb fc fc
> [ 670.266014] ^
> [ 670.270894] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 670.277349] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.283740]
> ==================================================================
> [ 670.574861] kasan test: kmalloc_oob_memset_16 out-of-bounds in memset16
> [ 670.574999]
> ==================================================================
> [ 670.582162] BUG: KASAN: slab-out-of-bounds in
> kmalloc_oob_memset_16+0x7c/0x94 [test_kasan]
> [ 670.590260] Write of size 16 at addr c58eae81 by task exe/340
> [ 670.595865]
> [ 670.597448] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 670.597499] Call Trace:
> [ 670.597674] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 670.597880] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 670.598053] [c5649cc0] [c0175700] memset+0x2c/0x4c
> [ 670.598344] [c5649ce0] [c95d4bcc] kmalloc_oob_memset_16+0x7c/0x94
> [test_kasan]
> [ 670.598626] [c5649d00] [c95d5548] kmalloc_tests_init+0x50/0x2d0
> [test_kasan]
> [ 670.598816] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 670.599031] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 670.599234] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 670.599439] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 670.599634] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 670.599801] --- interrupt: c01 at 0xfd6b914
> [ 670.599801] LR = 0x1001364c
> [ 670.599847]
> [ 670.601148] Allocated by task 340:
> [ 670.604580] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 670.604834] kmalloc_oob_memset_16+0x44/0x94 [test_kasan]
> [ 670.605070] kmalloc_tests_init+0x50/0x2d0 [test_kasan]
> [ 670.605215] do_one_initcall+0x40/0x278
> [ 670.605385] do_init_module+0xcc/0x59c
> [ 670.605543] load_module+0x2bc4/0x320c
> [ 670.605704] sys_init_module+0x114/0x138
> [ 670.605851] ret_from_syscall+0x0/0x38
> [ 670.605897]
> [ 670.607166] Freed by task 276:
> [ 670.610253] __kasan_slab_free+0x120/0x22c
> [ 670.610374] kfree+0x74/0x270
> [ 670.610506] single_release+0x54/0x6c
> [ 670.610681] close_pdeo+0x128/0x224
> [ 670.610849] proc_reg_release+0x110/0x128
> [ 670.610983] __fput+0xec/0x2d4
> [ 670.611107] task_work_run+0x13c/0x15c
> [ 670.611275] do_notify_resume+0x3d8/0x438
> [ 670.611424] do_user_signal+0x2c/0x34
> [ 670.611471]
> [ 670.612798] The buggy address belongs to the object at c58eae80
> [ 670.612798] which belongs to the cache kmalloc-16 of size 16
> [ 670.624345] The buggy address is located 1 bytes inside of
> [ 670.624345] 16-byte region [c58eae80, c58eae90)
> [ 670.634260] The buggy address belongs to the page:
> [ 670.639048] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 670.639158] flags: 0x200(slab)
> [ 670.639387] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 670.639457] page dumped because: kasan: bad access detected
> [ 670.639497]
> [ 670.640799] Memory state around the buggy address:
> [ 670.645604] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.652058] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.658513] >c58eae80: 00 00 fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 670.664901] ^
> [ 670.667978] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.674434] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.680825]
> ==================================================================
> [ 670.693766] kasan test: kmalloc_uaf use-after-free
> [ 670.693923]
> ==================================================================
> [ 670.701091] BUG: KASAN: use-after-free in kmalloc_uaf+0x78/0x94
> [test_kasan]
> [ 670.707899] Write of size 1 at addr c58eaea8 by task exe/340
> [ 670.713422]
> [ 670.715004] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 670.715055] Call Trace:
> [ 670.715229] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 670.715433] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 670.715719] [c5649ce0] [c95d450c] kmalloc_uaf+0x78/0x94 [test_kasan]
> [ 670.715997] [c5649d00] [c95d554c] kmalloc_tests_init+0x54/0x2d0
> [test_kasan]
> [ 670.716187] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 670.716400] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 670.716601] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 670.716804] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 670.716998] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 670.717164] --- interrupt: c01 at 0xfd6b914
> [ 670.717164] LR = 0x1001364c
> [ 670.717209]
> [ 670.718531] Allocated by task 340:
> [ 670.721965] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 670.722210] kmalloc_uaf+0x44/0x94 [test_kasan]
> [ 670.722446] kmalloc_tests_init+0x54/0x2d0 [test_kasan]
> [ 670.722588] do_one_initcall+0x40/0x278
> [ 670.722756] do_init_module+0xcc/0x59c
> [ 670.722912] load_module+0x2bc4/0x320c
> [ 670.723069] sys_init_module+0x114/0x138
> [ 670.723213] ret_from_syscall+0x0/0x38
> [ 670.723260]
> [ 670.724550] Freed by task 340:
> [ 670.727635] __kasan_slab_free+0x120/0x22c
> [ 670.727754] kfree+0x74/0x270
> [ 670.727998] kmalloc_uaf+0x70/0x94 [test_kasan]
> [ 670.728233] kmalloc_tests_init+0x54/0x2d0 [test_kasan]
> [ 670.728375] do_one_initcall+0x40/0x278
> [ 670.728543] do_init_module+0xcc/0x59c
> [ 670.728698] load_module+0x2bc4/0x320c
> [ 670.728855] sys_init_module+0x114/0x138
> [ 670.728998] ret_from_syscall+0x0/0x38
> [ 670.729044]
> [ 670.730356] The buggy address belongs to the object at c58eaea0
> [ 670.730356] which belongs to the cache kmalloc-16 of size 16
> [ 670.741901] The buggy address is located 8 bytes inside of
> [ 670.741901] 16-byte region [c58eaea0, c58eaeb0)
> [ 670.751818] The buggy address belongs to the page:
> [ 670.756605] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 670.756716] flags: 0x200(slab)
> [ 670.756944] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 670.757012] page dumped because: kasan: bad access detected
> [ 670.757052]
> [ 670.758354] Memory state around the buggy address:
> [ 670.763163] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.769616] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.776070] >c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
> [ 670.782461] ^
> [ 670.786311] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.792765] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 670.799157]
> ==================================================================
> [ 671.084949] kasan test: kmalloc_uaf_memset use-after-free in memset
> [ 671.085122]
> ==================================================================
> [ 671.092328] BUG: KASAN: use-after-free in
> kmalloc_tests_init+0x58/0x2d0 [test_kasan]
> [ 671.099824] Write of size 33 at addr c534b0c0 by task exe/340
> [ 671.105430]
> [ 671.107012] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 671.107063] Call Trace:
> [ 671.107238] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 671.107443] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 671.107616] [c5649ce0] [c0175700] memset+0x2c/0x4c
> [ 671.107907] [c5649d00] [c95d5550] kmalloc_tests_init+0x58/0x2d0
> [test_kasan]
> [ 671.108098] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 671.108314] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 671.108518] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 671.108724] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 671.108918] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 671.109085] --- interrupt: c01 at 0xfd6b914
> [ 671.109085] LR = 0x1001364c
> [ 671.109132]
> [ 671.110452] Allocated by task 340:
> [ 671.113886] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 671.114137] kmalloc_uaf_memset+0x44/0x90 [test_kasan]
> [ 671.114374] kmalloc_tests_init+0x58/0x2d0 [test_kasan]
> [ 671.114520] do_one_initcall+0x40/0x278
> [ 671.114689] do_init_module+0xcc/0x59c
> [ 671.114846] load_module+0x2bc4/0x320c
> [ 671.115005] sys_init_module+0x114/0x138
> [ 671.115151] ret_from_syscall+0x0/0x38
> [ 671.115198]
> [ 671.116472] Freed by task 340:
> [ 671.119559] __kasan_slab_free+0x120/0x22c
> [ 671.119681] kfree+0x74/0x270
> [ 671.119927] kmalloc_uaf_memset+0x70/0x90 [test_kasan]
> [ 671.120167] kmalloc_tests_init+0x58/0x2d0 [test_kasan]
> [ 671.120312] do_one_initcall+0x40/0x278
> [ 671.120481] do_init_module+0xcc/0x59c
> [ 671.120640] load_module+0x2bc4/0x320c
> [ 671.120801] sys_init_module+0x114/0x138
> [ 671.120945] ret_from_syscall+0x0/0x38
> [ 671.120992]
> [ 671.122276] The buggy address belongs to the object at c534b0c0
> [ 671.122276] which belongs to the cache kmalloc-64 of size 64
> [ 671.133824] The buggy address is located 0 bytes inside of
> [ 671.133824] 64-byte region [c534b0c0, c534b100)
> [ 671.143741] The buggy address belongs to the page:
> [ 671.148527] page:c7fd9a40 count:1 mapcount:0 mapping:c5007c20 index:0x0
> [ 671.148637] flags: 0x200(slab)
> [ 671.148866] raw: 00000200 00000100 00000200 c5007c20 00000000
> 00aa0155 ffffffff 00000001
> [ 671.148935] page dumped because: kasan: bad access detected
> [ 671.148975]
> [ 671.150277] Memory state around the buggy address:
> [ 671.155084] c534af80: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
> [ 671.161538] c534b000: 00 00 00 00 00 00 fc fc fc fc fc fc fb fb fb fb
> [ 671.167993] >c534b080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
> [ 671.174383] ^
> [ 671.179007] c534b100: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
> [ 671.185461] c534b180: 00 00 00 00 04 fc fc fc fc fc fc fc fb fb fb fb
> [ 671.191853]
> ==================================================================
> [ 671.204460] kasan test: kmalloc_uaf2 use-after-free after another kmalloc
> [ 671.204676]
> ==================================================================
> [ 671.211859] BUG: KASAN: use-after-free in kmalloc_uaf2+0x9c/0xd4
> [test_kasan]
> [ 671.218755] Write of size 1 at addr c534b088 by task exe/340
> [ 671.224277]
> [ 671.225860] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 671.225910] Call Trace:
> [ 671.226085] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 671.226288] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 671.226574] [c5649ce0] [c95d45c4] kmalloc_uaf2+0x9c/0xd4 [test_kasan]
> [ 671.226854] [c5649d00] [c95d5554] kmalloc_tests_init+0x5c/0x2d0
> [test_kasan]
> [ 671.227044] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 671.227257] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 671.227458] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 671.227659] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 671.227853] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 671.228018] --- interrupt: c01 at 0xfd6b914
> [ 671.228018] LR = 0x1001364c
> [ 671.228063]
> [ 671.229387] Allocated by task 340:
> [ 671.232819] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 671.233065] kmalloc_uaf2+0x48/0xd4 [test_kasan]
> [ 671.233299] kmalloc_tests_init+0x5c/0x2d0 [test_kasan]
> [ 671.233442] do_one_initcall+0x40/0x278
> [ 671.233609] do_init_module+0xcc/0x59c
> [ 671.233765] load_module+0x2bc4/0x320c
> [ 671.233922] sys_init_module+0x114/0x138
> [ 671.234066] ret_from_syscall+0x0/0x38
> [ 671.234111]
> [ 671.235407] Freed by task 340:
> [ 671.238491] __kasan_slab_free+0x120/0x22c
> [ 671.238609] kfree+0x74/0x270
> [ 671.238851] kmalloc_uaf2+0x78/0xd4 [test_kasan]
> [ 671.239085] kmalloc_tests_init+0x5c/0x2d0 [test_kasan]
> [ 671.239228] do_one_initcall+0x40/0x278
> [ 671.239395] do_init_module+0xcc/0x59c
> [ 671.239550] load_module+0x2bc4/0x320c
> [ 671.239707] sys_init_module+0x114/0x138
> [ 671.239850] ret_from_syscall+0x0/0x38
> [ 671.239897]
> [ 671.241211] The buggy address belongs to the object at c534b060
> [ 671.241211] which belongs to the cache kmalloc-64 of size 64
> [ 671.252758] The buggy address is located 40 bytes inside of
> [ 671.252758] 64-byte region [c534b060, c534b0a0)
> [ 671.262761] The buggy address belongs to the page:
> [ 671.267547] page:c7fd9a40 count:1 mapcount:0 mapping:c5007c20 index:0x0
> [ 671.267657] flags: 0x200(slab)
> [ 671.267885] raw: 00000200 00000100 00000200 c5007c20 00000000
> 00aa0155 ffffffff 00000001
> [ 671.267953] page dumped because: kasan: bad access detected
> [ 671.267993]
> [ 671.269296] Memory state around the buggy address:
> [ 671.274104] c534af80: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
> [ 671.280561] c534b000: 00 00 00 00 00 00 fc fc fc fc fc fc fb fb fb fb
> [ 671.287012] >c534b080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
> [ 671.293399] ^
> [ 671.296220] c534b100: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
> [ 671.302676] c534b180: 00 00 00 00 04 fc fc fc fc fc fc fc fb fb fb fb
> [ 671.309066]
> ==================================================================
> [ 671.597554] kasan test: kmem_cache_oob out-of-bounds in kmem_cache_alloc
> [ 671.597819]
> ==================================================================
> [ 671.604991] BUG: KASAN: slab-out-of-bounds in
> kmem_cache_oob+0x9c/0xd0 [test_kasan]
> [ 671.612398] Read of size 1 at addr c5e180c8 by task exe/340
> [ 671.617834]
> [ 671.619417] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 671.619469] Call Trace:
> [ 671.619645] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 671.619848] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 671.620138] [c5649ce0] [c95d4d10] kmem_cache_oob+0x9c/0xd0 [test_kasan]
> [ 671.620420] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
> [test_kasan]
> [ 671.620611] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 671.620826] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 671.621030] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 671.621234] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 671.621428] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 671.621596] --- interrupt: c01 at 0xfd6b914
> [ 671.621596] LR = 0x1001364c
> [ 671.621642]
> [ 671.622944] Allocated by task 340:
> [ 671.626376] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 671.626504] kmem_cache_alloc+0xf4/0x210
> [ 671.626752] kmem_cache_oob+0x78/0xd0 [test_kasan]
> [ 671.626989] kmalloc_tests_init+0x60/0x2d0 [test_kasan]
> [ 671.627135] do_one_initcall+0x40/0x278
> [ 671.627305] do_init_module+0xcc/0x59c
> [ 671.627463] load_module+0x2bc4/0x320c
> [ 671.627623] sys_init_module+0x114/0x138
> [ 671.627769] ret_from_syscall+0x0/0x38
> [ 671.627816]
> [ 671.629132] Freed by task 0:
> [ 671.631954] (stack is not available)
> [ 671.635476]
> [ 671.637007] The buggy address belongs to the object at c5e18000
> [ 671.637007] which belongs to the cache test_cache of size 200
> [ 671.648642] The buggy address is located 0 bytes to the right of
> [ 671.648642] 200-byte region [c5e18000, c5e180c8)
> [ 671.659156] The buggy address belongs to the page:
> [ 671.663942] page:c7fdf0c0 count:1 mapcount:0 mapping:c540a560 index:0x0
> [ 671.664054] flags: 0x200(slab)
> [ 671.664283] raw: 00000200 00000100 00000200 c540a560 00000000
> 003e007d ffffffff 00000001
> [ 671.664353] page dumped because: kasan: bad access detected
> [ 671.664393]
> [ 671.665694] Memory state around the buggy address:
> [ 671.670501] c5e17f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 671.676954] c5e18000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 671.683409] >c5e18080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
> [ 671.689802] ^
> [ 671.694680] c5e18100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 671.701137] c5e18180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 671.707528]
> ==================================================================
> [ 671.758410]
> =============================================================================
> [ 671.766368] BUG test_cache (Tainted: G B ): Objects
> remaining in test_cache on __kmem_cache_shutdown()
> [ 671.776719]
> -----------------------------------------------------------------------------
> [ 671.776719]
> [ 671.786325] INFO: Slab 0x(ptrval) objects=62 used=1 fp=0x(ptrval)
> flags=0x0200
> [ 671.793514] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 671.793563] Call Trace:
> [ 671.793752] [c5649bf0] [c016ebe0] slab_err+0x98/0xac (unreliable)
> [ 671.793956] [c5649c90] [c01748f4] __kmem_cache_shutdown+0x15c/0x338
> [ 671.794160] [c5649cf0] [c013c3b4] kmem_cache_destroy+0x68/0x114
> [ 671.794463] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
> [test_kasan]
> [ 671.794656] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 671.794868] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 671.795071] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 671.795275] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 671.795468] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 671.795633] --- interrupt: c01 at 0xfd6b914
> [ 671.795633] LR = 0x1001364c
> [ 671.795738] INFO: Object 0x(ptrval) @offset=0
> [ 671.909762] kmem_cache_destroy test_cache: Slab cache still has objects
> [ 671.931546] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 671.931601] Call Trace:
> [ 671.931790] [c5649cf0] [c013c45c] kmem_cache_destroy+0x110/0x114
> (unreliable)
> [ 671.932116] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
> [test_kasan]
> [ 671.932310] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 671.932526] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 671.932730] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 671.932934] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 671.933130] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 671.933300] --- interrupt: c01 at 0xfd6b914
> [ 671.933300] LR = 0x1001364c
> [ 671.952750] kasan test: memcg_accounted_kmem_cache allocate memcg
> accounted object
> [ 672.556766] kasan test: kasan_stack_oob out-of-bounds on stack
> [ 672.556850] kasan test: kasan_global_oob out-of-bounds global variable
> [ 672.556922] kasan test: kasan_alloca_oob_left out-of-bounds to left
> on alloca
> [ 672.556995] kasan test: kasan_alloca_oob_right out-of-bounds to right
> on alloca
> [ 672.557070] kasan test: ksize_unpoisons_memory ksize() unpoisons the
> whole allocated chunk
> [ 672.557200]
> ==================================================================
> [ 672.564395] BUG: KASAN: slab-out-of-bounds in
> ksize_unpoisons_memory+0x8c/0xac [test_kasan]
> [ 672.572578] Write of size 1 at addr c539ab40 by task exe/340
> [ 672.578098]
> [ 672.579682] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 672.579734] Call Trace:
> [ 672.579909] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 672.580114] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 672.580406] [c5649ce0] [c95d5100] ksize_unpoisons_memory+0x8c/0xac
> [test_kasan]
> [ 672.580689] [c5649d00] [c95d5570] kmalloc_tests_init+0x78/0x2d0
> [test_kasan]
> [ 672.580880] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 672.581096] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 672.581299] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 672.581503] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 672.581697] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 672.581864] --- interrupt: c01 at 0xfd6b914
> [ 672.581864] LR = 0x1001364c
> [ 672.581910]
> [ 672.583208] Allocated by task 340:
> [ 672.586642] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 672.586892] ksize_unpoisons_memory+0x44/0xac [test_kasan]
> [ 672.587129] kmalloc_tests_init+0x78/0x2d0 [test_kasan]
> [ 672.587275] do_one_initcall+0x40/0x278
> [ 672.587445] do_init_module+0xcc/0x59c
> [ 672.587602] load_module+0x2bc4/0x320c
> [ 672.587761] sys_init_module+0x114/0x138
> [ 672.587906] ret_from_syscall+0x0/0x38
> [ 672.587953]
> [ 672.589227] Freed by task 338:
> [ 672.592316] __kasan_slab_free+0x120/0x22c
> [ 672.592437] kfree+0x74/0x270
> [ 672.592602] load_elf_binary+0xb0/0x162c
> [ 672.592782] search_binary_handler+0x120/0x374
> [ 672.592950] __do_execve_file+0x834/0xb20
> [ 672.593114] sys_execve+0x40/0x54
> [ 672.593259] ret_from_syscall+0x0/0x38
> [ 672.593307]
> [ 672.594603] The buggy address belongs to the object at c539aac0
> [ 672.594603] which belongs to the cache kmalloc-128 of size 128
> [ 672.606324] The buggy address is located 0 bytes to the right of
> [ 672.606324] 128-byte region [c539aac0, c539ab40)
> [ 672.616840] The buggy address belongs to the page:
> [ 672.621625] page:c7fd9cc0 count:1 mapcount:0 mapping:c5007a80 index:0x0
> [ 672.621738] flags: 0x200(slab)
> [ 672.621967] raw: 00000200 00000100 00000200 c5007a80 00000000
> 005500ab ffffffff 00000001
> [ 672.622038] page dumped because: kasan: bad access detected
> [ 672.622077]
> [ 672.623375] Memory state around the buggy address:
> [ 672.628183] c539aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 672.634637] c539aa80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
> [ 672.641090] >c539ab00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
> [ 672.647483] ^
> [ 672.652106] c539ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 672.658562] c539ac00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
> [ 672.664951]
> ==================================================================
> [ 672.814421] kasan test: copy_user_test out-of-bounds in copy_from_user()
> [ 672.814499]
> ==================================================================
> [ 672.821643] BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x48/0xc4
> [ 672.828089] Write of size 11 at addr c58eb020 by task exe/340
> [ 672.833699]
> [ 672.835280] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 672.835331] Call Trace:
> [ 672.835504] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 672.835708] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 672.835929] [c5649cc0] [c0307be0] _copy_from_user+0x48/0xc4
> [ 672.836230] [c5649ce0] [c95d51b4] copy_user_test+0x94/0x1bc [test_kasan]
> [ 672.836512] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 672.836703] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 672.836917] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 672.837121] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 672.837326] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 672.837522] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 672.837687] --- interrupt: c01 at 0xfd6b914
> [ 672.837687] LR = 0x1001364c
> [ 672.837733]
> [ 672.839067] Allocated by task 340:
> [ 672.842500] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 672.842749] copy_user_test+0x28/0x1bc [test_kasan]
> [ 672.842985] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 672.843131] do_one_initcall+0x40/0x278
> [ 672.843301] do_init_module+0xcc/0x59c
> [ 672.843458] load_module+0x2bc4/0x320c
> [ 672.843619] sys_init_module+0x114/0x138
> [ 672.843764] ret_from_syscall+0x0/0x38
> [ 672.843812]
> [ 672.845085] Freed by task 276:
> [ 672.848173] __kasan_slab_free+0x120/0x22c
> [ 672.848295] kfree+0x74/0x270
> [ 672.848427] single_release+0x54/0x6c
> [ 672.848601] close_pdeo+0x128/0x224
> [ 672.848768] proc_reg_release+0x110/0x128
> [ 672.848903] __fput+0xec/0x2d4
> [ 672.849028] task_work_run+0x13c/0x15c
> [ 672.849197] do_notify_resume+0x3d8/0x438
> [ 672.849346] do_user_signal+0x2c/0x34
> [ 672.849393]
> [ 672.850719] The buggy address belongs to the object at c58eb020
> [ 672.850719] which belongs to the cache kmalloc-16 of size 16
> [ 672.862264] The buggy address is located 0 bytes inside of
> [ 672.862264] 16-byte region [c58eb020, c58eb030)
> [ 672.872182] The buggy address belongs to the page:
> [ 672.876968] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 672.877079] flags: 0x200(slab)
> [ 672.877309] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 672.877377] page dumped because: kasan: bad access detected
> [ 672.877418]
> [ 672.878717] Memory state around the buggy address:
> [ 672.883527] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 672.889979] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 672.896433] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 672.902824] ^
> [ 672.906673] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 672.913129] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 672.919520]
> ==================================================================
> [ 672.932289] kasan test: copy_user_test out-of-bounds in copy_to_user()
> [ 672.932363]
> ==================================================================
> [ 672.939457] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x9c/0xbc
> [ 672.945733] Read of size 11 at addr c58eb020 by task exe/340
> [ 672.951255]
> [ 672.952840] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 672.952890] Call Trace:
> [ 672.953061] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 672.953264] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 672.953480] [c5649cc0] [c0307cf8] _copy_to_user+0x9c/0xbc
> [ 672.953781] [c5649ce0] [c95d51d4] copy_user_test+0xb4/0x1bc [test_kasan]
> [ 672.954060] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 672.954249] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 672.954461] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 672.954662] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 672.954866] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 672.955058] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 672.955224] --- interrupt: c01 at 0xfd6b914
> [ 672.955224] LR = 0x1001364c
> [ 672.955269]
> [ 672.956538] Allocated by task 340:
> [ 672.959969] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 672.960219] copy_user_test+0x28/0x1bc [test_kasan]
> [ 672.960454] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 672.960597] do_one_initcall+0x40/0x278
> [ 672.960766] do_init_module+0xcc/0x59c
> [ 672.960924] load_module+0x2bc4/0x320c
> [ 672.961081] sys_init_module+0x114/0x138
> [ 672.961226] ret_from_syscall+0x0/0x38
> [ 672.961272]
> [ 672.962558] Freed by task 276:
> [ 672.965645] __kasan_slab_free+0x120/0x22c
> [ 672.965764] kfree+0x74/0x270
> [ 672.965896] single_release+0x54/0x6c
> [ 672.966070] close_pdeo+0x128/0x224
> [ 672.966236] proc_reg_release+0x110/0x128
> [ 672.966369] __fput+0xec/0x2d4
> [ 672.966493] task_work_run+0x13c/0x15c
> [ 672.966660] do_notify_resume+0x3d8/0x438
> [ 672.966809] do_user_signal+0x2c/0x34
> [ 672.966855]
> [ 672.968190] The buggy address belongs to the object at c58eb020
> [ 672.968190] which belongs to the cache kmalloc-16 of size 16
> [ 672.979735] The buggy address is located 0 bytes inside of
> [ 672.979735] 16-byte region [c58eb020, c58eb030)
> [ 672.989653] The buggy address belongs to the page:
> [ 672.994439] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 672.994550] flags: 0x200(slab)
> [ 672.994778] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 672.994845] page dumped because: kasan: bad access detected
> [ 672.994885]
> [ 672.996188] Memory state around the buggy address:
> [ 673.000996] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 673.007450] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.013904] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 673.020295] ^
> [ 673.024144] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.030600] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.036990]
> ==================================================================
> [ 673.327457] kasan test: copy_user_test out-of-bounds in
> __copy_from_user()
> [ 673.327537]
> ==================================================================
> [ 673.334723] BUG: KASAN: slab-out-of-bounds in
> copy_user_test+0xd0/0x1bc [test_kasan]
> [ 673.342217] Write of size 11 at addr c58eb020 by task exe/340
> [ 673.347825]
> [ 673.349408] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 673.349459] Call Trace:
> [ 673.349637] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 673.349842] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 673.350130] [c5649ce0] [c95d51f0] copy_user_test+0xd0/0x1bc [test_kasan]
> [ 673.350412] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 673.350605] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 673.350821] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 673.351025] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 673.351231] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 673.351426] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 673.351592] --- interrupt: c01 at 0xfd6b914
> [ 673.351592] LR = 0x1001364c
> [ 673.351638]
> [ 673.352936] Allocated by task 340:
> [ 673.356367] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 673.356619] copy_user_test+0x28/0x1bc [test_kasan]
> [ 673.356855] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 673.357000] do_one_initcall+0x40/0x278
> [ 673.357168] do_init_module+0xcc/0x59c
> [ 673.357324] load_module+0x2bc4/0x320c
> [ 673.357483] sys_init_module+0x114/0x138
> [ 673.357626] ret_from_syscall+0x0/0x38
> [ 673.357673]
> [ 673.358954] Freed by task 276:
> [ 673.362040] __kasan_slab_free+0x120/0x22c
> [ 673.362161] kfree+0x74/0x270
> [ 673.362293] single_release+0x54/0x6c
> [ 673.362465] close_pdeo+0x128/0x224
> [ 673.362632] proc_reg_release+0x110/0x128
> [ 673.362764] __fput+0xec/0x2d4
> [ 673.362888] task_work_run+0x13c/0x15c
> [ 673.363057] do_notify_resume+0x3d8/0x438
> [ 673.363208] do_user_signal+0x2c/0x34
> [ 673.363256]
> [ 673.364587] The buggy address belongs to the object at c58eb020
> [ 673.364587] which belongs to the cache kmalloc-16 of size 16
> [ 673.376132] The buggy address is located 0 bytes inside of
> [ 673.376132] 16-byte region [c58eb020, c58eb030)
> [ 673.386050] The buggy address belongs to the page:
> [ 673.390836] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 673.390947] flags: 0x200(slab)
> [ 673.391175] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 673.391245] page dumped because: kasan: bad access detected
> [ 673.391285]
> [ 673.392585] Memory state around the buggy address:
> [ 673.397393] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 673.403847] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.410301] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 673.416691] ^
> [ 673.420541] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.426997] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.433387]
> ==================================================================
> [ 673.446960] kasan test: copy_user_test out-of-bounds in __copy_to_user()
> [ 673.447031]
> ==================================================================
> [ 673.454258] BUG: KASAN: slab-out-of-bounds in
> copy_user_test+0xfc/0x1bc [test_kasan]
> [ 673.461753] Read of size 11 at addr c58eb020 by task exe/340
> [ 673.467275]
> [ 673.468858] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 673.468909] Call Trace:
> [ 673.469084] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 673.469286] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 673.469573] [c5649ce0] [c95d521c] copy_user_test+0xfc/0x1bc [test_kasan]
> [ 673.469851] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 673.470042] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 673.470256] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 673.470457] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 673.470660] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 673.470853] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 673.471019] --- interrupt: c01 at 0xfd6b914
> [ 673.471019] LR = 0x1001364c
> [ 673.471064]
> [ 673.472385] Allocated by task 340:
> [ 673.475818] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 673.476065] copy_user_test+0x28/0x1bc [test_kasan]
> [ 673.476301] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 673.476444] do_one_initcall+0x40/0x278
> [ 673.476612] do_init_module+0xcc/0x59c
> [ 673.476768] load_module+0x2bc4/0x320c
> [ 673.476925] sys_init_module+0x114/0x138
> [ 673.477067] ret_from_syscall+0x0/0x38
> [ 673.477113]
> [ 673.478403] Freed by task 276:
> [ 673.481490] __kasan_slab_free+0x120/0x22c
> [ 673.481610] kfree+0x74/0x270
> [ 673.481740] single_release+0x54/0x6c
> [ 673.481911] close_pdeo+0x128/0x224
> [ 673.482077] proc_reg_release+0x110/0x128
> [ 673.482209] __fput+0xec/0x2d4
> [ 673.482331] task_work_run+0x13c/0x15c
> [ 673.482500] do_notify_resume+0x3d8/0x438
> [ 673.482648] do_user_signal+0x2c/0x34
> [ 673.482694]
> [ 673.484036] The buggy address belongs to the object at c58eb020
> [ 673.484036] which belongs to the cache kmalloc-16 of size 16
> [ 673.495583] The buggy address is located 0 bytes inside of
> [ 673.495583] 16-byte region [c58eb020, c58eb030)
> [ 673.505500] The buggy address belongs to the page:
> [ 673.510287] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 673.510396] flags: 0x200(slab)
> [ 673.510622] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 673.510690] page dumped because: kasan: bad access detected
> [ 673.510729]
> [ 673.512037] Memory state around the buggy address:
> [ 673.516842] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 673.523297] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.529751] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 673.536142] ^
> [ 673.539991] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.546447] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.552838]
> ==================================================================
> [ 673.835827] kasan test: copy_user_test out-of-bounds in
> __copy_from_user_inatomic()
> [ 673.835905]
> ==================================================================
> [ 673.843082] BUG: KASAN: slab-out-of-bounds in
> copy_user_test+0x128/0x1bc [test_kasan]
> [ 673.850662] Write of size 11 at addr c58eb020 by task exe/340
> [ 673.856272]
> [ 673.857853] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 673.857905] Call Trace:
> [ 673.858080] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 673.858285] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 673.858574] [c5649ce0] [c95d5248] copy_user_test+0x128/0x1bc [test_kasan]
> [ 673.858855] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 673.859046] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 673.859261] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 673.859463] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 673.859668] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 673.859863] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 673.860029] --- interrupt: c01 at 0xfd6b914
> [ 673.860029] LR = 0x1001364c
> [ 673.860075]
> [ 673.861380] Allocated by task 340:
> [ 673.864812] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 673.865062] copy_user_test+0x28/0x1bc [test_kasan]
> [ 673.865299] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 673.865444] do_one_initcall+0x40/0x278
> [ 673.865615] do_init_module+0xcc/0x59c
> [ 673.865773] load_module+0x2bc4/0x320c
> [ 673.865932] sys_init_module+0x114/0x138
> [ 673.866077] ret_from_syscall+0x0/0x38
> [ 673.866123]
> [ 673.867399] Freed by task 276:
> [ 673.870488] __kasan_slab_free+0x120/0x22c
> [ 673.870609] kfree+0x74/0x270
> [ 673.870741] single_release+0x54/0x6c
> [ 673.870913] close_pdeo+0x128/0x224
> [ 673.871080] proc_reg_release+0x110/0x128
> [ 673.871213] __fput+0xec/0x2d4
> [ 673.871337] task_work_run+0x13c/0x15c
> [ 673.871506] do_notify_resume+0x3d8/0x438
> [ 673.871655] do_user_signal+0x2c/0x34
> [ 673.871702]
> [ 673.873032] The buggy address belongs to the object at c58eb020
> [ 673.873032] which belongs to the cache kmalloc-16 of size 16
> [ 673.884578] The buggy address is located 0 bytes inside of
> [ 673.884578] 16-byte region [c58eb020, c58eb030)
> [ 673.894494] The buggy address belongs to the page:
> [ 673.899282] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 673.899395] flags: 0x200(slab)
> [ 673.899625] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 673.899694] page dumped because: kasan: bad access detected
> [ 673.899734]
> [ 673.901033] Memory state around the buggy address:
> [ 673.905838] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 673.912293] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.918748] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 673.925136] ^
> [ 673.928987] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.935442] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 673.941833]
> ==================================================================
> [ 673.954463] kasan test: copy_user_test out-of-bounds in
> __copy_to_user_inatomic()
> [ 673.954535]
> ==================================================================
> [ 673.961759] BUG: KASAN: slab-out-of-bounds in
> copy_user_test+0x154/0x1bc [test_kasan]
> [ 673.969339] Read of size 11 at addr c58eb020 by task exe/340
> [ 673.974860]
> [ 673.976444] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 673.976494] Call Trace:
> [ 673.976668] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 673.976870] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 673.977160] [c5649ce0] [c95d5274] copy_user_test+0x154/0x1bc [test_kasan]
> [ 673.977439] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 673.977630] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 673.977843] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 673.978045] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 673.978249] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 673.978441] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 673.978607] --- interrupt: c01 at 0xfd6b914
> [ 673.978607] LR = 0x1001364c
> [ 673.978651]
> [ 673.979971] Allocated by task 340:
> [ 673.983401] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 673.983650] copy_user_test+0x28/0x1bc [test_kasan]
> [ 673.983885] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 673.984030] do_one_initcall+0x40/0x278
> [ 673.984198] do_init_module+0xcc/0x59c
> [ 673.984354] load_module+0x2bc4/0x320c
> [ 673.984512] sys_init_module+0x114/0x138
> [ 673.984655] ret_from_syscall+0x0/0x38
> [ 673.984701]
> [ 673.985990] Freed by task 276:
> [ 673.989077] __kasan_slab_free+0x120/0x22c
> [ 673.989197] kfree+0x74/0x270
> [ 673.989327] single_release+0x54/0x6c
> [ 673.989499] close_pdeo+0x128/0x224
> [ 673.989664] proc_reg_release+0x110/0x128
> [ 673.989796] __fput+0xec/0x2d4
> [ 673.989918] task_work_run+0x13c/0x15c
> [ 673.990086] do_notify_resume+0x3d8/0x438
> [ 673.990235] do_user_signal+0x2c/0x34
> [ 673.990281]
> [ 673.991622] The buggy address belongs to the object at c58eb020
> [ 673.991622] which belongs to the cache kmalloc-16 of size 16
> [ 674.003168] The buggy address is located 0 bytes inside of
> [ 674.003168] 16-byte region [c58eb020, c58eb030)
> [ 674.013086] The buggy address belongs to the page:
> [ 674.017872] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 674.017982] flags: 0x200(slab)
> [ 674.018210] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 674.018277] page dumped because: kasan: bad access detected
> [ 674.018316]
> [ 674.019622] Memory state around the buggy address:
> [ 674.024429] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 674.030883] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.037338] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 674.043727] ^
> [ 674.047578] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.054034] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.060424]
> ==================================================================
> [ 674.346609] kasan test: copy_user_test out-of-bounds in
> strncpy_from_user()
> [ 674.346689]
> ==================================================================
> [ 674.353778] BUG: KASAN: slab-out-of-bounds in
> strncpy_from_user+0x48/0x240
> [ 674.360487] Write of size 11 at addr c58eb020 by task exe/340
> [ 674.366094]
> [ 674.367678] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 674.367731] Call Trace:
> [ 674.367904] [c5649c40] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 674.368108] [c5649c70] [c0176d34] kasan_report+0xe4/0x168
> [ 674.368323] [c5649cb0] [c03202f8] strncpy_from_user+0x48/0x240
> [ 674.368627] [c5649ce0] [c95d52a4] copy_user_test+0x184/0x1bc [test_kasan]
> [ 674.368908] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
> [test_kasan]
> [ 674.369100] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 674.369315] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 674.369518] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 674.369724] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 674.369919] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 674.370086] --- interrupt: c01 at 0xfd6b914
> [ 674.370086] LR = 0x1001364c
> [ 674.370132]
> [ 674.371463] Allocated by task 340:
> [ 674.374894] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 674.375146] copy_user_test+0x28/0x1bc [test_kasan]
> [ 674.375383] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
> [ 674.375527] do_one_initcall+0x40/0x278
> [ 674.375697] do_init_module+0xcc/0x59c
> [ 674.375854] load_module+0x2bc4/0x320c
> [ 674.376015] sys_init_module+0x114/0x138
> [ 674.376162] ret_from_syscall+0x0/0x38
> [ 674.376209]
> [ 674.377481] Freed by task 276:
> [ 674.380568] __kasan_slab_free+0x120/0x22c
> [ 674.380691] kfree+0x74/0x270
> [ 674.380824] single_release+0x54/0x6c
> [ 674.380998] close_pdeo+0x128/0x224
> [ 674.381165] proc_reg_release+0x110/0x128
> [ 674.381299] __fput+0xec/0x2d4
> [ 674.381424] task_work_run+0x13c/0x15c
> [ 674.381592] do_notify_resume+0x3d8/0x438
> [ 674.381743] do_user_signal+0x2c/0x34
> [ 674.381792]
> [ 674.383113] The buggy address belongs to the object at c58eb020
> [ 674.383113] which belongs to the cache kmalloc-16 of size 16
> [ 674.394659] The buggy address is located 0 bytes inside of
> [ 674.394659] 16-byte region [c58eb020, c58eb030)
> [ 674.404577] The buggy address belongs to the page:
> [ 674.409363] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
> [ 674.409474] flags: 0x200(slab)
> [ 674.409703] raw: 00000200 00000100 00000200 c5007dc0 00000000
> 02000401 ffffffff 00000001
> [ 674.409772] page dumped because: kasan: bad access detected
> [ 674.409812]
> [ 674.411112] Memory state around the buggy address:
> [ 674.415920] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
> [ 674.422374] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.428827] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
> [ 674.435218] ^
> [ 674.439067] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.445524] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
> [ 674.451914]
> ==================================================================
> [ 674.466513] kasan test: use_after_scope_test use-after-scope on int
> [ 674.466592] kasan test: use_after_scope_test use-after-scope on array
> [ 674.470775] kasan test: kmem_cache_double_free double-free on heap object
> [ 674.471059]
> ==================================================================
> [ 674.478286] BUG: KASAN: double-free or invalid-free in
> kmem_cache_double_free+0xac/0xc4 [test_kasan]
> [ 674.487095]
> [ 674.488679] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 674.488730] Call Trace:
> [ 674.488906] [c5649b30] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 674.489118] [c5649b60] [c0176c24] kasan_report_invalid_free+0x48/0x74
> [ 674.489296] [c5649b90] [c0175620] __kasan_slab_free+0x198/0x22c
> [ 674.489467] [c5649cc0] [c0173838] kmem_cache_free+0x64/0x228
> [ 674.489754] [c5649ce0] [c95d4df0] kmem_cache_double_free+0xac/0xc4
> [test_kasan]
> [ 674.490029] [c5649d00] [c95d557c] kmalloc_tests_init+0x84/0x2d0
> [test_kasan]
> [ 674.490219] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 674.490432] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 674.490633] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 674.490837] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 674.491031] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 674.491194] --- interrupt: c01 at 0xfd6b914
> [ 674.491194] LR = 0x1001364c
> [ 674.491239]
> [ 674.492547] Allocated by task 340:
> [ 674.495981] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 674.496108] kmem_cache_alloc+0xf4/0x210
> [ 674.496355] kmem_cache_double_free+0x78/0xc4 [test_kasan]
> [ 674.496584] kmalloc_tests_init+0x84/0x2d0 [test_kasan]
> [ 674.496727] do_one_initcall+0x40/0x278
> [ 674.496893] do_init_module+0xcc/0x59c
> [ 674.497050] load_module+0x2bc4/0x320c
> [ 674.497208] sys_init_module+0x114/0x138
> [ 674.497354] ret_from_syscall+0x0/0x38
> [ 674.497400]
> [ 674.498652] Freed by task 340:
> [ 674.501739] __kasan_slab_free+0x120/0x22c
> [ 674.501866] kmem_cache_free+0x64/0x228
> [ 674.502112] kmem_cache_double_free+0xa0/0xc4 [test_kasan]
> [ 674.502340] kmalloc_tests_init+0x84/0x2d0 [test_kasan]
> [ 674.502483] do_one_initcall+0x40/0x278
> [ 674.502650] do_init_module+0xcc/0x59c
> [ 674.502807] load_module+0x2bc4/0x320c
> [ 674.502966] sys_init_module+0x114/0x138
> [ 674.503112] ret_from_syscall+0x0/0x38
> [ 674.503158]
> [ 674.504460] The buggy address belongs to the object at c5528000
> [ 674.504460] which belongs to the cache test_cache of size 200
> [ 674.516091] The buggy address is located 0 bytes inside of
> [ 674.516091] 200-byte region [c5528000, c55280c8)
> [ 674.526092] The buggy address belongs to the page:
> [ 674.530877] page:c7fda940 count:1 mapcount:0 mapping:c540a700 index:0x0
> [ 674.530988] flags: 0x200(slab)
> [ 674.531216] raw: 00000200 00000100 00000200 c540a700 00000000
> 003e007d ffffffff 00000001
> [ 674.531284] page dumped because: kasan: bad access detected
> [ 674.531323]
> [ 674.532630] Memory state around the buggy address:
> [ 674.537436] c5527f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 674.543890] c5527f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 674.550345] >c5528000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 674.556731] ^
> [ 674.559293] c5528080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
> [ 674.565750] c5528100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 674.572138]
> ==================================================================
> [ 674.880790] kasan test: kmem_cache_invalid_free invalid-free of heap
> object
> [ 674.881044]
> ==================================================================
> [ 674.888197] BUG: KASAN: double-free or invalid-free in
> kmem_cache_invalid_free+0xa0/0xc4 [test_kasan]
> [ 674.897089]
> [ 674.898670] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 674.898722] Call Trace:
> [ 674.898899] [c5649b30] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 674.899113] [c5649b60] [c0176c24] kasan_report_invalid_free+0x48/0x74
> [ 674.899293] [c5649b90] [c0175620] __kasan_slab_free+0x198/0x22c
> [ 674.899467] [c5649cc0] [c0173838] kmem_cache_free+0x64/0x228
> [ 674.899756] [c5649ce0] [c95d4ea8] kmem_cache_invalid_free+0xa0/0xc4
> [test_kasan]
> [ 674.900031] [c5649d00] [c95d5580] kmalloc_tests_init+0x88/0x2d0
> [test_kasan]
> [ 674.900222] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 674.900437] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 674.900639] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 674.900845] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 674.901040] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 674.901206] --- interrupt: c01 at 0xfd6b914
> [ 674.901206] LR = 0x1001364c
> [ 674.901251]
> [ 674.902542] Allocated by task 340:
> [ 674.905975] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 674.906103] kmem_cache_alloc+0xf4/0x210
> [ 674.906351] kmem_cache_invalid_free+0x78/0xc4 [test_kasan]
> [ 674.906584] kmalloc_tests_init+0x88/0x2d0 [test_kasan]
> [ 674.906730] do_one_initcall+0x40/0x278
> [ 674.906899] do_init_module+0xcc/0x59c
> [ 674.907056] load_module+0x2bc4/0x320c
> [ 674.907217] sys_init_module+0x114/0x138
> [ 674.907364] ret_from_syscall+0x0/0x38
> [ 674.907411]
> [ 674.908731] Freed by task 0:
> [ 674.911551] (stack is not available)
> [ 674.915074]
> [ 674.916605] The buggy address belongs to the object at c5528000
> [ 674.916605] which belongs to the cache test_cache of size 200
> [ 674.928237] The buggy address is located 1 bytes inside of
> [ 674.928237] 200-byte region [c5528000, c55280c8)
> [ 674.938237] The buggy address belongs to the page:
> [ 674.943024] page:c7fda940 count:1 mapcount:0 mapping:c540a7d0 index:0x0
> [ 674.943136] flags: 0x200(slab)
> [ 674.943365] raw: 00000200 00000100 00000200 c540a7d0 00000000
> 003e007d ffffffff 00000001
> [ 674.943434] page dumped because: kasan: bad access detected
> [ 674.943475]
> [ 674.944775] Memory state around the buggy address:
> [ 674.949581] c5527f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 674.956036] c5527f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 674.962491] >c5528000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 674.968876] ^
> [ 674.971438] c5528080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
> [ 674.977895] c5528100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 674.984285]
> ==================================================================
> [ 675.126818] kasan test: kasan_memchr out-of-bounds in memchr
> [ 675.126994] kasan test: kasan_memcmp out-of-bounds in memcmp
> [ 675.127158] kasan test: kasan_strings use-after-free in strchr
> [ 675.127309]
> ==================================================================
> [ 675.134382] BUG: KASAN: use-after-free in strchr+0x1c/0x80
> [ 675.139762] Read of size 1 at addr c53e8e20 by task exe/340
> [ 675.145200]
> [ 675.146784] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 675.146836] Call Trace:
> [ 675.147010] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 675.147215] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 675.147385] [c5649cc0] [c072ec4c] strchr+0x1c/0x80
> [ 675.147684] [c5649ce0] [c95d5440] kasan_strings+0x60/0x118 [test_kasan]
> [ 675.147966] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
> [test_kasan]
> [ 675.148157] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 675.148372] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 675.148577] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 675.148781] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 675.148976] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 675.149143] --- interrupt: c01 at 0xfd6b914
> [ 675.149143] LR = 0x1001364c
> [ 675.149189]
> [ 675.150483] Allocated by task 340:
> [ 675.153915] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 675.154163] kasan_strings+0x44/0x118 [test_kasan]
> [ 675.154400] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.154545] do_one_initcall+0x40/0x278
> [ 675.154714] do_init_module+0xcc/0x59c
> [ 675.154872] load_module+0x2bc4/0x320c
> [ 675.155033] sys_init_module+0x114/0x138
> [ 675.155179] ret_from_syscall+0x0/0x38
> [ 675.155225]
> [ 675.156501] Freed by task 340:
> [ 675.159587] __kasan_slab_free+0x120/0x22c
> [ 675.159709] kfree+0x74/0x270
> [ 675.159954] kasan_strings+0x54/0x118 [test_kasan]
> [ 675.160191] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.160337] do_one_initcall+0x40/0x278
> [ 675.160508] do_init_module+0xcc/0x59c
> [ 675.160667] load_module+0x2bc4/0x320c
> [ 675.160828] sys_init_module+0x114/0x138
> [ 675.160973] ret_from_syscall+0x0/0x38
> [ 675.161019]
> [ 675.162306] The buggy address belongs to the object at c53e8e10
> [ 675.162306] which belongs to the cache kmalloc-32 of size 32
> [ 675.173853] The buggy address is located 16 bytes inside of
> [ 675.173853] 32-byte region [c53e8e10, c53e8e30)
> [ 675.183856] The buggy address belongs to the page:
> [ 675.188642] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 675.188753] flags: 0x200(slab)
> [ 675.188982] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 675.189051] page dumped because: kasan: bad access detected
> [ 675.189091]
> [ 675.190392] Memory state around the buggy address:
> [ 675.195199] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
> [ 675.201653] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
> [ 675.208108] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
> [ 675.214497] ^
> [ 675.218089] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
> [ 675.224544] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
> [ 675.230935]
> ==================================================================
> [ 675.383353] kasan test: kasan_strings use-after-free in strrchr
> [ 675.383430]
> ==================================================================
> [ 675.390498] BUG: KASAN: use-after-free in strrchr+0x30/0x64
> [ 675.395964] Read of size 1 at addr c53e8e20 by task exe/340
> [ 675.401403]
> [ 675.402986] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 675.403038] Call Trace:
> [ 675.403212] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 675.403415] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 675.403587] [c5649cc0] [c072ed48] strrchr+0x30/0x64
> [ 675.403888] [c5649ce0] [c95d545c] kasan_strings+0x7c/0x118 [test_kasan]
> [ 675.404170] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
> [test_kasan]
> [ 675.404362] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 675.404576] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 675.404779] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 675.404983] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 675.405177] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 675.405344] --- interrupt: c01 at 0xfd6b914
> [ 675.405344] LR = 0x1001364c
> [ 675.405390]
> [ 675.406684] Allocated by task 340:
> [ 675.410118] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 675.410366] kasan_strings+0x44/0x118 [test_kasan]
> [ 675.410603] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.410750] do_one_initcall+0x40/0x278
> [ 675.410919] do_init_module+0xcc/0x59c
> [ 675.411078] load_module+0x2bc4/0x320c
> [ 675.411238] sys_init_module+0x114/0x138
> [ 675.411384] ret_from_syscall+0x0/0x38
> [ 675.411430]
> [ 675.412704] Freed by task 340:
> [ 675.415789] __kasan_slab_free+0x120/0x22c
> [ 675.415910] kfree+0x74/0x270
> [ 675.416155] kasan_strings+0x54/0x118 [test_kasan]
> [ 675.416391] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.416537] do_one_initcall+0x40/0x278
> [ 675.416706] do_init_module+0xcc/0x59c
> [ 675.416865] load_module+0x2bc4/0x320c
> [ 675.417024] sys_init_module+0x114/0x138
> [ 675.417169] ret_from_syscall+0x0/0x38
> [ 675.417215]
> [ 675.418509] The buggy address belongs to the object at c53e8e10
> [ 675.418509] which belongs to the cache kmalloc-32 of size 32
> [ 675.430055] The buggy address is located 16 bytes inside of
> [ 675.430055] 32-byte region [c53e8e10, c53e8e30)
> [ 675.440057] The buggy address belongs to the page:
> [ 675.444844] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 675.444955] flags: 0x200(slab)
> [ 675.445184] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 675.445253] page dumped because: kasan: bad access detected
> [ 675.445293]
> [ 675.446595] Memory state around the buggy address:
> [ 675.451401] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
> [ 675.457856] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
> [ 675.464310] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
> [ 675.470698] ^
> [ 675.474291] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
> [ 675.480747] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
> [ 675.487138]
> ==================================================================
> [ 675.500419] kasan test: kasan_strings use-after-free in strcmp
> [ 675.500491]
> ==================================================================
> [ 675.507536] BUG: KASAN: use-after-free in strcmp+0x30/0x90
> [ 675.512918] Read of size 1 at addr c53e8e20 by task exe/340
> [ 675.518358]
> [ 675.519942] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 675.519994] Call Trace:
> [ 675.520167] [c5649c50] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 675.520369] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
> [ 675.520536] [c5649cc0] [c072ebd0] strcmp+0x30/0x90
> [ 675.520833] [c5649ce0] [c95d5480] kasan_strings+0xa0/0x118 [test_kasan]
> [ 675.521113] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
> [test_kasan]
> [ 675.521303] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 675.521514] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 675.521716] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 675.521919] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 675.522111] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 675.522275] --- interrupt: c01 at 0xfd6b914
> [ 675.522275] LR = 0x1001364c
> [ 675.522320]
> [ 675.523640] Allocated by task 340:
> [ 675.527073] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 675.527321] kasan_strings+0x44/0x118 [test_kasan]
> [ 675.527556] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.527699] do_one_initcall+0x40/0x278
> [ 675.527867] do_init_module+0xcc/0x59c
> [ 675.528024] load_module+0x2bc4/0x320c
> [ 675.528182] sys_init_module+0x114/0x138
> [ 675.528327] ret_from_syscall+0x0/0x38
> [ 675.528373]
> [ 675.529658] Freed by task 340:
> [ 675.532745] __kasan_slab_free+0x120/0x22c
> [ 675.532865] kfree+0x74/0x270
> [ 675.533109] kasan_strings+0x54/0x118 [test_kasan]
> [ 675.533343] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.533486] do_one_initcall+0x40/0x278
> [ 675.533654] do_init_module+0xcc/0x59c
> [ 675.533810] load_module+0x2bc4/0x320c
> [ 675.533967] sys_init_module+0x114/0x138
> [ 675.534112] ret_from_syscall+0x0/0x38
> [ 675.534157]
> [ 675.535463] The buggy address belongs to the object at c53e8e10
> [ 675.535463] which belongs to the cache kmalloc-32 of size 32
> [ 675.547010] The buggy address is located 16 bytes inside of
> [ 675.547010] 32-byte region [c53e8e10, c53e8e30)
> [ 675.557012] The buggy address belongs to the page:
> [ 675.561799] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 675.561909] flags: 0x200(slab)
> [ 675.562137] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 675.562204] page dumped because: kasan: bad access detected
> [ 675.562243]
> [ 675.563549] Memory state around the buggy address:
> [ 675.568356] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
> [ 675.574809] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
> [ 675.581265] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
> [ 675.587653] ^
> [ 675.591247] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
> [ 675.597702] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
> [ 675.604091]
> ==================================================================
> [ 675.894391] kasan test: kasan_strings use-after-free in strncmp
> [ 675.894468] kasan test: kasan_strings use-after-free in strlen
> [ 675.894536] kasan test: kasan_strings use-after-free in strnlen
> [ 675.894600]
> ==================================================================
> [ 675.901698] BUG: KASAN: use-after-free in strnlen+0x24/0x88
> [ 675.907165] Read of size 1 at addr c53e8e20 by task exe/340
> [ 675.912603]
> [ 675.914186] CPU: 0 PID: 340 Comm: exe Tainted: G B
> 5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
> [ 675.914237] Call Trace:
> [ 675.914412] [c5649c70] [c0176998]
> print_address_description+0x6c/0x2b0 (unreliable)
> [ 675.914617] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
> [ 675.914788] [c5649ce0] [c072eeb4] strnlen+0x24/0x88
> [ 675.915091] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
> [test_kasan]
> [ 675.915283] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
> [ 675.915497] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
> [ 675.915700] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
> [ 675.915904] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
> [ 675.916099] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
> [ 675.916267] --- interrupt: c01 at 0xfd6b914
> [ 675.916267] LR = 0x1001364c
> [ 675.916312]
> [ 675.917626] Allocated by task 340:
> [ 675.921059] __kasan_kmalloc.isra.0+0xc8/0x1b0
> [ 675.921309] kasan_strings+0x44/0x118 [test_kasan]
> [ 675.921546] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.921690] do_one_initcall+0x40/0x278
> [ 675.921858] do_init_module+0xcc/0x59c
> [ 675.922016] load_module+0x2bc4/0x320c
> [ 675.922174] sys_init_module+0x114/0x138
> [ 675.922318] ret_from_syscall+0x0/0x38
> [ 675.922365]
> [ 675.923645] Freed by task 340:
> [ 675.926731] __kasan_slab_free+0x120/0x22c
> [ 675.926851] kfree+0x74/0x270
> [ 675.927097] kasan_strings+0x54/0x118 [test_kasan]
> [ 675.927334] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
> [ 675.927479] do_one_initcall+0x40/0x278
> [ 675.927647] do_init_module+0xcc/0x59c
> [ 675.927804] load_module+0x2bc4/0x320c
> [ 675.927962] sys_init_module+0x114/0x138
> [ 675.928107] ret_from_syscall+0x0/0x38
> [ 675.928154]
> [ 675.929450] The buggy address belongs to the object at c53e8e10
> [ 675.929450] which belongs to the cache kmalloc-32 of size 32
> [ 675.940997] The buggy address is located 16 bytes inside of
> [ 675.940997] 32-byte region [c53e8e10, c53e8e30)
> [ 675.950999] The buggy address belongs to the page:
> [ 675.955786] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
> [ 675.955897] flags: 0x200(slab)
> [ 675.956127] raw: 00000200 00000100 00000200 c5007cf0 00000000
> 015502ab ffffffff 00000001
> [ 675.956196] page dumped because: kasan: bad access detected
> [ 675.956236]
> [ 675.957536] Memory state around the buggy address:
> [ 675.962343] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
> [ 675.968796] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
> [ 675.975251] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
> [ 675.981640] ^
> [ 675.985233] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
> [ 675.991688] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
> [ 675.998080]
> ==================================================================
> [ 721.624809] random: crng init done
^ permalink raw reply
* Re: [PATCH v2 29/29] y2038: add 64-bit time_t syscalls to all 32-bit architectures
From: Heiko Carstens @ 2019-01-21 12:19 UTC (permalink / raw)
To: Arnd Bergmann
Cc: dalias, linux-ia64, linux-sh, will.deacon, linux-mips, jcmvbkbc,
netdev, deepa.kernel, hpa, sparclinux, linux-arch, linux-s390,
y2038, deller, x86, linux, mingo, geert, catalin.marinas,
firoz.khan, mattst88, fenghua.yu, linux-fsdevel, linux-m68k, luto,
tglx, linux-arm-kernel, monstr, tony.luck, linux-parisc,
linux-api, linux-kernel, paul.burton, ebiederm, linux-alpha,
schwidefsky, akpm, linuxppc-dev, davem
In-Reply-To: <20190118161835.2259170-30-arnd@arndb.de>
On Fri, Jan 18, 2019 at 05:18:35PM +0100, Arnd Bergmann wrote:
> This adds 21 new system calls on each ABI that has 32-bit time_t
> today. All of these have the exact same semantics as their existing
> counterparts, and the new ones all have macro names that end in 'time64'
> for clarification.
>
> This gets us to the point of being able to safely use a C library
> that has 64-bit time_t in user space. There are still a couple of
> loose ends to tie up in various areas of the code, but this is the
> big one, and should be entirely uncontroversial at this point.
>
> In particular, there are four system calls (getitimer, setitimer,
> waitid, and getrusage) that don't have a 64-bit counterpart yet,
> but these can all be safely implemented in the C library by wrapping
> around the existing system calls because the 32-bit time_t they
> pass only counts elapsed time, not time since the epoch. They
> will be dealt with later.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> arch/s390/kernel/syscalls/syscall.tbl | 20 +++++++++
For the s390 bits:
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply
* Re: [PATCH v2 28/29] y2038: rename old time and utime syscalls
From: Heiko Carstens @ 2019-01-21 12:15 UTC (permalink / raw)
To: Arnd Bergmann
Cc: dalias, linux-ia64, linux-sh, will.deacon, linux-mips, jcmvbkbc,
netdev, deepa.kernel, hpa, sparclinux, linux-arch, linux-s390,
y2038, deller, x86, linux, mingo, geert, catalin.marinas,
firoz.khan, mattst88, fenghua.yu, linux-fsdevel, linux-m68k, luto,
tglx, linux-arm-kernel, monstr, tony.luck, linux-parisc,
linux-api, linux-kernel, paul.burton, ebiederm, linux-alpha,
schwidefsky, akpm, linuxppc-dev, davem
In-Reply-To: <20190118161835.2259170-29-arnd@arndb.de>
On Fri, Jan 18, 2019 at 05:18:34PM +0100, Arnd Bergmann wrote:
> The time, stime, utime, utimes, and futimesat system calls are only
> used on older architectures, and we do not provide y2038 safe variants
> of them, as they are replaced by clock_gettime64, clock_settime64,
> and utimensat_time64.
>
> However, for consistency it seems better to have the 32-bit architectures
> that still use them call the "time32" entry points (leaving the
> traditional handlers for the 64-bit architectures), like we do for system
> calls that now require two versions.
>
> Note: We used to always define __ARCH_WANT_SYS_TIME and
> __ARCH_WANT_SYS_UTIME and only set __ARCH_WANT_COMPAT_SYS_TIME and
> __ARCH_WANT_SYS_UTIME32 for compat mode on 64-bit kernels. Now this is
> reversed: only 64-bit architectures set __ARCH_WANT_SYS_TIME/UTIME, while
> we need __ARCH_WANT_SYS_TIME32/UTIME32 for 32-bit architectures and compat
> mode. The resulting asm/unistd.h changes look a bit counterintuitive.
>
> This is only a cleanup patch and it should not change any behavior.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
...
> arch/s390/include/asm/unistd.h | 2 +-
For the s390 bits:
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply
* Re: [PATCH v2 17/29] syscalls: remove obsolete __IGNORE_ macros
From: Heiko Carstens @ 2019-01-21 11:59 UTC (permalink / raw)
To: Arnd Bergmann
Cc: dalias, linux-ia64, linux-sh, will.deacon, linux-mips, jcmvbkbc,
netdev, deepa.kernel, hpa, sparclinux, linux-arch, linux-s390,
y2038, deller, x86, linux, mingo, geert, catalin.marinas,
firoz.khan, mattst88, fenghua.yu, linux-fsdevel, linux-m68k, luto,
tglx, linux-arm-kernel, monstr, tony.luck, linux-parisc,
linux-api, linux-kernel, paul.burton, ebiederm, linux-alpha,
schwidefsky, akpm, linuxppc-dev, davem
In-Reply-To: <20190118161835.2259170-18-arnd@arndb.de>
On Fri, Jan 18, 2019 at 05:18:23PM +0100, Arnd Bergmann wrote:
> These are all for ignoring the lack of obsolete system calls,
> which have been marked the same way in scripts/checksyscall.sh,
> so these can be removed.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> arch/mips/include/asm/unistd.h | 16 ----------------
> arch/parisc/include/asm/unistd.h | 3 ---
> arch/s390/include/asm/unistd.h | 2 --
> arch/xtensa/include/asm/unistd.h | 12 ------------
> 4 files changed, 33 deletions(-)
For the s390 bits:
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply
* Re: [PATCH v2 14/29] arch: add pkey and rseq syscall numbers everywhere
From: Heiko Carstens @ 2019-01-21 11:59 UTC (permalink / raw)
To: Arnd Bergmann
Cc: dalias, linux-ia64, linux-sh, will.deacon, linux-mips, jcmvbkbc,
netdev, deepa.kernel, hpa, sparclinux, linux-arch, linux-s390,
y2038, deller, x86, linux, mingo, geert, catalin.marinas,
firoz.khan, mattst88, fenghua.yu, linux-fsdevel, linux-m68k, luto,
tglx, linux-arm-kernel, monstr, tony.luck, linux-parisc,
linux-api, linux-kernel, paul.burton, ebiederm, linux-alpha,
schwidefsky, akpm, linuxppc-dev, davem
In-Reply-To: <20190118161835.2259170-15-arnd@arndb.de>
On Fri, Jan 18, 2019 at 05:18:20PM +0100, Arnd Bergmann wrote:
> Most architectures define system call numbers for the rseq and pkey system
> calls, even when they don't support the features, and perhaps never will.
>
> Only a few architectures are missing these, so just define them anyway
> for consistency. If we decide to add them later to one of these, the
> system call numbers won't get out of sync then.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> arch/alpha/include/asm/unistd.h | 4 ----
> arch/alpha/kernel/syscalls/syscall.tbl | 4 ++++
> arch/ia64/kernel/syscalls/syscall.tbl | 4 ++++
> arch/m68k/kernel/syscalls/syscall.tbl | 4 ++++
> arch/parisc/include/asm/unistd.h | 3 ---
> arch/parisc/kernel/syscalls/syscall.tbl | 4 ++++
> arch/s390/include/asm/unistd.h | 3 ---
> arch/s390/kernel/syscalls/syscall.tbl | 3 +++
> arch/sh/kernel/syscalls/syscall.tbl | 4 ++++
> arch/sparc/include/asm/unistd.h | 5 -----
> arch/sparc/kernel/syscalls/syscall.tbl | 4 ++++
> arch/xtensa/kernel/syscalls/syscall.tbl | 1 +
> 12 files changed, 28 insertions(+), 15 deletions(-)
For the s390 bits:
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply
* Re: [PATCH v2 13/29] arch: add split IPC system calls where needed
From: Heiko Carstens @ 2019-01-21 11:57 UTC (permalink / raw)
To: Arnd Bergmann
Cc: dalias, linux-ia64, linux-sh, will.deacon, linux-mips, jcmvbkbc,
netdev, deepa.kernel, hpa, sparclinux, linux-arch, linux-s390,
y2038, deller, x86, linux, mingo, geert, catalin.marinas,
firoz.khan, mattst88, fenghua.yu, linux-fsdevel, linux-m68k, luto,
tglx, linux-arm-kernel, monstr, tony.luck, linux-parisc,
linux-api, linux-kernel, paul.burton, ebiederm, linux-alpha,
schwidefsky, akpm, linuxppc-dev, davem
In-Reply-To: <20190118161835.2259170-14-arnd@arndb.de>
On Fri, Jan 18, 2019 at 05:18:19PM +0100, Arnd Bergmann wrote:
> The IPC system call handling is highly inconsistent across architectures,
> some use sys_ipc, some use separate calls, and some use both. We also
> have some architectures that require passing IPC_64 in the flags, and
> others that set it implicitly.
>
> For the additon of a y2083 safe semtimedop() system call, I chose to only
> support the separate entry points, but that requires first supporting
> the regular ones with their own syscall numbers.
>
> The IPC_64 is now implied by the new semctl/shmctl/msgctl system
> calls even on the architectures that require passing it with the ipc()
> multiplexer.
>
> I'm not adding the new semtimedop() or semop() on 32-bit architectures,
> those will get implemented using the new semtimedop_time64() version
> that gets added along with the other time64 calls.
> Three 64-bit architectures (powerpc, s390 and sparc) get semtimedop().
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> One aspect here that might be a bit controversial is the use of
> the same system call numbers across all architectures, synchronizing
> all of them with the x86-32 numbers. With the new syscall.tbl
> files, I hope we can just keep doing that in the future, and no
> longer require the architecture maintainers to assign a number.
>
> This is mainly useful for implementers of the C libraries: if
> we can add future system calls everywhere at the same time, using
> a particular version of the kernel headers also guarantees that
> the system call number macro is visible.
> ---
> arch/m68k/kernel/syscalls/syscall.tbl | 11 +++++++++++
> arch/mips/kernel/syscalls/syscall_o32.tbl | 11 +++++++++++
> arch/powerpc/kernel/syscalls/syscall.tbl | 13 +++++++++++++
> arch/s390/kernel/syscalls/syscall.tbl | 12 ++++++++++++
> arch/sh/kernel/syscalls/syscall.tbl | 11 +++++++++++
> arch/sparc/kernel/syscalls/syscall.tbl | 12 ++++++++++++
> arch/x86/entry/syscalls/syscall_32.tbl | 11 +++++++++++
> 7 files changed, 81 insertions(+)
For the s390 bits:
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
^ permalink raw reply
* Re: [PATCH v2 0/9] mm: PG_reserved cleanups and documentation
From: David Hildenbrand @ 2019-01-21 11:36 UTC (permalink / raw)
To: linux-mm, Andrew Morton
Cc: Mark Rutland, Michal Hocko, CHANDAN VN, David Airlie,
Bhupesh Sharma, Palmer Dabbelt, Heiko Carstens, Tony Luck,
Stefan Agner, Michal Hocko, David Howells, Paul Mackerras,
linux-riscv, Alexander Duyck, linux-s390, Florian Fainelli,
Vasily Gorbik, Logan Gunthorpe, Pavel Tatashin, Matthew Wilcox,
AKASHI Takahiro, Geert Uytterhoeven, Catalin Marinas,
Anthony Yznaga, Tobias Klauser, Laura Abbott, Fenghua Yu,
Albert Ou, Kees Cook, Arnd Bergmann, Stephen Rothwell,
Marc Zyngier, Will Deacon, Kristina Martsenko, linux-m68k,
Dave Kleikamp, linux-mediatek, Oleg Nesterov, Dan Williams,
linux-arm-kernel, Matthias Brugger, Greg Kroah-Hartman,
Randy Dunlap, linux-kernel, Miles Chen, Mike Rapoport,
James Morse, Souptick Joarder, Johannes Weiner,
Martin Schwidefsky, linuxppc-dev, Greg Hackmann
In-Reply-To: <20190114125903.24845-1-david@redhat.com>
On 14.01.19 13:58, David Hildenbrand wrote:
> Nothing major changed since the last version. I would be happy about
> additional ACKs. If there are no further comments, can this go via the
> mm-tree in one chunk?
For the time being, I will not add further patches to this series (as
discussed in response to one question, we have to be careful dropping
PG_reserved at some places). Only ACKs were added during review so far.
@Andrew, how to proceed with this?
--
Thanks,
David / dhildenb
^ permalink raw reply
* [PATCH] powerpc: simplify BDI switch
From: Christophe Leroy @ 2019-01-21 11:34 UTC (permalink / raw)
To: Benjamin Herrenschmidt, Paul Mackerras, Michael Ellerman
Cc: linuxppc-dev, linux-kernel
There is no reason to re-read each time the pointer at
location 0xf0 as it is fixed and known.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
---
arch/powerpc/include/asm/mmu.h | 2 ++
arch/powerpc/kernel/head_32.S | 5 ++---
arch/powerpc/kernel/head_40x.S | 5 ++---
arch/powerpc/kernel/head_8xx.S | 1 +
arch/powerpc/mm/8xx_mmu.c | 7 ++-----
5 files changed, 9 insertions(+), 11 deletions(-)
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index 25607604a7a5..6d22a8e78fe2 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -356,6 +356,8 @@ extern void early_init_mmu_secondary(void);
extern void setup_initial_memory_limit(phys_addr_t first_memblock_base,
phys_addr_t first_memblock_size);
static inline void mmu_early_init_devtree(void) { }
+
+extern void *abatron_pteptrs[2];
#endif /* __ASSEMBLY__ */
#endif
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 05b08db3901d..c2f564690778 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -1027,9 +1027,8 @@ _ENTRY(switch_mmu_context)
* The PGDIR is passed as second argument.
*/
lwz r4,MM_PGD(r4)
- lis r5, KERNELBASE@h
- lwz r5, 0xf0(r5)
- stw r4, 0x4(r5)
+ lis r5, abatron_pteptrs@ha
+ stw r4, abatron_pteptrs@l + 0x4(r5)
#endif
li r4,0
isync
diff --git a/arch/powerpc/kernel/head_40x.S b/arch/powerpc/kernel/head_40x.S
index b19d78410511..11dd09d0ce1a 100644
--- a/arch/powerpc/kernel/head_40x.S
+++ b/arch/powerpc/kernel/head_40x.S
@@ -953,9 +953,8 @@ _GLOBAL(set_context)
/* Context switch the PTE pointer for the Abatron BDI2000.
* The PGDIR is the second parameter.
*/
- lis r5, KERNELBASE@h
- lwz r5, 0xf0(r5)
- stw r4, 0x4(r5)
+ lis r5, abatron_pteptrs@ha
+ stw r4, abatron_pteptrs@l + 0x4(r5)
#endif
sync
mtspr SPRN_PID,r3
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 20cc816b3508..ec12abc2a8ce 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -989,5 +989,6 @@ swapper_pg_dir:
/* Room for two PTE table poiners, usually the kernel and current user
* pointer to their respective root page table (pgdir).
*/
+ .globl abatron_pteptrs
abatron_pteptrs:
.space 8
diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c
index 92b677faea8c..174452f7b5db 100644
--- a/arch/powerpc/mm/8xx_mmu.c
+++ b/arch/powerpc/mm/8xx_mmu.c
@@ -156,14 +156,11 @@ void set_context(unsigned long id, pgd_t *pgd)
{
s16 offset = (s16)(__pa(swapper_pg_dir));
-#ifdef CONFIG_BDI_SWITCH
- pgd_t **ptr = *(pgd_t ***)(KERNELBASE + 0xf0);
-
/* Context switch the PTE pointer for the Abatron BDI2000.
* The PGDIR is passed as second argument.
*/
- *(ptr + 1) = pgd;
-#endif
+ if (IS_ENABLED(CONFIG_BDI_SWITCH))
+ abatron_pteptrs[1] = pgd;
/* Register M_TWB will contain base address of level 1 table minus the
* lower part of the kernel PGDIR base address, so that all accesses to
--
2.13.3
^ permalink raw reply related
* [PATCH v2 2/2] powerpc/8xx: Map a second 8M text page at startup when needed.
From: Christophe Leroy @ 2019-01-21 11:34 UTC (permalink / raw)
To: Benjamin Herrenschmidt, Paul Mackerras, Michael Ellerman
Cc: linuxppc-dev, linux-kernel
In-Reply-To: <6658dcb02424fbd5e19be3c3c9abb1a20253db46.1547801451.git.christophe.leroy@c-s.fr>
Some debug setup like CONFIG_KASAN generate huge
kernels with text size over the 8M limit.
This patch maps a second 8M page when _einittext is over 8M.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
---
v2: Using IS_ENABLED() instead of #ifdef in 8xx_mmu.c
arch/powerpc/kernel/head_8xx.S | 27 +++++++++++++++++++++++++--
arch/powerpc/mm/8xx_mmu.c | 3 +++
2 files changed, 28 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 20cc816b3508..3b3b7846247f 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -337,8 +337,8 @@ InstructionTLBMiss:
rlwinm r10, r10, 16, 0xfff8
cmpli cr0, r10, PAGE_OFFSET@h
#ifndef CONFIG_PIN_TLB_TEXT
- /* It is assumed that kernel code fits into the first 8M page */
-0: cmpli cr7, r10, (PAGE_OFFSET + 0x0800000)@h
+ /* It is assumed that kernel code fits into the two first 8M pages */
+0: cmpli cr7, r10, (PAGE_OFFSET + 0x1000000)@h
patch_site 0b, patch__itlbmiss_linmem_top
#endif
#endif
@@ -908,6 +908,29 @@ initial_mmu:
li r8, MI_BOOTINIT /* Create RPN for address 0 */
mtspr SPRN_MI_RPN, r8 /* Store TLB entry */
+ /* Map a second 8M page if needed */
+ lis r9, _einittext@h
+ oris r9, r9, _einittext@l
+ cmpli cr0, r9, (PAGE_OFFSET + 0x8000000)@h
+ blt 1f
+
+#ifdef CONFIG_PIN_TLB_TEXT
+ lis r8, MI_RSV4I@h
+ ori r8, r8, 0x1d00
+
+ mtspr SPRN_MI_CTR, r8 /* Set instruction MMU control */
+#endif
+
+ lis r8, (KERNELBASE + 0x800000)@h /* Create vaddr for TLB */
+ ori r8, r8, MI_EVALID /* Mark it valid */
+ mtspr SPRN_MI_EPN, r8
+ li r8, MI_PS8MEG /* Set 8M byte page */
+ ori r8, r8, MI_SVALID /* Make it valid */
+ mtspr SPRN_MI_TWC, r8
+ li r8, MI_BOOTINIT /* Create RPN for address 0 */
+ addis r8, r8, 0x80
+ mtspr SPRN_MI_RPN, r8 /* Store TLB entry */
+1:
lis r8, MI_APG_INIT@h /* Set protection modes */
ori r8, r8, MI_APG_INIT@l
mtspr SPRN_MI_AP, r8
diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c
index 92b677faea8c..b5f6d794281d 100644
--- a/arch/powerpc/mm/8xx_mmu.c
+++ b/arch/powerpc/mm/8xx_mmu.c
@@ -112,6 +112,9 @@ unsigned long __init mmu_mapin_ram(unsigned long top)
mmu_patch_cmp_limit(&patch__itlbmiss_linmem_top, 0);
} else {
mapped = top & ~(LARGE_PAGE_SIZE_8M - 1);
+ if (!IS_ENABLED(CONFIG_PIN_TLB_TEXT))
+ mmu_patch_cmp_limit(&patch__itlbmiss_linmem_top,
+ _ALIGN(__pa(_einittext), 8 << 20));
}
mmu_patch_cmp_limit(&patch__dtlbmiss_linmem_top, mapped);
--
2.13.3
^ permalink raw reply related
* [PATCH v2 1/2] powerpc/8xx: replace most #ifdef by IS_ENABLED() in 8xx_mmu.c
From: Christophe Leroy @ 2019-01-21 11:34 UTC (permalink / raw)
To: Benjamin Herrenschmidt, Paul Mackerras, Michael Ellerman
Cc: linuxppc-dev, linux-kernel
This patch replaces most #ifdef mess by IS_ENABLED() in 8xx_mmu.c
This has the advantage of allowing syntax verification at compile
time regardless of selected options.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
---
v2: left CONFIG_BDI_SWITCH change aside as it goes away in another patch
arch/powerpc/mm/8xx_mmu.c | 44 +++++++++++++++++++-------------------------
1 file changed, 19 insertions(+), 25 deletions(-)
diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c
index bfa503cff351..92b677faea8c 100644
--- a/arch/powerpc/mm/8xx_mmu.c
+++ b/arch/powerpc/mm/8xx_mmu.c
@@ -66,26 +66,22 @@ unsigned long p_block_mapped(phys_addr_t pa)
void __init MMU_init_hw(void)
{
/* PIN up to the 3 first 8Mb after IMMR in DTLB table */
-#ifdef CONFIG_PIN_TLB_DATA
- unsigned long ctr = mfspr(SPRN_MD_CTR) & 0xfe000000;
- unsigned long flags = 0xf0 | MD_SPS16K | _PAGE_SH | _PAGE_DIRTY;
-#ifdef CONFIG_PIN_TLB_IMMR
- int i = 29;
-#else
- int i = 28;
-#endif
- unsigned long addr = 0;
- unsigned long mem = total_lowmem;
-
- for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) {
- mtspr(SPRN_MD_CTR, ctr | (i << 8));
- mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID);
- mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID);
- mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT);
- addr += LARGE_PAGE_SIZE_8M;
- mem -= LARGE_PAGE_SIZE_8M;
+ if (IS_ENABLED(CONFIG_PIN_TLB_DATA)) {
+ unsigned long ctr = mfspr(SPRN_MD_CTR) & 0xfe000000;
+ unsigned long flags = 0xf0 | MD_SPS16K | _PAGE_SH | _PAGE_DIRTY;
+ int i = IS_ENABLED(CONFIG_PIN_TLB_IMMR) ? 29 : 28;
+ unsigned long addr = 0;
+ unsigned long mem = total_lowmem;
+
+ for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) {
+ mtspr(SPRN_MD_CTR, ctr | (i << 8));
+ mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID);
+ mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID);
+ mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT);
+ addr += LARGE_PAGE_SIZE_8M;
+ mem -= LARGE_PAGE_SIZE_8M;
+ }
}
-#endif
}
static void __init mmu_mapin_immr(void)
@@ -110,12 +106,10 @@ unsigned long __init mmu_mapin_ram(unsigned long top)
if (__map_without_ltlbs) {
mapped = 0;
mmu_mapin_immr();
-#ifndef CONFIG_PIN_TLB_IMMR
- patch_instruction_site(&patch__dtlbmiss_immr_jmp, PPC_INST_NOP);
-#endif
-#ifndef CONFIG_PIN_TLB_TEXT
- mmu_patch_cmp_limit(&patch__itlbmiss_linmem_top, 0);
-#endif
+ if (!IS_ENABLED(CONFIG_PIN_TLB_IMMR))
+ patch_instruction_site(&patch__dtlbmiss_immr_jmp, PPC_INST_NOP);
+ if (!IS_ENABLED(CONFIG_PIN_TLB_TEXT))
+ mmu_patch_cmp_limit(&patch__itlbmiss_linmem_top, 0);
} else {
mapped = top & ~(LARGE_PAGE_SIZE_8M - 1);
}
--
2.13.3
^ permalink raw reply related
* Re: [PATCH v3 3/3] powerpc/32: Add KASAN support
From: Christophe Leroy @ 2019-01-21 10:36 UTC (permalink / raw)
To: Andrey Ryabinin, Benjamin Herrenschmidt, Paul Mackerras,
Michael Ellerman, Nicholas Piggin, Aneesh Kumar K.V,
Alexander Potapenko, Dmitry Vyukov
Cc: linux-mm, linuxppc-dev, linux-kernel, kasan-dev
In-Reply-To: <e4b343fa-702b-294f-7741-bb85ed877cdf@virtuozzo.com>
Le 15/01/2019 à 18:23, Andrey Ryabinin a écrit :
>
>
> On 1/12/19 2:16 PM, Christophe Leroy wrote:
>
>> +KASAN_SANITIZE_early_32.o := n
>> +KASAN_SANITIZE_cputable.o := n
>> +KASAN_SANITIZE_prom_init.o := n
>> +
>
> Usually it's also good idea to disable branch profiling - define DISABLE_BRANCH_PROFILING
> either in top of these files or via Makefile. Branch profiling redefines if() statement and calls
> instrumented ftrace_likely_update in every if().
>
>
>
>> diff --git a/arch/powerpc/mm/kasan_init.c b/arch/powerpc/mm/kasan_init.c
>> new file mode 100644
>> index 000000000000..3edc9c2d2f3e
>
>> +void __init kasan_init(void)
>> +{
>> + struct memblock_region *reg;
>> +
>> + for_each_memblock(memory, reg)
>> + kasan_init_region(reg);
>> +
>> + pr_info("KASAN init done\n");
>
> Without "init_task.kasan_depth = 0;" kasan will not repot bugs.
>
> There is test_kasan module. Make sure that it produce reports.
>
I get the following report with test_kasan module.
Could you have a look at it and tell if everything is as expected ?
Thanks
Christophe
[ 667.298897] kasan test: kmalloc_oob_right out-of-bounds to right
[ 667.299036]
==================================================================
[ 667.306263] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_right+0x74/0x94 [test_kasan]
[ 667.313929] Write of size 1 at addr c53996fb by task exe/340
[ 667.319451]
[ 667.321021] CPU: 0 PID: 340 Comm: exe Not tainted
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 667.321072] Call Trace:
[ 667.321248] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 667.321452] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 667.321741] [c5649ce0] [c95d41d4] kmalloc_oob_right+0x74/0x94
[test_kasan]
[ 667.322022] [c5649d00] [c95d5510] kmalloc_tests_init+0x18/0x2d0
[test_kasan]
[ 667.322214] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 667.322428] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 667.322630] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 667.322834] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 667.323027] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 667.323193] --- interrupt: c01 at 0xfd6b914
[ 667.323193] LR = 0x1001364c
[ 667.323239]
[ 667.324561] Allocated by task 340:
[ 667.327993] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 667.328241] kmalloc_oob_right+0x44/0x94 [test_kasan]
[ 667.328477] kmalloc_tests_init+0x18/0x2d0 [test_kasan]
[ 667.328622] do_one_initcall+0x40/0x278
[ 667.328792] do_init_module+0xcc/0x59c
[ 667.328948] load_module+0x2bc4/0x320c
[ 667.329107] sys_init_module+0x114/0x138
[ 667.329250] ret_from_syscall+0x0/0x38
[ 667.329298]
[ 667.330580] Freed by task 335:
[ 667.333667] __kasan_slab_free+0x120/0x22c
[ 667.333788] kfree+0x74/0x270
[ 667.333950] load_elf_binary+0xb0/0x162c
[ 667.334129] search_binary_handler+0x120/0x374
[ 667.334297] __do_execve_file+0x834/0xb20
[ 667.334460] sys_execve+0x40/0x54
[ 667.334605] ret_from_syscall+0x0/0x38
[ 667.334652]
[ 667.335954] The buggy address belongs to the object at c5399680
[ 667.335954] which belongs to the cache kmalloc-128 of size 128
[ 667.347675] The buggy address is located 123 bytes inside of
[ 667.347675] 128-byte region [c5399680, c5399700)
[ 667.357847] The buggy address belongs to the page:
[ 667.362634] page:c7fd9cc0 count:1 mapcount:0 mapping:c5007a80 index:0x0
[ 667.362745] flags: 0x200(slab)
[ 667.362973] raw: 00000200 00000100 00000200 c5007a80 00000000
005500ab ffffffff 00000001
[ 667.363043] page dumped because: kasan: bad access detected
[ 667.363083]
[ 667.364384] Memory state around the buggy address:
[ 667.369190] c5399580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 667.375645] c5399600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 667.382099] >c5399680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
[ 667.388496] ^
[ 667.394921] c5399700: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 667.401377] c5399780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 667.407767]
==================================================================
[ 667.414904] Disabling lock debugging due to kernel taint
[ 667.421182] kasan test: kmalloc_oob_left out-of-bounds to left
[ 667.421314]
==================================================================
[ 667.428466] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_left+0x74/0x9c [test_kasan]
[ 667.436045] Read of size 1 at addr c58e9ddf by task exe/340
[ 667.441483]
[ 667.443064] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 667.443115] Call Trace:
[ 667.443290] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 667.443492] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 667.443779] [c5649ce0] [c95d4268] kmalloc_oob_left+0x74/0x9c [test_kasan]
[ 667.444057] [c5649d00] [c95d5514] kmalloc_tests_init+0x1c/0x2d0
[test_kasan]
[ 667.444246] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 667.444458] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 667.444658] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 667.444859] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 667.445051] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 667.445215] --- interrupt: c01 at 0xfd6b914
[ 667.445215] LR = 0x1001364c
[ 667.445260]
[ 667.446593] Allocated by task 340:
[ 667.450025] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 667.450191] do_init_module+0x2c/0x59c
[ 667.450346] load_module+0x2bc4/0x320c
[ 667.450503] sys_init_module+0x114/0x138
[ 667.450645] ret_from_syscall+0x0/0x38
[ 667.450691]
[ 667.452009] Freed by task 276:
[ 667.455096] __kasan_slab_free+0x120/0x22c
[ 667.455214] kfree+0x74/0x270
[ 667.455344] single_release+0x54/0x6c
[ 667.455516] close_pdeo+0x128/0x224
[ 667.455680] proc_reg_release+0x110/0x128
[ 667.455811] __fput+0xec/0x2d4
[ 667.455934] task_work_run+0x13c/0x15c
[ 667.456101] do_notify_resume+0x3d8/0x438
[ 667.456248] do_user_signal+0x2c/0x34
[ 667.456294]
[ 667.457641] The buggy address belongs to the object at c58e9dc0
[ 667.457641] which belongs to the cache kmalloc-16 of size 16
[ 667.469191] The buggy address is located 15 bytes to the right of
[ 667.469191] 16-byte region [c58e9dc0, c58e9dd0)
[ 667.479708] The buggy address belongs to the page:
[ 667.484495] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 667.484606] flags: 0x200(slab)
[ 667.484833] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 667.484900] page dumped because: kasan: bad access detected
[ 667.484940]
[ 667.486244] Memory state around the buggy address:
[ 667.491051] c58e9c80: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
[ 667.497505] c58e9d00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
[ 667.503959] >c58e9d80: 00 00 fc fc 00 00 fc fc 00 04 fc fc 00 07 fc fc
[ 667.510354] ^
[ 667.515748] c58e9e00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 667.522204] c58e9e80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 667.528595]
==================================================================
[ 667.803662] kasan test: kmalloc_node_oob_right kmalloc_node():
out-of-bounds to right
[ 667.803806]
==================================================================
[ 667.811008] BUG: KASAN: slab-out-of-bounds in
kmalloc_node_oob_right+0x74/0x94 [test_kasan]
[ 667.819105] Write of size 1 at addr c59a4300 by task exe/340
[ 667.824627]
[ 667.826209] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 667.826260] Call Trace:
[ 667.826436] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 667.826640] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 667.826931] [c5649ce0] [c95d4304] kmalloc_node_oob_right+0x74/0x94
[test_kasan]
[ 667.827211] [c5649d00] [c95d5518] kmalloc_tests_init+0x20/0x2d0
[test_kasan]
[ 667.827402] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 667.827616] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 667.827818] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 667.828022] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 667.828216] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 667.828382] --- interrupt: c01 at 0xfd6b914
[ 667.828382] LR = 0x1001364c
[ 667.828428]
[ 667.829737] Allocated by task 340:
[ 667.833169] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 667.833420] kmalloc_node_oob_right+0x44/0x94 [test_kasan]
[ 667.833656] kmalloc_tests_init+0x20/0x2d0 [test_kasan]
[ 667.833801] do_one_initcall+0x40/0x278
[ 667.833970] do_init_module+0xcc/0x59c
[ 667.834125] load_module+0x2bc4/0x320c
[ 667.834284] sys_init_module+0x114/0x138
[ 667.834427] ret_from_syscall+0x0/0x38
[ 667.834475]
[ 667.835756] Freed by task 319:
[ 667.838843] __kasan_slab_free+0x120/0x22c
[ 667.838963] kfree+0x74/0x270
[ 667.839137] kobject_uevent_env+0x15c/0x65c
[ 667.839299] led_trigger_set+0x3f0/0x4fc
[ 667.839451] led_trigger_store+0xd8/0x164
[ 667.839593] kernfs_fop_write+0x18c/0x218
[ 667.839721] __vfs_write+0x5c/0x258
[ 667.839843] vfs_write+0xe4/0x248
[ 667.839966] ksys_write+0x58/0xd8
[ 667.840111] ret_from_syscall+0x0/0x38
[ 667.840158]
[ 667.841475] The buggy address belongs to the object at c59a3300
[ 667.841475] which belongs to the cache kmalloc-4k of size 4096
[ 667.853196] The buggy address is located 0 bytes to the right of
[ 667.853196] 4096-byte region [c59a3300, c59a4300)
[ 667.863798] The buggy address belongs to the page:
[ 667.868586] page:c7fdcd00 count:1 mapcount:0 mapping:c50075a0
index:0x0 compound_mapcount: 0
[ 667.868727] flags: 0x10200(slab|head)
[ 667.868956] raw: 00010200 00000100 00000200 c50075a0 00000000
000f001f ffffffff 00000001
[ 667.869025] page dumped because: kasan: bad access detected
[ 667.869065]
[ 667.870334] Memory state around the buggy address:
[ 667.875141] c59a4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 667.881595] c59a4280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 667.888049] >c59a4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 667.894436] ^
[ 667.896998] c59a4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 667.903454] c59a4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 667.909845]
==================================================================
[ 667.923434] kasan test: kmalloc_pagealloc_oob_right kmalloc pagealloc
allocation: out-of-bounds to right
[ 667.923647]
==================================================================
[ 667.930896] BUG: KASAN: slab-out-of-bounds in
kmalloc_pagealloc_oob_right+0x78/0x98 [test_kasan]
[ 667.939503] Write of size 1 at addr c5bd800a by task exe/340
[ 667.945024]
[ 667.946607] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 667.946657] Call Trace:
[ 667.946833] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 667.947035] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 667.947325] [c5649ce0] [c95d4674]
kmalloc_pagealloc_oob_right+0x78/0x98 [test_kasan]
[ 667.947603] [c5649d00] [c95d551c] kmalloc_tests_init+0x24/0x2d0
[test_kasan]
[ 667.947792] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 667.948004] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 667.948204] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 667.948406] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 667.948597] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 667.948760] --- interrupt: c01 at 0xfd6b914
[ 667.948760] LR = 0x1001364c
[ 667.948806]
[ 667.950115] The buggy address belongs to the page:
[ 667.954903] page:c7fdde80 count:1 mapcount:0 mapping:00000000
index:0x0 compound_mapcount: 0
[ 667.955038] flags: 0x10000(head)
[ 667.955260] raw: 00010000 00000100 00000200 00000000 00000000
00000000 ffffffff 00000001
[ 667.955327] page dumped because: kasan: bad access detected
[ 667.955367]
[ 667.956652] Memory state around the buggy address:
[ 667.961458] c5bd7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 667.967912] c5bd7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 667.974367] >c5bd8000: 00 02 fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[ 667.980755] ^
[ 667.983574] c5bd8080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[ 667.990030] c5bd8100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[ 667.996420]
==================================================================
[ 668.222064] kasan test: kmalloc_pagealloc_uaf kmalloc pagealloc
allocation: use-after-free
[ 668.222349]
==================================================================
[ 668.229525] BUG: KASAN: use-after-free in
kmalloc_pagealloc_uaf+0x78/0x94 [test_kasan]
[ 668.237274] Write of size 1 at addr c5bd0000 by task exe/340
[ 668.242796]
[ 668.244378] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 668.244429] Call Trace:
[ 668.244606] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 668.244810] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 668.245100] [c5649ce0] [c95d470c] kmalloc_pagealloc_uaf+0x78/0x94
[test_kasan]
[ 668.245381] [c5649d00] [c95d5520] kmalloc_tests_init+0x28/0x2d0
[test_kasan]
[ 668.245573] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 668.245787] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 668.245989] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 668.246192] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 668.246386] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 668.246552] --- interrupt: c01 at 0xfd6b914
[ 668.246552] LR = 0x1001364c
[ 668.246598]
[ 668.247886] The buggy address belongs to the page:
[ 668.252671] page:c7fdde80 count:0 mapcount:-128 mapping:00000000
index:0x0
[ 668.252769] flags: 0x0()
[ 668.252994] raw: 00000000 c7fdcf84 c0982ae8 00000000 00000000
00000002 ffffff7f 00000000
[ 668.253062] page dumped because: kasan: bad access detected
[ 668.253102]
[ 668.254337] Memory state around the buggy address:
[ 668.259143] c5bcff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.265597] c5bcff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.272052] >c5bd0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 668.278439] ^
[ 668.281001] c5bd0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 668.287458] c5bd0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 668.293847]
==================================================================
[ 668.310744] kasan test: kmalloc_pagealloc_invalid_free kmalloc
pagealloc allocation: invalid-free
[ 668.310957]
==================================================================
[ 668.318156] BUG: KASAN: double-free or invalid-free in
kmalloc_tests_init+0x2c/0x2d0 [test_kasan]
[ 668.326705]
[ 668.328286] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 668.328337] Call Trace:
[ 668.328512] [c5649c80] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 668.328724] [c5649cb0] [c0176c24] kasan_report_invalid_free+0x48/0x74
[ 668.328888] [c5649ce0] [c0173c14] kfree+0x1f8/0x270
[ 668.329176] [c5649d00] [c95d5524] kmalloc_tests_init+0x2c/0x2d0
[test_kasan]
[ 668.329365] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 668.329577] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 668.329777] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 668.329978] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 668.330170] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 668.330334] --- interrupt: c01 at 0xfd6b914
[ 668.330334] LR = 0x1001364c
[ 668.330379]
[ 668.331622] The buggy address belongs to the page:
[ 668.336410] page:c7fdde80 count:1 mapcount:0 mapping:00000000
index:0x0 compound_mapcount: 0
[ 668.336545] flags: 0x10000(head)
[ 668.336767] raw: 00010000 00000100 00000200 00000000 00000000
00000000 ffffffff 00000001
[ 668.336834] page dumped because: kasan: bad access detected
[ 668.336873]
[ 668.338158] Memory state around the buggy address:
[ 668.342965] c5bcff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.349419] c5bcff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.355874] >c5bd0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 668.362260] ^
[ 668.364822] c5bd0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 668.371279] c5bd0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 668.377668]
==================================================================
[ 668.528086] kasan test: kmalloc_large_oob_right kmalloc large
allocation: out-of-bounds to right
[ 668.528279]
==================================================================
[ 668.535471] BUG: KASAN: slab-out-of-bounds in
kmalloc_large_oob_right+0x74/0x94 [test_kasan]
[ 668.543735] Write of size 1 at addr c5498700 by task exe/340
[ 668.549257]
[ 668.550840] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 668.550891] Call Trace:
[ 668.551068] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 668.551272] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 668.551561] [c5649ce0] [c95d4398] kmalloc_large_oob_right+0x74/0x94
[test_kasan]
[ 668.551842] [c5649d00] [c95d5528] kmalloc_tests_init+0x30/0x2d0
[test_kasan]
[ 668.552034] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 668.552248] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 668.552450] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 668.552655] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 668.552848] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 668.553013] --- interrupt: c01 at 0xfd6b914
[ 668.553013] LR = 0x1001364c
[ 668.553059]
[ 668.554367] Allocated by task 340:
[ 668.557799] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 668.558049] kmalloc_large_oob_right+0x44/0x94 [test_kasan]
[ 668.558285] kmalloc_tests_init+0x30/0x2d0 [test_kasan]
[ 668.558430] do_one_initcall+0x40/0x278
[ 668.558599] do_init_module+0xcc/0x59c
[ 668.558756] load_module+0x2bc4/0x320c
[ 668.558915] sys_init_module+0x114/0x138
[ 668.559058] ret_from_syscall+0x0/0x38
[ 668.559106]
[ 668.560386] Freed by task 173:
[ 668.563473] __kasan_slab_free+0x120/0x22c
[ 668.563595] kfree+0x74/0x270
[ 668.563763] consume_skb+0x38/0x138
[ 668.563935] skb_free_datagram+0x1c/0x80
[ 668.564104] netlink_recvmsg+0x1d0/0x4d4
[ 668.564270] ___sys_recvmsg+0xd8/0x194
[ 668.564436] __sys_recvmsg+0x40/0x8c
[ 668.564563] sys_socketcall+0xf8/0x210
[ 668.564709] ret_from_syscall+0x0/0x38
[ 668.564756]
[ 668.566106] The buggy address belongs to the object at c5490800
[ 668.566106] which belongs to the cache kmalloc-32k of size 32768
[ 668.578000] The buggy address is located 32512 bytes inside of
[ 668.578000] 32768-byte region [c5490800, c5498800)
[ 668.588514] The buggy address belongs to the page:
[ 668.593302] page:c7fda400 count:1 mapcount:0 mapping:c5007330
index:0x0 compound_mapcount: 0
[ 668.593443] flags: 0x10200(slab|head)
[ 668.593672] raw: 00010200 00000100 00000200 c5007330 00000000
00030007 ffffffff 00000001
[ 668.593741] page dumped because: kasan: bad access detected
[ 668.593781]
[ 668.595051] Memory state around the buggy address:
[ 668.599857] c5498600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 668.606311] c5498680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 668.612765] >c5498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.619152] ^
[ 668.621714] c5498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.628171] c5498800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 668.634561]
==================================================================
[ 668.645940] kasan test: kmalloc_oob_krealloc_more out-of-bounds after
krealloc more
[ 668.646103]
==================================================================
[ 668.653286] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_krealloc_more+0x8c/0xac [test_kasan]
[ 668.661723] Write of size 1 at addr c53e8ca3 by task exe/340
[ 668.667245]
[ 668.668827] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 668.668877] Call Trace:
[ 668.669052] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 668.669254] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 668.669543] [c5649ce0] [c95d4838] kmalloc_oob_krealloc_more+0x8c/0xac
[test_kasan]
[ 668.669823] [c5649d00] [c95d552c] kmalloc_tests_init+0x34/0x2d0
[test_kasan]
[ 668.670012] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 668.670225] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 668.670426] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 668.670627] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 668.670819] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 668.670982] --- interrupt: c01 at 0xfd6b914
[ 668.670982] LR = 0x1001364c
[ 668.671027]
[ 668.672354] Allocated by task 340:
[ 668.675786] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 668.675935] krealloc+0xb0/0xe8
[ 668.676185] kmalloc_oob_krealloc_more+0x58/0xac [test_kasan]
[ 668.676419] kmalloc_tests_init+0x34/0x2d0 [test_kasan]
[ 668.676563] do_one_initcall+0x40/0x278
[ 668.676730] do_init_module+0xcc/0x59c
[ 668.676885] load_module+0x2bc4/0x320c
[ 668.677042] sys_init_module+0x114/0x138
[ 668.677185] ret_from_syscall+0x0/0x38
[ 668.677231]
[ 668.678543] Freed by task 0:
[ 668.681460] __kasan_slab_free+0x120/0x22c
[ 668.681579] kfree+0x74/0x270
[ 668.681726] rcu_process_callbacks+0x384/0x620
[ 668.681858] __do_softirq+0x134/0x48c
[ 668.681904]
[ 668.683231] The buggy address belongs to the object at c53e8c90
[ 668.683231] which belongs to the cache kmalloc-32 of size 32
[ 668.694778] The buggy address is located 19 bytes inside of
[ 668.694778] 32-byte region [c53e8c90, c53e8cb0)
[ 668.704780] The buggy address belongs to the page:
[ 668.709568] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 668.709676] flags: 0x200(slab)
[ 668.709903] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 668.709970] page dumped because: kasan: bad access detected
[ 668.710010]
[ 668.711317] Memory state around the buggy address:
[ 668.716124] c53e8b80: 00 fc fc fc 00 00 00 fc fc fc fb fb fb fb fc fc
[ 668.722579] c53e8c00: 00 00 00 04 fc fc 00 00 00 04 fc fc 00 00 00 00
[ 668.729033] >c53e8c80: fc fc 00 00 03 fc fc fc 00 00 00 00 fc fc 00 00
[ 668.735421] ^
[ 668.739014] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
[ 668.745470] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
[ 668.751860]
==================================================================
[ 669.016775] kasan test: kmalloc_oob_krealloc_less out-of-bounds after
krealloc less
[ 669.016942]
==================================================================
[ 669.024120] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_krealloc_less+0x8c/0xac [test_kasan]
[ 669.032474] Write of size 1 at addr c53e8bdf by task exe/340
[ 669.037995]
[ 669.039577] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 669.039628] Call Trace:
[ 669.039803] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 669.040007] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 669.040299] [c5649ce0] [c95d48e4] kmalloc_oob_krealloc_less+0x8c/0xac
[test_kasan]
[ 669.040580] [c5649d00] [c95d5530] kmalloc_tests_init+0x38/0x2d0
[test_kasan]
[ 669.040771] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 669.040984] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 669.041187] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 669.041390] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 669.041584] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 669.041750] --- interrupt: c01 at 0xfd6b914
[ 669.041750] LR = 0x1001364c
[ 669.041796]
[ 669.043105] Allocated by task 340:
[ 669.046537] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 669.046687] krealloc+0xb0/0xe8
[ 669.046940] kmalloc_oob_krealloc_less+0x58/0xac [test_kasan]
[ 669.047176] kmalloc_tests_init+0x38/0x2d0 [test_kasan]
[ 669.047321] do_one_initcall+0x40/0x278
[ 669.047491] do_init_module+0xcc/0x59c
[ 669.047648] load_module+0x2bc4/0x320c
[ 669.047806] sys_init_module+0x114/0x138
[ 669.047951] ret_from_syscall+0x0/0x38
[ 669.047998]
[ 669.049294] Freed by task 0:
[ 669.052211] __kasan_slab_free+0x120/0x22c
[ 669.052332] kfree+0x74/0x270
[ 669.052479] rcu_process_callbacks+0x384/0x620
[ 669.052612] __do_softirq+0x134/0x48c
[ 669.052659]
[ 669.053981] The buggy address belongs to the object at c53e8bd0
[ 669.053981] which belongs to the cache kmalloc-32 of size 32
[ 669.065529] The buggy address is located 15 bytes inside of
[ 669.065529] 32-byte region [c53e8bd0, c53e8bf0)
[ 669.075531] The buggy address belongs to the page:
[ 669.080318] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 669.080428] flags: 0x200(slab)
[ 669.080655] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 669.080724] page dumped because: kasan: bad access detected
[ 669.080764]
[ 669.082068] Memory state around the buggy address:
[ 669.086874] c53e8a80: 00 00 00 fc fc fc 00 00 00 fc fc fc 00 00 00 00
[ 669.093328] c53e8b00: fc fc 00 00 00 fc fc fc 00 00 00 fc fc fc 00 00
[ 669.099783] >c53e8b80: 00 fc fc fc 00 00 00 fc fc fc 00 07 fc fc fc fc
[ 669.106177] ^
[ 669.111572] c53e8c00: 00 00 00 04 fc fc 00 00 00 04 fc fc 00 00 00 00
[ 669.118028] c53e8c80: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc 00 00
[ 669.124418]
==================================================================
[ 669.137359] kasan test: kmalloc_oob_16 kmalloc out-of-bounds for
16-bytes access
[ 669.137538]
==================================================================
[ 669.144772] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_16+0x94/0xdc [test_kasan]
[ 669.152181] Write of size 16 at addr c58eada0 by task exe/340
[ 669.157790]
[ 669.159371] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 669.159421] Call Trace:
[ 669.159597] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 669.159799] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 669.160086] [c5649ce0] [c95d444c] kmalloc_oob_16+0x94/0xdc [test_kasan]
[ 669.160365] [c5649d00] [c95d5534] kmalloc_tests_init+0x3c/0x2d0
[test_kasan]
[ 669.160554] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 669.160765] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 669.160966] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 669.161167] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 669.161360] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 669.161523] --- interrupt: c01 at 0xfd6b914
[ 669.161523] LR = 0x1001364c
[ 669.161569]
[ 669.162900] Allocated by task 340:
[ 669.166332] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 669.166578] kmalloc_oob_16+0x48/0xdc [test_kasan]
[ 669.166812] kmalloc_tests_init+0x3c/0x2d0 [test_kasan]
[ 669.166955] do_one_initcall+0x40/0x278
[ 669.167121] do_init_module+0xcc/0x59c
[ 669.167275] load_module+0x2bc4/0x320c
[ 669.167432] sys_init_module+0x114/0x138
[ 669.167575] ret_from_syscall+0x0/0x38
[ 669.167620]
[ 669.168919] Freed by task 338:
[ 669.172004] __kasan_slab_free+0x120/0x22c
[ 669.172122] kfree+0x74/0x270
[ 669.172264] walk_component+0x150/0x478
[ 669.172399] link_path_walk+0x374/0x63c
[ 669.172535] path_openat+0xe4/0x15f8
[ 669.172674] do_filp_open+0xd0/0x120
[ 669.172843] do_open_execat+0x64/0x264
[ 669.173010] __do_execve_file+0xa0c/0xb20
[ 669.173172] sys_execve+0x40/0x54
[ 669.173318] ret_from_syscall+0x0/0x38
[ 669.173364]
[ 669.174722] The buggy address belongs to the object at c58eada0
[ 669.174722] which belongs to the cache kmalloc-16 of size 16
[ 669.186269] The buggy address is located 0 bytes inside of
[ 669.186269] 16-byte region [c58eada0, c58eadb0)
[ 669.196187] The buggy address belongs to the page:
[ 669.200974] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 669.201083] flags: 0x200(slab)
[ 669.201310] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 669.201378] page dumped because: kasan: bad access detected
[ 669.201417]
[ 669.202723] Memory state around the buggy address:
[ 669.207530] c58eac80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.213984] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.220438] >c58ead80: fb fb fc fc 00 05 fc fc 00 00 fc fc fb fb fc fc
[ 669.226828] ^
[ 669.230678] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.237134] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 669.243524]
==================================================================
[ 669.521937] kasan test: kmalloc_oob_in_memset out-of-bounds in memset
[ 669.522086]
==================================================================
[ 669.529294] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_in_memset+0x78/0x90 [test_kasan]
[ 669.537306] Write of size 671 at addr c5881b00 by task exe/340
[ 669.543000]
[ 669.544581] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 669.544632] Call Trace:
[ 669.544808] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 669.545012] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 669.545186] [c5649cc0] [c0175700] memset+0x2c/0x4c
[ 669.545477] [c5649ce0] [c95d497c] kmalloc_oob_in_memset+0x78/0x90
[test_kasan]
[ 669.545759] [c5649d00] [c95d5538] kmalloc_tests_init+0x40/0x2d0
[test_kasan]
[ 669.545949] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 669.546163] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 669.546366] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 669.546570] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 669.546764] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 669.546929] --- interrupt: c01 at 0xfd6b914
[ 669.546929] LR = 0x1001364c
[ 669.546976]
[ 669.548281] Allocated by task 340:
[ 669.551713] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 669.551963] kmalloc_oob_in_memset+0x44/0x90 [test_kasan]
[ 669.552199] kmalloc_tests_init+0x40/0x2d0 [test_kasan]
[ 669.552346] do_one_initcall+0x40/0x278
[ 669.552515] do_init_module+0xcc/0x59c
[ 669.552672] load_module+0x2bc4/0x320c
[ 669.552831] sys_init_module+0x114/0x138
[ 669.552976] ret_from_syscall+0x0/0x38
[ 669.553023]
[ 669.554300] Freed by task 131:
[ 669.557387] __kasan_slab_free+0x120/0x22c
[ 669.557508] kfree+0x74/0x270
[ 669.557682] pskb_expand_head+0x2b0/0x434
[ 669.557843] netlink_trim+0xfc/0x114
[ 669.558009] netlink_broadcast_filtered+0x48/0x530
[ 669.558169] nlmsg_notify+0x7c/0x128
[ 669.558330] fib6_add+0xd44/0x11d4
[ 669.558461] __ip6_ins_rt+0x5c/0x88
[ 669.558598] ip6_ins_rt+0x34/0x44
[ 669.558777] __ipv6_ifa_notify+0x388/0x38c
[ 669.558945] ipv6_ifa_notify+0x68/0x88
[ 669.559076] addrconf_dad_completed+0x54/0x49c
[ 669.559201] addrconf_dad_work+0x558/0x84c
[ 669.559369] process_one_work+0x408/0x78c
[ 669.559524] worker_thread+0xb4/0x83c
[ 669.559657] kthread+0x144/0x184
[ 669.559811] ret_from_kernel_thread+0x14/0x1c
[ 669.559858]
[ 669.561223] The buggy address belongs to the object at c5881b00
[ 669.561223] which belongs to the cache kmalloc-1k of size 1024
[ 669.572943] The buggy address is located 0 bytes inside of
[ 669.572943] 1024-byte region [c5881b00, c5881f00)
[ 669.583031] The buggy address belongs to the page:
[ 669.587818] page:c7fdc400 count:1 mapcount:0 mapping:c5007740 index:0x0
[ 669.587929] flags: 0x200(slab)
[ 669.588156] raw: 00000200 00000100 00000200 c5007740 00000000
000e001d ffffffff 00000001
[ 669.588225] page dumped because: kasan: bad access detected
[ 669.588265]
[ 669.589567] Memory state around the buggy address:
[ 669.594374] c5881c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 669.600828] c5881d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 669.607282] >c5881d80: 00 00 00 02 fc fc fc fc fc fc fc fc fc fc fc fc
[ 669.613671] ^
[ 669.617005] c5881e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 669.623462] c5881e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 669.629852]
==================================================================
[ 669.643287] kasan test: kmalloc_oob_memset_2 out-of-bounds in memset2
[ 669.643423]
==================================================================
[ 669.650641] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_memset_2+0x7c/0x94 [test_kasan]
[ 669.658563] Write of size 2 at addr c58eae07 by task exe/340
[ 669.664085]
[ 669.665668] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 669.665718] Call Trace:
[ 669.665891] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 669.666095] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 669.666267] [c5649cc0] [c0175700] memset+0x2c/0x4c
[ 669.666556] [c5649ce0] [c95d4a10] kmalloc_oob_memset_2+0x7c/0x94
[test_kasan]
[ 669.666836] [c5649d00] [c95d553c] kmalloc_tests_init+0x44/0x2d0
[test_kasan]
[ 669.667026] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 669.667239] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 669.667440] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 669.667643] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 669.667836] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 669.668002] --- interrupt: c01 at 0xfd6b914
[ 669.668002] LR = 0x1001364c
[ 669.668046]
[ 669.669366] Allocated by task 340:
[ 669.672799] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 669.673048] kmalloc_oob_memset_2+0x44/0x94 [test_kasan]
[ 669.673283] kmalloc_tests_init+0x44/0x2d0 [test_kasan]
[ 669.673426] do_one_initcall+0x40/0x278
[ 669.673594] do_init_module+0xcc/0x59c
[ 669.673750] load_module+0x2bc4/0x320c
[ 669.673909] sys_init_module+0x114/0x138
[ 669.674051] ret_from_syscall+0x0/0x38
[ 669.674098]
[ 669.675387] Freed by task 276:
[ 669.678473] __kasan_slab_free+0x120/0x22c
[ 669.678594] kfree+0x74/0x270
[ 669.678724] single_release+0x54/0x6c
[ 669.678897] close_pdeo+0x128/0x224
[ 669.679064] proc_reg_release+0x110/0x128
[ 669.679197] __fput+0xec/0x2d4
[ 669.679320] task_work_run+0x13c/0x15c
[ 669.679487] do_notify_resume+0x3d8/0x438
[ 669.679636] do_user_signal+0x2c/0x34
[ 669.679682]
[ 669.681018] The buggy address belongs to the object at c58eae00
[ 669.681018] which belongs to the cache kmalloc-16 of size 16
[ 669.692565] The buggy address is located 7 bytes inside of
[ 669.692565] 16-byte region [c58eae00, c58eae10)
[ 669.702482] The buggy address belongs to the page:
[ 669.707268] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 669.707380] flags: 0x200(slab)
[ 669.707607] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 669.707674] page dumped because: kasan: bad access detected
[ 669.707713]
[ 669.709018] Memory state around the buggy address:
[ 669.713825] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.720279] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.726734] >c58eae00: 00 fc fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.733120] ^
[ 669.735941] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 669.742397] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 669.748787]
==================================================================
[ 670.056503] kasan test: kmalloc_oob_memset_4 out-of-bounds in memset4
[ 670.056640]
==================================================================
[ 670.063818] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_memset_4+0x7c/0x94 [test_kasan]
[ 670.071743] Write of size 4 at addr c58eae25 by task exe/340
[ 670.077263]
[ 670.078847] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 670.078898] Call Trace:
[ 670.079074] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 670.079279] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 670.079452] [c5649cc0] [c0175700] memset+0x2c/0x4c
[ 670.079743] [c5649ce0] [c95d4aa4] kmalloc_oob_memset_4+0x7c/0x94
[test_kasan]
[ 670.080025] [c5649d00] [c95d5540] kmalloc_tests_init+0x48/0x2d0
[test_kasan]
[ 670.080216] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 670.080431] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 670.080635] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 670.080839] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 670.081034] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 670.081201] --- interrupt: c01 at 0xfd6b914
[ 670.081201] LR = 0x1001364c
[ 670.081247]
[ 670.082546] Allocated by task 340:
[ 670.085978] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 670.086229] kmalloc_oob_memset_4+0x44/0x94 [test_kasan]
[ 670.086465] kmalloc_tests_init+0x48/0x2d0 [test_kasan]
[ 670.086611] do_one_initcall+0x40/0x278
[ 670.086782] do_init_module+0xcc/0x59c
[ 670.086941] load_module+0x2bc4/0x320c
[ 670.087101] sys_init_module+0x114/0x138
[ 670.087246] ret_from_syscall+0x0/0x38
[ 670.087293]
[ 670.088563] Freed by task 276:
[ 670.091652] __kasan_slab_free+0x120/0x22c
[ 670.091774] kfree+0x74/0x270
[ 670.091906] single_release+0x54/0x6c
[ 670.092080] close_pdeo+0x128/0x224
[ 670.092249] proc_reg_release+0x110/0x128
[ 670.092383] __fput+0xec/0x2d4
[ 670.092509] task_work_run+0x13c/0x15c
[ 670.092678] do_notify_resume+0x3d8/0x438
[ 670.092828] do_user_signal+0x2c/0x34
[ 670.092874]
[ 670.094198] The buggy address belongs to the object at c58eae20
[ 670.094198] which belongs to the cache kmalloc-16 of size 16
[ 670.105743] The buggy address is located 5 bytes inside of
[ 670.105743] 16-byte region [c58eae20, c58eae30)
[ 670.115660] The buggy address belongs to the page:
[ 670.120447] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 670.120560] flags: 0x200(slab)
[ 670.120789] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 670.120858] page dumped because: kasan: bad access detected
[ 670.120899]
[ 670.122198] Memory state around the buggy address:
[ 670.127004] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.133458] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.139912] >c58eae00: fb fb fc fc 00 fc fc fc fb fb fc fc fb fb fc fc
[ 670.146302] ^
[ 670.150152] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 670.156608] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.162998]
==================================================================
[ 670.176210] kasan test: kmalloc_oob_memset_8 out-of-bounds in memset8
[ 670.176342]
==================================================================
[ 670.183528] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_memset_8+0x7c/0x94 [test_kasan]
[ 670.191450] Write of size 8 at addr c58eae41 by task exe/340
[ 670.196972]
[ 670.198555] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 670.198605] Call Trace:
[ 670.198779] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 670.198982] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 670.199153] [c5649cc0] [c0175700] memset+0x2c/0x4c
[ 670.199443] [c5649ce0] [c95d4b38] kmalloc_oob_memset_8+0x7c/0x94
[test_kasan]
[ 670.199722] [c5649d00] [c95d5544] kmalloc_tests_init+0x4c/0x2d0
[test_kasan]
[ 670.199912] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 670.200125] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 670.200327] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 670.200530] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 670.200723] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 670.200887] --- interrupt: c01 at 0xfd6b914
[ 670.200887] LR = 0x1001364c
[ 670.200931]
[ 670.202255] Allocated by task 340:
[ 670.205686] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 670.205934] kmalloc_oob_memset_8+0x44/0x94 [test_kasan]
[ 670.206168] kmalloc_tests_init+0x4c/0x2d0 [test_kasan]
[ 670.206312] do_one_initcall+0x40/0x278
[ 670.206480] do_init_module+0xcc/0x59c
[ 670.206637] load_module+0x2bc4/0x320c
[ 670.206794] sys_init_module+0x114/0x138
[ 670.206937] ret_from_syscall+0x0/0x38
[ 670.206983]
[ 670.208274] Freed by task 276:
[ 670.211360] __kasan_slab_free+0x120/0x22c
[ 670.211479] kfree+0x74/0x270
[ 670.211611] single_release+0x54/0x6c
[ 670.211782] close_pdeo+0x128/0x224
[ 670.211947] proc_reg_release+0x110/0x128
[ 670.212079] __fput+0xec/0x2d4
[ 670.212202] task_work_run+0x13c/0x15c
[ 670.212368] do_notify_resume+0x3d8/0x438
[ 670.212515] do_user_signal+0x2c/0x34
[ 670.212561]
[ 670.213904] The buggy address belongs to the object at c58eae40
[ 670.213904] which belongs to the cache kmalloc-16 of size 16
[ 670.225452] The buggy address is located 1 bytes inside of
[ 670.225452] 16-byte region [c58eae40, c58eae50)
[ 670.235368] The buggy address belongs to the page:
[ 670.240155] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 670.240265] flags: 0x200(slab)
[ 670.240493] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 670.240560] page dumped because: kasan: bad access detected
[ 670.240599]
[ 670.241906] Memory state around the buggy address:
[ 670.246712] c58ead00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.253167] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.259621] >c58eae00: fb fb fc fc fb fb fc fc 00 fc fc fc fb fb fc fc
[ 670.266014] ^
[ 670.270894] c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 670.277349] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.283740]
==================================================================
[ 670.574861] kasan test: kmalloc_oob_memset_16 out-of-bounds in memset16
[ 670.574999]
==================================================================
[ 670.582162] BUG: KASAN: slab-out-of-bounds in
kmalloc_oob_memset_16+0x7c/0x94 [test_kasan]
[ 670.590260] Write of size 16 at addr c58eae81 by task exe/340
[ 670.595865]
[ 670.597448] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 670.597499] Call Trace:
[ 670.597674] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 670.597880] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 670.598053] [c5649cc0] [c0175700] memset+0x2c/0x4c
[ 670.598344] [c5649ce0] [c95d4bcc] kmalloc_oob_memset_16+0x7c/0x94
[test_kasan]
[ 670.598626] [c5649d00] [c95d5548] kmalloc_tests_init+0x50/0x2d0
[test_kasan]
[ 670.598816] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 670.599031] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 670.599234] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 670.599439] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 670.599634] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 670.599801] --- interrupt: c01 at 0xfd6b914
[ 670.599801] LR = 0x1001364c
[ 670.599847]
[ 670.601148] Allocated by task 340:
[ 670.604580] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 670.604834] kmalloc_oob_memset_16+0x44/0x94 [test_kasan]
[ 670.605070] kmalloc_tests_init+0x50/0x2d0 [test_kasan]
[ 670.605215] do_one_initcall+0x40/0x278
[ 670.605385] do_init_module+0xcc/0x59c
[ 670.605543] load_module+0x2bc4/0x320c
[ 670.605704] sys_init_module+0x114/0x138
[ 670.605851] ret_from_syscall+0x0/0x38
[ 670.605897]
[ 670.607166] Freed by task 276:
[ 670.610253] __kasan_slab_free+0x120/0x22c
[ 670.610374] kfree+0x74/0x270
[ 670.610506] single_release+0x54/0x6c
[ 670.610681] close_pdeo+0x128/0x224
[ 670.610849] proc_reg_release+0x110/0x128
[ 670.610983] __fput+0xec/0x2d4
[ 670.611107] task_work_run+0x13c/0x15c
[ 670.611275] do_notify_resume+0x3d8/0x438
[ 670.611424] do_user_signal+0x2c/0x34
[ 670.611471]
[ 670.612798] The buggy address belongs to the object at c58eae80
[ 670.612798] which belongs to the cache kmalloc-16 of size 16
[ 670.624345] The buggy address is located 1 bytes inside of
[ 670.624345] 16-byte region [c58eae80, c58eae90)
[ 670.634260] The buggy address belongs to the page:
[ 670.639048] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 670.639158] flags: 0x200(slab)
[ 670.639387] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 670.639457] page dumped because: kasan: bad access detected
[ 670.639497]
[ 670.640799] Memory state around the buggy address:
[ 670.645604] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.652058] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.658513] >c58eae80: 00 00 fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 670.664901] ^
[ 670.667978] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.674434] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.680825]
==================================================================
[ 670.693766] kasan test: kmalloc_uaf use-after-free
[ 670.693923]
==================================================================
[ 670.701091] BUG: KASAN: use-after-free in kmalloc_uaf+0x78/0x94
[test_kasan]
[ 670.707899] Write of size 1 at addr c58eaea8 by task exe/340
[ 670.713422]
[ 670.715004] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 670.715055] Call Trace:
[ 670.715229] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 670.715433] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 670.715719] [c5649ce0] [c95d450c] kmalloc_uaf+0x78/0x94 [test_kasan]
[ 670.715997] [c5649d00] [c95d554c] kmalloc_tests_init+0x54/0x2d0
[test_kasan]
[ 670.716187] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 670.716400] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 670.716601] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 670.716804] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 670.716998] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 670.717164] --- interrupt: c01 at 0xfd6b914
[ 670.717164] LR = 0x1001364c
[ 670.717209]
[ 670.718531] Allocated by task 340:
[ 670.721965] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 670.722210] kmalloc_uaf+0x44/0x94 [test_kasan]
[ 670.722446] kmalloc_tests_init+0x54/0x2d0 [test_kasan]
[ 670.722588] do_one_initcall+0x40/0x278
[ 670.722756] do_init_module+0xcc/0x59c
[ 670.722912] load_module+0x2bc4/0x320c
[ 670.723069] sys_init_module+0x114/0x138
[ 670.723213] ret_from_syscall+0x0/0x38
[ 670.723260]
[ 670.724550] Freed by task 340:
[ 670.727635] __kasan_slab_free+0x120/0x22c
[ 670.727754] kfree+0x74/0x270
[ 670.727998] kmalloc_uaf+0x70/0x94 [test_kasan]
[ 670.728233] kmalloc_tests_init+0x54/0x2d0 [test_kasan]
[ 670.728375] do_one_initcall+0x40/0x278
[ 670.728543] do_init_module+0xcc/0x59c
[ 670.728698] load_module+0x2bc4/0x320c
[ 670.728855] sys_init_module+0x114/0x138
[ 670.728998] ret_from_syscall+0x0/0x38
[ 670.729044]
[ 670.730356] The buggy address belongs to the object at c58eaea0
[ 670.730356] which belongs to the cache kmalloc-16 of size 16
[ 670.741901] The buggy address is located 8 bytes inside of
[ 670.741901] 16-byte region [c58eaea0, c58eaeb0)
[ 670.751818] The buggy address belongs to the page:
[ 670.756605] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 670.756716] flags: 0x200(slab)
[ 670.756944] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 670.757012] page dumped because: kasan: bad access detected
[ 670.757052]
[ 670.758354] Memory state around the buggy address:
[ 670.763163] c58ead80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.769616] c58eae00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.776070] >c58eae80: fb fb fc fc fb fb fc fc fb fb fc fc 00 04 fc fc
[ 670.782461] ^
[ 670.786311] c58eaf00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.792765] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 670.799157]
==================================================================
[ 671.084949] kasan test: kmalloc_uaf_memset use-after-free in memset
[ 671.085122]
==================================================================
[ 671.092328] BUG: KASAN: use-after-free in
kmalloc_tests_init+0x58/0x2d0 [test_kasan]
[ 671.099824] Write of size 33 at addr c534b0c0 by task exe/340
[ 671.105430]
[ 671.107012] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 671.107063] Call Trace:
[ 671.107238] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 671.107443] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 671.107616] [c5649ce0] [c0175700] memset+0x2c/0x4c
[ 671.107907] [c5649d00] [c95d5550] kmalloc_tests_init+0x58/0x2d0
[test_kasan]
[ 671.108098] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 671.108314] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 671.108518] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 671.108724] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 671.108918] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 671.109085] --- interrupt: c01 at 0xfd6b914
[ 671.109085] LR = 0x1001364c
[ 671.109132]
[ 671.110452] Allocated by task 340:
[ 671.113886] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 671.114137] kmalloc_uaf_memset+0x44/0x90 [test_kasan]
[ 671.114374] kmalloc_tests_init+0x58/0x2d0 [test_kasan]
[ 671.114520] do_one_initcall+0x40/0x278
[ 671.114689] do_init_module+0xcc/0x59c
[ 671.114846] load_module+0x2bc4/0x320c
[ 671.115005] sys_init_module+0x114/0x138
[ 671.115151] ret_from_syscall+0x0/0x38
[ 671.115198]
[ 671.116472] Freed by task 340:
[ 671.119559] __kasan_slab_free+0x120/0x22c
[ 671.119681] kfree+0x74/0x270
[ 671.119927] kmalloc_uaf_memset+0x70/0x90 [test_kasan]
[ 671.120167] kmalloc_tests_init+0x58/0x2d0 [test_kasan]
[ 671.120312] do_one_initcall+0x40/0x278
[ 671.120481] do_init_module+0xcc/0x59c
[ 671.120640] load_module+0x2bc4/0x320c
[ 671.120801] sys_init_module+0x114/0x138
[ 671.120945] ret_from_syscall+0x0/0x38
[ 671.120992]
[ 671.122276] The buggy address belongs to the object at c534b0c0
[ 671.122276] which belongs to the cache kmalloc-64 of size 64
[ 671.133824] The buggy address is located 0 bytes inside of
[ 671.133824] 64-byte region [c534b0c0, c534b100)
[ 671.143741] The buggy address belongs to the page:
[ 671.148527] page:c7fd9a40 count:1 mapcount:0 mapping:c5007c20 index:0x0
[ 671.148637] flags: 0x200(slab)
[ 671.148866] raw: 00000200 00000100 00000200 c5007c20 00000000
00aa0155 ffffffff 00000001
[ 671.148935] page dumped because: kasan: bad access detected
[ 671.148975]
[ 671.150277] Memory state around the buggy address:
[ 671.155084] c534af80: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
[ 671.161538] c534b000: 00 00 00 00 00 00 fc fc fc fc fc fc fb fb fb fb
[ 671.167993] >c534b080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
[ 671.174383] ^
[ 671.179007] c534b100: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
[ 671.185461] c534b180: 00 00 00 00 04 fc fc fc fc fc fc fc fb fb fb fb
[ 671.191853]
==================================================================
[ 671.204460] kasan test: kmalloc_uaf2 use-after-free after another kmalloc
[ 671.204676]
==================================================================
[ 671.211859] BUG: KASAN: use-after-free in kmalloc_uaf2+0x9c/0xd4
[test_kasan]
[ 671.218755] Write of size 1 at addr c534b088 by task exe/340
[ 671.224277]
[ 671.225860] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 671.225910] Call Trace:
[ 671.226085] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 671.226288] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 671.226574] [c5649ce0] [c95d45c4] kmalloc_uaf2+0x9c/0xd4 [test_kasan]
[ 671.226854] [c5649d00] [c95d5554] kmalloc_tests_init+0x5c/0x2d0
[test_kasan]
[ 671.227044] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 671.227257] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 671.227458] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 671.227659] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 671.227853] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 671.228018] --- interrupt: c01 at 0xfd6b914
[ 671.228018] LR = 0x1001364c
[ 671.228063]
[ 671.229387] Allocated by task 340:
[ 671.232819] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 671.233065] kmalloc_uaf2+0x48/0xd4 [test_kasan]
[ 671.233299] kmalloc_tests_init+0x5c/0x2d0 [test_kasan]
[ 671.233442] do_one_initcall+0x40/0x278
[ 671.233609] do_init_module+0xcc/0x59c
[ 671.233765] load_module+0x2bc4/0x320c
[ 671.233922] sys_init_module+0x114/0x138
[ 671.234066] ret_from_syscall+0x0/0x38
[ 671.234111]
[ 671.235407] Freed by task 340:
[ 671.238491] __kasan_slab_free+0x120/0x22c
[ 671.238609] kfree+0x74/0x270
[ 671.238851] kmalloc_uaf2+0x78/0xd4 [test_kasan]
[ 671.239085] kmalloc_tests_init+0x5c/0x2d0 [test_kasan]
[ 671.239228] do_one_initcall+0x40/0x278
[ 671.239395] do_init_module+0xcc/0x59c
[ 671.239550] load_module+0x2bc4/0x320c
[ 671.239707] sys_init_module+0x114/0x138
[ 671.239850] ret_from_syscall+0x0/0x38
[ 671.239897]
[ 671.241211] The buggy address belongs to the object at c534b060
[ 671.241211] which belongs to the cache kmalloc-64 of size 64
[ 671.252758] The buggy address is located 40 bytes inside of
[ 671.252758] 64-byte region [c534b060, c534b0a0)
[ 671.262761] The buggy address belongs to the page:
[ 671.267547] page:c7fd9a40 count:1 mapcount:0 mapping:c5007c20 index:0x0
[ 671.267657] flags: 0x200(slab)
[ 671.267885] raw: 00000200 00000100 00000200 c5007c20 00000000
00aa0155 ffffffff 00000001
[ 671.267953] page dumped because: kasan: bad access detected
[ 671.267993]
[ 671.269296] Memory state around the buggy address:
[ 671.274104] c534af80: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
[ 671.280561] c534b000: 00 00 00 00 00 00 fc fc fc fc fc fc fb fb fb fb
[ 671.287012] >c534b080: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
[ 671.293399] ^
[ 671.296220] c534b100: fc fc fc fc 00 00 00 00 04 fc fc fc fc fc fc fc
[ 671.302676] c534b180: 00 00 00 00 04 fc fc fc fc fc fc fc fb fb fb fb
[ 671.309066]
==================================================================
[ 671.597554] kasan test: kmem_cache_oob out-of-bounds in kmem_cache_alloc
[ 671.597819]
==================================================================
[ 671.604991] BUG: KASAN: slab-out-of-bounds in
kmem_cache_oob+0x9c/0xd0 [test_kasan]
[ 671.612398] Read of size 1 at addr c5e180c8 by task exe/340
[ 671.617834]
[ 671.619417] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 671.619469] Call Trace:
[ 671.619645] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 671.619848] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 671.620138] [c5649ce0] [c95d4d10] kmem_cache_oob+0x9c/0xd0 [test_kasan]
[ 671.620420] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
[test_kasan]
[ 671.620611] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 671.620826] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 671.621030] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 671.621234] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 671.621428] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 671.621596] --- interrupt: c01 at 0xfd6b914
[ 671.621596] LR = 0x1001364c
[ 671.621642]
[ 671.622944] Allocated by task 340:
[ 671.626376] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 671.626504] kmem_cache_alloc+0xf4/0x210
[ 671.626752] kmem_cache_oob+0x78/0xd0 [test_kasan]
[ 671.626989] kmalloc_tests_init+0x60/0x2d0 [test_kasan]
[ 671.627135] do_one_initcall+0x40/0x278
[ 671.627305] do_init_module+0xcc/0x59c
[ 671.627463] load_module+0x2bc4/0x320c
[ 671.627623] sys_init_module+0x114/0x138
[ 671.627769] ret_from_syscall+0x0/0x38
[ 671.627816]
[ 671.629132] Freed by task 0:
[ 671.631954] (stack is not available)
[ 671.635476]
[ 671.637007] The buggy address belongs to the object at c5e18000
[ 671.637007] which belongs to the cache test_cache of size 200
[ 671.648642] The buggy address is located 0 bytes to the right of
[ 671.648642] 200-byte region [c5e18000, c5e180c8)
[ 671.659156] The buggy address belongs to the page:
[ 671.663942] page:c7fdf0c0 count:1 mapcount:0 mapping:c540a560 index:0x0
[ 671.664054] flags: 0x200(slab)
[ 671.664283] raw: 00000200 00000100 00000200 c540a560 00000000
003e007d ffffffff 00000001
[ 671.664353] page dumped because: kasan: bad access detected
[ 671.664393]
[ 671.665694] Memory state around the buggy address:
[ 671.670501] c5e17f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 671.676954] c5e18000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 671.683409] >c5e18080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 671.689802] ^
[ 671.694680] c5e18100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 671.701137] c5e18180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 671.707528]
==================================================================
[ 671.758410]
=============================================================================
[ 671.766368] BUG test_cache (Tainted: G B ): Objects
remaining in test_cache on __kmem_cache_shutdown()
[ 671.776719]
-----------------------------------------------------------------------------
[ 671.776719]
[ 671.786325] INFO: Slab 0x(ptrval) objects=62 used=1 fp=0x(ptrval)
flags=0x0200
[ 671.793514] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 671.793563] Call Trace:
[ 671.793752] [c5649bf0] [c016ebe0] slab_err+0x98/0xac (unreliable)
[ 671.793956] [c5649c90] [c01748f4] __kmem_cache_shutdown+0x15c/0x338
[ 671.794160] [c5649cf0] [c013c3b4] kmem_cache_destroy+0x68/0x114
[ 671.794463] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
[test_kasan]
[ 671.794656] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 671.794868] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 671.795071] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 671.795275] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 671.795468] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 671.795633] --- interrupt: c01 at 0xfd6b914
[ 671.795633] LR = 0x1001364c
[ 671.795738] INFO: Object 0x(ptrval) @offset=0
[ 671.909762] kmem_cache_destroy test_cache: Slab cache still has objects
[ 671.931546] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 671.931601] Call Trace:
[ 671.931790] [c5649cf0] [c013c45c] kmem_cache_destroy+0x110/0x114
(unreliable)
[ 671.932116] [c5649d00] [c95d5558] kmalloc_tests_init+0x60/0x2d0
[test_kasan]
[ 671.932310] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 671.932526] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 671.932730] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 671.932934] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 671.933130] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 671.933300] --- interrupt: c01 at 0xfd6b914
[ 671.933300] LR = 0x1001364c
[ 671.952750] kasan test: memcg_accounted_kmem_cache allocate memcg
accounted object
[ 672.556766] kasan test: kasan_stack_oob out-of-bounds on stack
[ 672.556850] kasan test: kasan_global_oob out-of-bounds global variable
[ 672.556922] kasan test: kasan_alloca_oob_left out-of-bounds to left
on alloca
[ 672.556995] kasan test: kasan_alloca_oob_right out-of-bounds to right
on alloca
[ 672.557070] kasan test: ksize_unpoisons_memory ksize() unpoisons the
whole allocated chunk
[ 672.557200]
==================================================================
[ 672.564395] BUG: KASAN: slab-out-of-bounds in
ksize_unpoisons_memory+0x8c/0xac [test_kasan]
[ 672.572578] Write of size 1 at addr c539ab40 by task exe/340
[ 672.578098]
[ 672.579682] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 672.579734] Call Trace:
[ 672.579909] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 672.580114] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 672.580406] [c5649ce0] [c95d5100] ksize_unpoisons_memory+0x8c/0xac
[test_kasan]
[ 672.580689] [c5649d00] [c95d5570] kmalloc_tests_init+0x78/0x2d0
[test_kasan]
[ 672.580880] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 672.581096] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 672.581299] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 672.581503] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 672.581697] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 672.581864] --- interrupt: c01 at 0xfd6b914
[ 672.581864] LR = 0x1001364c
[ 672.581910]
[ 672.583208] Allocated by task 340:
[ 672.586642] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 672.586892] ksize_unpoisons_memory+0x44/0xac [test_kasan]
[ 672.587129] kmalloc_tests_init+0x78/0x2d0 [test_kasan]
[ 672.587275] do_one_initcall+0x40/0x278
[ 672.587445] do_init_module+0xcc/0x59c
[ 672.587602] load_module+0x2bc4/0x320c
[ 672.587761] sys_init_module+0x114/0x138
[ 672.587906] ret_from_syscall+0x0/0x38
[ 672.587953]
[ 672.589227] Freed by task 338:
[ 672.592316] __kasan_slab_free+0x120/0x22c
[ 672.592437] kfree+0x74/0x270
[ 672.592602] load_elf_binary+0xb0/0x162c
[ 672.592782] search_binary_handler+0x120/0x374
[ 672.592950] __do_execve_file+0x834/0xb20
[ 672.593114] sys_execve+0x40/0x54
[ 672.593259] ret_from_syscall+0x0/0x38
[ 672.593307]
[ 672.594603] The buggy address belongs to the object at c539aac0
[ 672.594603] which belongs to the cache kmalloc-128 of size 128
[ 672.606324] The buggy address is located 0 bytes to the right of
[ 672.606324] 128-byte region [c539aac0, c539ab40)
[ 672.616840] The buggy address belongs to the page:
[ 672.621625] page:c7fd9cc0 count:1 mapcount:0 mapping:c5007a80 index:0x0
[ 672.621738] flags: 0x200(slab)
[ 672.621967] raw: 00000200 00000100 00000200 c5007a80 00000000
005500ab ffffffff 00000001
[ 672.622038] page dumped because: kasan: bad access detected
[ 672.622077]
[ 672.623375] Memory state around the buggy address:
[ 672.628183] c539aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 672.634637] c539aa80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 672.641090] >c539ab00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 672.647483] ^
[ 672.652106] c539ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 672.658562] c539ac00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[ 672.664951]
==================================================================
[ 672.814421] kasan test: copy_user_test out-of-bounds in copy_from_user()
[ 672.814499]
==================================================================
[ 672.821643] BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x48/0xc4
[ 672.828089] Write of size 11 at addr c58eb020 by task exe/340
[ 672.833699]
[ 672.835280] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 672.835331] Call Trace:
[ 672.835504] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 672.835708] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 672.835929] [c5649cc0] [c0307be0] _copy_from_user+0x48/0xc4
[ 672.836230] [c5649ce0] [c95d51b4] copy_user_test+0x94/0x1bc [test_kasan]
[ 672.836512] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 672.836703] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 672.836917] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 672.837121] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 672.837326] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 672.837522] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 672.837687] --- interrupt: c01 at 0xfd6b914
[ 672.837687] LR = 0x1001364c
[ 672.837733]
[ 672.839067] Allocated by task 340:
[ 672.842500] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 672.842749] copy_user_test+0x28/0x1bc [test_kasan]
[ 672.842985] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 672.843131] do_one_initcall+0x40/0x278
[ 672.843301] do_init_module+0xcc/0x59c
[ 672.843458] load_module+0x2bc4/0x320c
[ 672.843619] sys_init_module+0x114/0x138
[ 672.843764] ret_from_syscall+0x0/0x38
[ 672.843812]
[ 672.845085] Freed by task 276:
[ 672.848173] __kasan_slab_free+0x120/0x22c
[ 672.848295] kfree+0x74/0x270
[ 672.848427] single_release+0x54/0x6c
[ 672.848601] close_pdeo+0x128/0x224
[ 672.848768] proc_reg_release+0x110/0x128
[ 672.848903] __fput+0xec/0x2d4
[ 672.849028] task_work_run+0x13c/0x15c
[ 672.849197] do_notify_resume+0x3d8/0x438
[ 672.849346] do_user_signal+0x2c/0x34
[ 672.849393]
[ 672.850719] The buggy address belongs to the object at c58eb020
[ 672.850719] which belongs to the cache kmalloc-16 of size 16
[ 672.862264] The buggy address is located 0 bytes inside of
[ 672.862264] 16-byte region [c58eb020, c58eb030)
[ 672.872182] The buggy address belongs to the page:
[ 672.876968] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 672.877079] flags: 0x200(slab)
[ 672.877309] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 672.877377] page dumped because: kasan: bad access detected
[ 672.877418]
[ 672.878717] Memory state around the buggy address:
[ 672.883527] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 672.889979] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 672.896433] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 672.902824] ^
[ 672.906673] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 672.913129] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 672.919520]
==================================================================
[ 672.932289] kasan test: copy_user_test out-of-bounds in copy_to_user()
[ 672.932363]
==================================================================
[ 672.939457] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x9c/0xbc
[ 672.945733] Read of size 11 at addr c58eb020 by task exe/340
[ 672.951255]
[ 672.952840] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 672.952890] Call Trace:
[ 672.953061] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 672.953264] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 672.953480] [c5649cc0] [c0307cf8] _copy_to_user+0x9c/0xbc
[ 672.953781] [c5649ce0] [c95d51d4] copy_user_test+0xb4/0x1bc [test_kasan]
[ 672.954060] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 672.954249] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 672.954461] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 672.954662] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 672.954866] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 672.955058] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 672.955224] --- interrupt: c01 at 0xfd6b914
[ 672.955224] LR = 0x1001364c
[ 672.955269]
[ 672.956538] Allocated by task 340:
[ 672.959969] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 672.960219] copy_user_test+0x28/0x1bc [test_kasan]
[ 672.960454] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 672.960597] do_one_initcall+0x40/0x278
[ 672.960766] do_init_module+0xcc/0x59c
[ 672.960924] load_module+0x2bc4/0x320c
[ 672.961081] sys_init_module+0x114/0x138
[ 672.961226] ret_from_syscall+0x0/0x38
[ 672.961272]
[ 672.962558] Freed by task 276:
[ 672.965645] __kasan_slab_free+0x120/0x22c
[ 672.965764] kfree+0x74/0x270
[ 672.965896] single_release+0x54/0x6c
[ 672.966070] close_pdeo+0x128/0x224
[ 672.966236] proc_reg_release+0x110/0x128
[ 672.966369] __fput+0xec/0x2d4
[ 672.966493] task_work_run+0x13c/0x15c
[ 672.966660] do_notify_resume+0x3d8/0x438
[ 672.966809] do_user_signal+0x2c/0x34
[ 672.966855]
[ 672.968190] The buggy address belongs to the object at c58eb020
[ 672.968190] which belongs to the cache kmalloc-16 of size 16
[ 672.979735] The buggy address is located 0 bytes inside of
[ 672.979735] 16-byte region [c58eb020, c58eb030)
[ 672.989653] The buggy address belongs to the page:
[ 672.994439] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 672.994550] flags: 0x200(slab)
[ 672.994778] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 672.994845] page dumped because: kasan: bad access detected
[ 672.994885]
[ 672.996188] Memory state around the buggy address:
[ 673.000996] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 673.007450] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.013904] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 673.020295] ^
[ 673.024144] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.030600] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.036990]
==================================================================
[ 673.327457] kasan test: copy_user_test out-of-bounds in
__copy_from_user()
[ 673.327537]
==================================================================
[ 673.334723] BUG: KASAN: slab-out-of-bounds in
copy_user_test+0xd0/0x1bc [test_kasan]
[ 673.342217] Write of size 11 at addr c58eb020 by task exe/340
[ 673.347825]
[ 673.349408] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 673.349459] Call Trace:
[ 673.349637] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 673.349842] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 673.350130] [c5649ce0] [c95d51f0] copy_user_test+0xd0/0x1bc [test_kasan]
[ 673.350412] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 673.350605] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 673.350821] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 673.351025] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 673.351231] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 673.351426] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 673.351592] --- interrupt: c01 at 0xfd6b914
[ 673.351592] LR = 0x1001364c
[ 673.351638]
[ 673.352936] Allocated by task 340:
[ 673.356367] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 673.356619] copy_user_test+0x28/0x1bc [test_kasan]
[ 673.356855] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 673.357000] do_one_initcall+0x40/0x278
[ 673.357168] do_init_module+0xcc/0x59c
[ 673.357324] load_module+0x2bc4/0x320c
[ 673.357483] sys_init_module+0x114/0x138
[ 673.357626] ret_from_syscall+0x0/0x38
[ 673.357673]
[ 673.358954] Freed by task 276:
[ 673.362040] __kasan_slab_free+0x120/0x22c
[ 673.362161] kfree+0x74/0x270
[ 673.362293] single_release+0x54/0x6c
[ 673.362465] close_pdeo+0x128/0x224
[ 673.362632] proc_reg_release+0x110/0x128
[ 673.362764] __fput+0xec/0x2d4
[ 673.362888] task_work_run+0x13c/0x15c
[ 673.363057] do_notify_resume+0x3d8/0x438
[ 673.363208] do_user_signal+0x2c/0x34
[ 673.363256]
[ 673.364587] The buggy address belongs to the object at c58eb020
[ 673.364587] which belongs to the cache kmalloc-16 of size 16
[ 673.376132] The buggy address is located 0 bytes inside of
[ 673.376132] 16-byte region [c58eb020, c58eb030)
[ 673.386050] The buggy address belongs to the page:
[ 673.390836] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 673.390947] flags: 0x200(slab)
[ 673.391175] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 673.391245] page dumped because: kasan: bad access detected
[ 673.391285]
[ 673.392585] Memory state around the buggy address:
[ 673.397393] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 673.403847] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.410301] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 673.416691] ^
[ 673.420541] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.426997] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.433387]
==================================================================
[ 673.446960] kasan test: copy_user_test out-of-bounds in __copy_to_user()
[ 673.447031]
==================================================================
[ 673.454258] BUG: KASAN: slab-out-of-bounds in
copy_user_test+0xfc/0x1bc [test_kasan]
[ 673.461753] Read of size 11 at addr c58eb020 by task exe/340
[ 673.467275]
[ 673.468858] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 673.468909] Call Trace:
[ 673.469084] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 673.469286] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 673.469573] [c5649ce0] [c95d521c] copy_user_test+0xfc/0x1bc [test_kasan]
[ 673.469851] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 673.470042] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 673.470256] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 673.470457] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 673.470660] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 673.470853] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 673.471019] --- interrupt: c01 at 0xfd6b914
[ 673.471019] LR = 0x1001364c
[ 673.471064]
[ 673.472385] Allocated by task 340:
[ 673.475818] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 673.476065] copy_user_test+0x28/0x1bc [test_kasan]
[ 673.476301] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 673.476444] do_one_initcall+0x40/0x278
[ 673.476612] do_init_module+0xcc/0x59c
[ 673.476768] load_module+0x2bc4/0x320c
[ 673.476925] sys_init_module+0x114/0x138
[ 673.477067] ret_from_syscall+0x0/0x38
[ 673.477113]
[ 673.478403] Freed by task 276:
[ 673.481490] __kasan_slab_free+0x120/0x22c
[ 673.481610] kfree+0x74/0x270
[ 673.481740] single_release+0x54/0x6c
[ 673.481911] close_pdeo+0x128/0x224
[ 673.482077] proc_reg_release+0x110/0x128
[ 673.482209] __fput+0xec/0x2d4
[ 673.482331] task_work_run+0x13c/0x15c
[ 673.482500] do_notify_resume+0x3d8/0x438
[ 673.482648] do_user_signal+0x2c/0x34
[ 673.482694]
[ 673.484036] The buggy address belongs to the object at c58eb020
[ 673.484036] which belongs to the cache kmalloc-16 of size 16
[ 673.495583] The buggy address is located 0 bytes inside of
[ 673.495583] 16-byte region [c58eb020, c58eb030)
[ 673.505500] The buggy address belongs to the page:
[ 673.510287] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 673.510396] flags: 0x200(slab)
[ 673.510622] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 673.510690] page dumped because: kasan: bad access detected
[ 673.510729]
[ 673.512037] Memory state around the buggy address:
[ 673.516842] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 673.523297] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.529751] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 673.536142] ^
[ 673.539991] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.546447] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.552838]
==================================================================
[ 673.835827] kasan test: copy_user_test out-of-bounds in
__copy_from_user_inatomic()
[ 673.835905]
==================================================================
[ 673.843082] BUG: KASAN: slab-out-of-bounds in
copy_user_test+0x128/0x1bc [test_kasan]
[ 673.850662] Write of size 11 at addr c58eb020 by task exe/340
[ 673.856272]
[ 673.857853] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 673.857905] Call Trace:
[ 673.858080] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 673.858285] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 673.858574] [c5649ce0] [c95d5248] copy_user_test+0x128/0x1bc [test_kasan]
[ 673.858855] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 673.859046] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 673.859261] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 673.859463] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 673.859668] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 673.859863] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 673.860029] --- interrupt: c01 at 0xfd6b914
[ 673.860029] LR = 0x1001364c
[ 673.860075]
[ 673.861380] Allocated by task 340:
[ 673.864812] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 673.865062] copy_user_test+0x28/0x1bc [test_kasan]
[ 673.865299] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 673.865444] do_one_initcall+0x40/0x278
[ 673.865615] do_init_module+0xcc/0x59c
[ 673.865773] load_module+0x2bc4/0x320c
[ 673.865932] sys_init_module+0x114/0x138
[ 673.866077] ret_from_syscall+0x0/0x38
[ 673.866123]
[ 673.867399] Freed by task 276:
[ 673.870488] __kasan_slab_free+0x120/0x22c
[ 673.870609] kfree+0x74/0x270
[ 673.870741] single_release+0x54/0x6c
[ 673.870913] close_pdeo+0x128/0x224
[ 673.871080] proc_reg_release+0x110/0x128
[ 673.871213] __fput+0xec/0x2d4
[ 673.871337] task_work_run+0x13c/0x15c
[ 673.871506] do_notify_resume+0x3d8/0x438
[ 673.871655] do_user_signal+0x2c/0x34
[ 673.871702]
[ 673.873032] The buggy address belongs to the object at c58eb020
[ 673.873032] which belongs to the cache kmalloc-16 of size 16
[ 673.884578] The buggy address is located 0 bytes inside of
[ 673.884578] 16-byte region [c58eb020, c58eb030)
[ 673.894494] The buggy address belongs to the page:
[ 673.899282] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 673.899395] flags: 0x200(slab)
[ 673.899625] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 673.899694] page dumped because: kasan: bad access detected
[ 673.899734]
[ 673.901033] Memory state around the buggy address:
[ 673.905838] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 673.912293] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.918748] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 673.925136] ^
[ 673.928987] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.935442] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 673.941833]
==================================================================
[ 673.954463] kasan test: copy_user_test out-of-bounds in
__copy_to_user_inatomic()
[ 673.954535]
==================================================================
[ 673.961759] BUG: KASAN: slab-out-of-bounds in
copy_user_test+0x154/0x1bc [test_kasan]
[ 673.969339] Read of size 11 at addr c58eb020 by task exe/340
[ 673.974860]
[ 673.976444] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 673.976494] Call Trace:
[ 673.976668] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 673.976870] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 673.977160] [c5649ce0] [c95d5274] copy_user_test+0x154/0x1bc [test_kasan]
[ 673.977439] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 673.977630] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 673.977843] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 673.978045] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 673.978249] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 673.978441] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 673.978607] --- interrupt: c01 at 0xfd6b914
[ 673.978607] LR = 0x1001364c
[ 673.978651]
[ 673.979971] Allocated by task 340:
[ 673.983401] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 673.983650] copy_user_test+0x28/0x1bc [test_kasan]
[ 673.983885] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 673.984030] do_one_initcall+0x40/0x278
[ 673.984198] do_init_module+0xcc/0x59c
[ 673.984354] load_module+0x2bc4/0x320c
[ 673.984512] sys_init_module+0x114/0x138
[ 673.984655] ret_from_syscall+0x0/0x38
[ 673.984701]
[ 673.985990] Freed by task 276:
[ 673.989077] __kasan_slab_free+0x120/0x22c
[ 673.989197] kfree+0x74/0x270
[ 673.989327] single_release+0x54/0x6c
[ 673.989499] close_pdeo+0x128/0x224
[ 673.989664] proc_reg_release+0x110/0x128
[ 673.989796] __fput+0xec/0x2d4
[ 673.989918] task_work_run+0x13c/0x15c
[ 673.990086] do_notify_resume+0x3d8/0x438
[ 673.990235] do_user_signal+0x2c/0x34
[ 673.990281]
[ 673.991622] The buggy address belongs to the object at c58eb020
[ 673.991622] which belongs to the cache kmalloc-16 of size 16
[ 674.003168] The buggy address is located 0 bytes inside of
[ 674.003168] 16-byte region [c58eb020, c58eb030)
[ 674.013086] The buggy address belongs to the page:
[ 674.017872] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 674.017982] flags: 0x200(slab)
[ 674.018210] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 674.018277] page dumped because: kasan: bad access detected
[ 674.018316]
[ 674.019622] Memory state around the buggy address:
[ 674.024429] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 674.030883] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.037338] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 674.043727] ^
[ 674.047578] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.054034] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.060424]
==================================================================
[ 674.346609] kasan test: copy_user_test out-of-bounds in
strncpy_from_user()
[ 674.346689]
==================================================================
[ 674.353778] BUG: KASAN: slab-out-of-bounds in
strncpy_from_user+0x48/0x240
[ 674.360487] Write of size 11 at addr c58eb020 by task exe/340
[ 674.366094]
[ 674.367678] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 674.367731] Call Trace:
[ 674.367904] [c5649c40] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 674.368108] [c5649c70] [c0176d34] kasan_report+0xe4/0x168
[ 674.368323] [c5649cb0] [c03202f8] strncpy_from_user+0x48/0x240
[ 674.368627] [c5649ce0] [c95d52a4] copy_user_test+0x184/0x1bc [test_kasan]
[ 674.368908] [c5649d00] [c95d5574] kmalloc_tests_init+0x7c/0x2d0
[test_kasan]
[ 674.369100] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 674.369315] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 674.369518] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 674.369724] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 674.369919] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 674.370086] --- interrupt: c01 at 0xfd6b914
[ 674.370086] LR = 0x1001364c
[ 674.370132]
[ 674.371463] Allocated by task 340:
[ 674.374894] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 674.375146] copy_user_test+0x28/0x1bc [test_kasan]
[ 674.375383] kmalloc_tests_init+0x7c/0x2d0 [test_kasan]
[ 674.375527] do_one_initcall+0x40/0x278
[ 674.375697] do_init_module+0xcc/0x59c
[ 674.375854] load_module+0x2bc4/0x320c
[ 674.376015] sys_init_module+0x114/0x138
[ 674.376162] ret_from_syscall+0x0/0x38
[ 674.376209]
[ 674.377481] Freed by task 276:
[ 674.380568] __kasan_slab_free+0x120/0x22c
[ 674.380691] kfree+0x74/0x270
[ 674.380824] single_release+0x54/0x6c
[ 674.380998] close_pdeo+0x128/0x224
[ 674.381165] proc_reg_release+0x110/0x128
[ 674.381299] __fput+0xec/0x2d4
[ 674.381424] task_work_run+0x13c/0x15c
[ 674.381592] do_notify_resume+0x3d8/0x438
[ 674.381743] do_user_signal+0x2c/0x34
[ 674.381792]
[ 674.383113] The buggy address belongs to the object at c58eb020
[ 674.383113] which belongs to the cache kmalloc-16 of size 16
[ 674.394659] The buggy address is located 0 bytes inside of
[ 674.394659] 16-byte region [c58eb020, c58eb030)
[ 674.404577] The buggy address belongs to the page:
[ 674.409363] page:c7fdc740 count:1 mapcount:0 mapping:c5007dc0 index:0x0
[ 674.409474] flags: 0x200(slab)
[ 674.409703] raw: 00000200 00000100 00000200 c5007dc0 00000000
02000401 ffffffff 00000001
[ 674.409772] page dumped because: kasan: bad access detected
[ 674.409812]
[ 674.411112] Memory state around the buggy address:
[ 674.415920] c58eaf00: 00 00 fc fc 00 00 fc fc 00 00 fc fc fb fb fc fc
[ 674.422374] c58eaf80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.428827] >c58eb000: fb fb fc fc 00 02 fc fc fb fb fc fc fb fb fc fc
[ 674.435218] ^
[ 674.439067] c58eb080: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.445524] c58eb100: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
[ 674.451914]
==================================================================
[ 674.466513] kasan test: use_after_scope_test use-after-scope on int
[ 674.466592] kasan test: use_after_scope_test use-after-scope on array
[ 674.470775] kasan test: kmem_cache_double_free double-free on heap object
[ 674.471059]
==================================================================
[ 674.478286] BUG: KASAN: double-free or invalid-free in
kmem_cache_double_free+0xac/0xc4 [test_kasan]
[ 674.487095]
[ 674.488679] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 674.488730] Call Trace:
[ 674.488906] [c5649b30] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 674.489118] [c5649b60] [c0176c24] kasan_report_invalid_free+0x48/0x74
[ 674.489296] [c5649b90] [c0175620] __kasan_slab_free+0x198/0x22c
[ 674.489467] [c5649cc0] [c0173838] kmem_cache_free+0x64/0x228
[ 674.489754] [c5649ce0] [c95d4df0] kmem_cache_double_free+0xac/0xc4
[test_kasan]
[ 674.490029] [c5649d00] [c95d557c] kmalloc_tests_init+0x84/0x2d0
[test_kasan]
[ 674.490219] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 674.490432] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 674.490633] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 674.490837] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 674.491031] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 674.491194] --- interrupt: c01 at 0xfd6b914
[ 674.491194] LR = 0x1001364c
[ 674.491239]
[ 674.492547] Allocated by task 340:
[ 674.495981] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 674.496108] kmem_cache_alloc+0xf4/0x210
[ 674.496355] kmem_cache_double_free+0x78/0xc4 [test_kasan]
[ 674.496584] kmalloc_tests_init+0x84/0x2d0 [test_kasan]
[ 674.496727] do_one_initcall+0x40/0x278
[ 674.496893] do_init_module+0xcc/0x59c
[ 674.497050] load_module+0x2bc4/0x320c
[ 674.497208] sys_init_module+0x114/0x138
[ 674.497354] ret_from_syscall+0x0/0x38
[ 674.497400]
[ 674.498652] Freed by task 340:
[ 674.501739] __kasan_slab_free+0x120/0x22c
[ 674.501866] kmem_cache_free+0x64/0x228
[ 674.502112] kmem_cache_double_free+0xa0/0xc4 [test_kasan]
[ 674.502340] kmalloc_tests_init+0x84/0x2d0 [test_kasan]
[ 674.502483] do_one_initcall+0x40/0x278
[ 674.502650] do_init_module+0xcc/0x59c
[ 674.502807] load_module+0x2bc4/0x320c
[ 674.502966] sys_init_module+0x114/0x138
[ 674.503112] ret_from_syscall+0x0/0x38
[ 674.503158]
[ 674.504460] The buggy address belongs to the object at c5528000
[ 674.504460] which belongs to the cache test_cache of size 200
[ 674.516091] The buggy address is located 0 bytes inside of
[ 674.516091] 200-byte region [c5528000, c55280c8)
[ 674.526092] The buggy address belongs to the page:
[ 674.530877] page:c7fda940 count:1 mapcount:0 mapping:c540a700 index:0x0
[ 674.530988] flags: 0x200(slab)
[ 674.531216] raw: 00000200 00000100 00000200 c540a700 00000000
003e007d ffffffff 00000001
[ 674.531284] page dumped because: kasan: bad access detected
[ 674.531323]
[ 674.532630] Memory state around the buggy address:
[ 674.537436] c5527f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 674.543890] c5527f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 674.550345] >c5528000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 674.556731] ^
[ 674.559293] c5528080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[ 674.565750] c5528100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 674.572138]
==================================================================
[ 674.880790] kasan test: kmem_cache_invalid_free invalid-free of heap
object
[ 674.881044]
==================================================================
[ 674.888197] BUG: KASAN: double-free or invalid-free in
kmem_cache_invalid_free+0xa0/0xc4 [test_kasan]
[ 674.897089]
[ 674.898670] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 674.898722] Call Trace:
[ 674.898899] [c5649b30] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 674.899113] [c5649b60] [c0176c24] kasan_report_invalid_free+0x48/0x74
[ 674.899293] [c5649b90] [c0175620] __kasan_slab_free+0x198/0x22c
[ 674.899467] [c5649cc0] [c0173838] kmem_cache_free+0x64/0x228
[ 674.899756] [c5649ce0] [c95d4ea8] kmem_cache_invalid_free+0xa0/0xc4
[test_kasan]
[ 674.900031] [c5649d00] [c95d5580] kmalloc_tests_init+0x88/0x2d0
[test_kasan]
[ 674.900222] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 674.900437] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 674.900639] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 674.900845] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 674.901040] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 674.901206] --- interrupt: c01 at 0xfd6b914
[ 674.901206] LR = 0x1001364c
[ 674.901251]
[ 674.902542] Allocated by task 340:
[ 674.905975] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 674.906103] kmem_cache_alloc+0xf4/0x210
[ 674.906351] kmem_cache_invalid_free+0x78/0xc4 [test_kasan]
[ 674.906584] kmalloc_tests_init+0x88/0x2d0 [test_kasan]
[ 674.906730] do_one_initcall+0x40/0x278
[ 674.906899] do_init_module+0xcc/0x59c
[ 674.907056] load_module+0x2bc4/0x320c
[ 674.907217] sys_init_module+0x114/0x138
[ 674.907364] ret_from_syscall+0x0/0x38
[ 674.907411]
[ 674.908731] Freed by task 0:
[ 674.911551] (stack is not available)
[ 674.915074]
[ 674.916605] The buggy address belongs to the object at c5528000
[ 674.916605] which belongs to the cache test_cache of size 200
[ 674.928237] The buggy address is located 1 bytes inside of
[ 674.928237] 200-byte region [c5528000, c55280c8)
[ 674.938237] The buggy address belongs to the page:
[ 674.943024] page:c7fda940 count:1 mapcount:0 mapping:c540a7d0 index:0x0
[ 674.943136] flags: 0x200(slab)
[ 674.943365] raw: 00000200 00000100 00000200 c540a7d0 00000000
003e007d ffffffff 00000001
[ 674.943434] page dumped because: kasan: bad access detected
[ 674.943475]
[ 674.944775] Memory state around the buggy address:
[ 674.949581] c5527f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 674.956036] c5527f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 674.962491] >c5528000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 674.968876] ^
[ 674.971438] c5528080: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 674.977895] c5528100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 674.984285]
==================================================================
[ 675.126818] kasan test: kasan_memchr out-of-bounds in memchr
[ 675.126994] kasan test: kasan_memcmp out-of-bounds in memcmp
[ 675.127158] kasan test: kasan_strings use-after-free in strchr
[ 675.127309]
==================================================================
[ 675.134382] BUG: KASAN: use-after-free in strchr+0x1c/0x80
[ 675.139762] Read of size 1 at addr c53e8e20 by task exe/340
[ 675.145200]
[ 675.146784] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 675.146836] Call Trace:
[ 675.147010] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 675.147215] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 675.147385] [c5649cc0] [c072ec4c] strchr+0x1c/0x80
[ 675.147684] [c5649ce0] [c95d5440] kasan_strings+0x60/0x118 [test_kasan]
[ 675.147966] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
[test_kasan]
[ 675.148157] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 675.148372] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 675.148577] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 675.148781] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 675.148976] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 675.149143] --- interrupt: c01 at 0xfd6b914
[ 675.149143] LR = 0x1001364c
[ 675.149189]
[ 675.150483] Allocated by task 340:
[ 675.153915] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 675.154163] kasan_strings+0x44/0x118 [test_kasan]
[ 675.154400] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.154545] do_one_initcall+0x40/0x278
[ 675.154714] do_init_module+0xcc/0x59c
[ 675.154872] load_module+0x2bc4/0x320c
[ 675.155033] sys_init_module+0x114/0x138
[ 675.155179] ret_from_syscall+0x0/0x38
[ 675.155225]
[ 675.156501] Freed by task 340:
[ 675.159587] __kasan_slab_free+0x120/0x22c
[ 675.159709] kfree+0x74/0x270
[ 675.159954] kasan_strings+0x54/0x118 [test_kasan]
[ 675.160191] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.160337] do_one_initcall+0x40/0x278
[ 675.160508] do_init_module+0xcc/0x59c
[ 675.160667] load_module+0x2bc4/0x320c
[ 675.160828] sys_init_module+0x114/0x138
[ 675.160973] ret_from_syscall+0x0/0x38
[ 675.161019]
[ 675.162306] The buggy address belongs to the object at c53e8e10
[ 675.162306] which belongs to the cache kmalloc-32 of size 32
[ 675.173853] The buggy address is located 16 bytes inside of
[ 675.173853] 32-byte region [c53e8e10, c53e8e30)
[ 675.183856] The buggy address belongs to the page:
[ 675.188642] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 675.188753] flags: 0x200(slab)
[ 675.188982] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 675.189051] page dumped because: kasan: bad access detected
[ 675.189091]
[ 675.190392] Memory state around the buggy address:
[ 675.195199] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
[ 675.201653] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
[ 675.208108] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
[ 675.214497] ^
[ 675.218089] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 675.224544] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
[ 675.230935]
==================================================================
[ 675.383353] kasan test: kasan_strings use-after-free in strrchr
[ 675.383430]
==================================================================
[ 675.390498] BUG: KASAN: use-after-free in strrchr+0x30/0x64
[ 675.395964] Read of size 1 at addr c53e8e20 by task exe/340
[ 675.401403]
[ 675.402986] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 675.403038] Call Trace:
[ 675.403212] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 675.403415] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 675.403587] [c5649cc0] [c072ed48] strrchr+0x30/0x64
[ 675.403888] [c5649ce0] [c95d545c] kasan_strings+0x7c/0x118 [test_kasan]
[ 675.404170] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
[test_kasan]
[ 675.404362] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 675.404576] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 675.404779] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 675.404983] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 675.405177] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 675.405344] --- interrupt: c01 at 0xfd6b914
[ 675.405344] LR = 0x1001364c
[ 675.405390]
[ 675.406684] Allocated by task 340:
[ 675.410118] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 675.410366] kasan_strings+0x44/0x118 [test_kasan]
[ 675.410603] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.410750] do_one_initcall+0x40/0x278
[ 675.410919] do_init_module+0xcc/0x59c
[ 675.411078] load_module+0x2bc4/0x320c
[ 675.411238] sys_init_module+0x114/0x138
[ 675.411384] ret_from_syscall+0x0/0x38
[ 675.411430]
[ 675.412704] Freed by task 340:
[ 675.415789] __kasan_slab_free+0x120/0x22c
[ 675.415910] kfree+0x74/0x270
[ 675.416155] kasan_strings+0x54/0x118 [test_kasan]
[ 675.416391] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.416537] do_one_initcall+0x40/0x278
[ 675.416706] do_init_module+0xcc/0x59c
[ 675.416865] load_module+0x2bc4/0x320c
[ 675.417024] sys_init_module+0x114/0x138
[ 675.417169] ret_from_syscall+0x0/0x38
[ 675.417215]
[ 675.418509] The buggy address belongs to the object at c53e8e10
[ 675.418509] which belongs to the cache kmalloc-32 of size 32
[ 675.430055] The buggy address is located 16 bytes inside of
[ 675.430055] 32-byte region [c53e8e10, c53e8e30)
[ 675.440057] The buggy address belongs to the page:
[ 675.444844] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 675.444955] flags: 0x200(slab)
[ 675.445184] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 675.445253] page dumped because: kasan: bad access detected
[ 675.445293]
[ 675.446595] Memory state around the buggy address:
[ 675.451401] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
[ 675.457856] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
[ 675.464310] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
[ 675.470698] ^
[ 675.474291] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 675.480747] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
[ 675.487138]
==================================================================
[ 675.500419] kasan test: kasan_strings use-after-free in strcmp
[ 675.500491]
==================================================================
[ 675.507536] BUG: KASAN: use-after-free in strcmp+0x30/0x90
[ 675.512918] Read of size 1 at addr c53e8e20 by task exe/340
[ 675.518358]
[ 675.519942] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 675.519994] Call Trace:
[ 675.520167] [c5649c50] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 675.520369] [c5649c80] [c0176d34] kasan_report+0xe4/0x168
[ 675.520536] [c5649cc0] [c072ebd0] strcmp+0x30/0x90
[ 675.520833] [c5649ce0] [c95d5480] kasan_strings+0xa0/0x118 [test_kasan]
[ 675.521113] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
[test_kasan]
[ 675.521303] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 675.521514] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 675.521716] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 675.521919] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 675.522111] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 675.522275] --- interrupt: c01 at 0xfd6b914
[ 675.522275] LR = 0x1001364c
[ 675.522320]
[ 675.523640] Allocated by task 340:
[ 675.527073] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 675.527321] kasan_strings+0x44/0x118 [test_kasan]
[ 675.527556] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.527699] do_one_initcall+0x40/0x278
[ 675.527867] do_init_module+0xcc/0x59c
[ 675.528024] load_module+0x2bc4/0x320c
[ 675.528182] sys_init_module+0x114/0x138
[ 675.528327] ret_from_syscall+0x0/0x38
[ 675.528373]
[ 675.529658] Freed by task 340:
[ 675.532745] __kasan_slab_free+0x120/0x22c
[ 675.532865] kfree+0x74/0x270
[ 675.533109] kasan_strings+0x54/0x118 [test_kasan]
[ 675.533343] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.533486] do_one_initcall+0x40/0x278
[ 675.533654] do_init_module+0xcc/0x59c
[ 675.533810] load_module+0x2bc4/0x320c
[ 675.533967] sys_init_module+0x114/0x138
[ 675.534112] ret_from_syscall+0x0/0x38
[ 675.534157]
[ 675.535463] The buggy address belongs to the object at c53e8e10
[ 675.535463] which belongs to the cache kmalloc-32 of size 32
[ 675.547010] The buggy address is located 16 bytes inside of
[ 675.547010] 32-byte region [c53e8e10, c53e8e30)
[ 675.557012] The buggy address belongs to the page:
[ 675.561799] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 675.561909] flags: 0x200(slab)
[ 675.562137] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 675.562204] page dumped because: kasan: bad access detected
[ 675.562243]
[ 675.563549] Memory state around the buggy address:
[ 675.568356] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
[ 675.574809] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
[ 675.581265] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
[ 675.587653] ^
[ 675.591247] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 675.597702] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
[ 675.604091]
==================================================================
[ 675.894391] kasan test: kasan_strings use-after-free in strncmp
[ 675.894468] kasan test: kasan_strings use-after-free in strlen
[ 675.894536] kasan test: kasan_strings use-after-free in strnlen
[ 675.894600]
==================================================================
[ 675.901698] BUG: KASAN: use-after-free in strnlen+0x24/0x88
[ 675.907165] Read of size 1 at addr c53e8e20 by task exe/340
[ 675.912603]
[ 675.914186] CPU: 0 PID: 340 Comm: exe Tainted: G B
5.0.0-rc2-s3k-dev-00559-g88aa407c4bce-dirty #778
[ 675.914237] Call Trace:
[ 675.914412] [c5649c70] [c0176998]
print_address_description+0x6c/0x2b0 (unreliable)
[ 675.914617] [c5649ca0] [c0176d34] kasan_report+0xe4/0x168
[ 675.914788] [c5649ce0] [c072eeb4] strnlen+0x24/0x88
[ 675.915091] [c5649d00] [c95d558c] kmalloc_tests_init+0x94/0x2d0
[test_kasan]
[ 675.915283] [c5649d10] [c0003a44] do_one_initcall+0x40/0x278
[ 675.915497] [c5649d80] [c00b2bc0] do_init_module+0xcc/0x59c
[ 675.915700] [c5649db0] [c00b1384] load_module+0x2bc4/0x320c
[ 675.915904] [c5649ec0] [c00b1ae0] sys_init_module+0x114/0x138
[ 675.916099] [c5649f40] [c001211c] ret_from_syscall+0x0/0x38
[ 675.916267] --- interrupt: c01 at 0xfd6b914
[ 675.916267] LR = 0x1001364c
[ 675.916312]
[ 675.917626] Allocated by task 340:
[ 675.921059] __kasan_kmalloc.isra.0+0xc8/0x1b0
[ 675.921309] kasan_strings+0x44/0x118 [test_kasan]
[ 675.921546] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.921690] do_one_initcall+0x40/0x278
[ 675.921858] do_init_module+0xcc/0x59c
[ 675.922016] load_module+0x2bc4/0x320c
[ 675.922174] sys_init_module+0x114/0x138
[ 675.922318] ret_from_syscall+0x0/0x38
[ 675.922365]
[ 675.923645] Freed by task 340:
[ 675.926731] __kasan_slab_free+0x120/0x22c
[ 675.926851] kfree+0x74/0x270
[ 675.927097] kasan_strings+0x54/0x118 [test_kasan]
[ 675.927334] kmalloc_tests_init+0x94/0x2d0 [test_kasan]
[ 675.927479] do_one_initcall+0x40/0x278
[ 675.927647] do_init_module+0xcc/0x59c
[ 675.927804] load_module+0x2bc4/0x320c
[ 675.927962] sys_init_module+0x114/0x138
[ 675.928107] ret_from_syscall+0x0/0x38
[ 675.928154]
[ 675.929450] The buggy address belongs to the object at c53e8e10
[ 675.929450] which belongs to the cache kmalloc-32 of size 32
[ 675.940997] The buggy address is located 16 bytes inside of
[ 675.940997] 32-byte region [c53e8e10, c53e8e30)
[ 675.950999] The buggy address belongs to the page:
[ 675.955786] page:c7fd9f40 count:1 mapcount:0 mapping:c5007cf0 index:0x0
[ 675.955897] flags: 0x200(slab)
[ 675.956127] raw: 00000200 00000100 00000200 c5007cf0 00000000
015502ab ffffffff 00000001
[ 675.956196] page dumped because: kasan: bad access detected
[ 675.956236]
[ 675.957536] Memory state around the buggy address:
[ 675.962343] c53e8d00: 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00 fc fc
[ 675.968796] c53e8d80: 00 00 00 00 fc fc 00 00 00 00 fc fc 00 00 00 00
[ 675.975251] >c53e8e00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc fb fb
[ 675.981640] ^
[ 675.985233] c53e8e80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
[ 675.991688] c53e8f00: 00 00 00 04 fc fc fb fb fb fb fc fc fb fb fb fb
[ 675.998080]
==================================================================
[ 721.624809] random: crng init done
^ permalink raw reply
* [PATCHv5 4/4] misc: pci_endpoint_test: Add the layerscape EP device support
From: Xiaowei Bao @ 2019-01-21 9:45 UTC (permalink / raw)
To: bhelgaas, robh+dt, mark.rutland, shawnguo, leoyang.li, kishon,
lorenzo.pieralisi, arnd, gregkh, minghuan.Lian, mingkai.hu,
roy.zang, kstewart, cyrille.pitchen, pombredanne, shawn.lin,
niklas.cassel, linux-pci, devicetree, linux-kernel,
linux-arm-kernel, linuxppc-dev
Cc: Xiaowei Bao
In-Reply-To: <20190121094500.10657-1-xiaowei.bao@nxp.com>
Add the layerscape EP device support in pci_endpoint_test driver.
Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
Reviewed-by: Greg KH <gregkh@linuxfoundation.org>
---
v2:
- no change
v3:
- no change
v4:
- delate the comments.
v5:
- no change.
drivers/misc/pci_endpoint_test.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 896e2df..29582fe 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -788,6 +788,7 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
static const struct pci_device_id pci_endpoint_test_tbl[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA74x) },
{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA72x) },
+ { PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x81c0) },
{ PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, 0xedda) },
{ }
};
--
1.7.1
^ permalink raw reply related
* [PATCHv5 3/4] pci: layerscape: Add the EP mode support.
From: Xiaowei Bao @ 2019-01-21 9:44 UTC (permalink / raw)
To: bhelgaas, robh+dt, mark.rutland, shawnguo, leoyang.li, kishon,
lorenzo.pieralisi, arnd, gregkh, minghuan.Lian, mingkai.hu,
roy.zang, kstewart, cyrille.pitchen, pombredanne, shawn.lin,
niklas.cassel, linux-pci, devicetree, linux-kernel,
linux-arm-kernel, linuxppc-dev
Cc: Xiaowei Bao
In-Reply-To: <20190121094500.10657-1-xiaowei.bao@nxp.com>
Add the PCIe EP mode support for layerscape platform.
Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
---
v2:
- remove the EP mode check function.
v3:
- modif the return value when enter default case.
v4:
- no change.
v5:
- no change.
drivers/pci/controller/dwc/Makefile | 2 +-
drivers/pci/controller/dwc/pci-layerscape-ep.c | 146 ++++++++++++++++++++++++
2 files changed, 147 insertions(+), 1 deletions(-)
create mode 100644 drivers/pci/controller/dwc/pci-layerscape-ep.c
diff --git a/drivers/pci/controller/dwc/Makefile b/drivers/pci/controller/dwc/Makefile
index 7bcdcdf..b5f3b83 100644
--- a/drivers/pci/controller/dwc/Makefile
+++ b/drivers/pci/controller/dwc/Makefile
@@ -8,7 +8,7 @@ obj-$(CONFIG_PCI_EXYNOS) += pci-exynos.o
obj-$(CONFIG_PCI_IMX6) += pci-imx6.o
obj-$(CONFIG_PCIE_SPEAR13XX) += pcie-spear13xx.o
obj-$(CONFIG_PCI_KEYSTONE) += pci-keystone.o
-obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o
+obj-$(CONFIG_PCI_LAYERSCAPE) += pci-layerscape.o pci-layerscape-ep.o
obj-$(CONFIG_PCIE_QCOM) += pcie-qcom.o
obj-$(CONFIG_PCIE_ARMADA_8K) += pcie-armada8k.o
obj-$(CONFIG_PCIE_ARTPEC6) += pcie-artpec6.o
diff --git a/drivers/pci/controller/dwc/pci-layerscape-ep.c b/drivers/pci/controller/dwc/pci-layerscape-ep.c
new file mode 100644
index 0000000..dafb528
--- /dev/null
+++ b/drivers/pci/controller/dwc/pci-layerscape-ep.c
@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * PCIe controller EP driver for Freescale Layerscape SoCs
+ *
+ * Copyright (C) 2018 NXP Semiconductor.
+ *
+ * Author: Xiaowei Bao <xiaowei.bao@nxp.com>
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/of_pci.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/resource.h>
+
+#include "pcie-designware.h"
+
+#define PCIE_DBI2_OFFSET 0x1000 /* DBI2 base address*/
+
+struct ls_pcie_ep {
+ struct dw_pcie *pci;
+};
+
+#define to_ls_pcie_ep(x) dev_get_drvdata((x)->dev)
+
+static int ls_pcie_establish_link(struct dw_pcie *pci)
+{
+ return 0;
+}
+
+static const struct dw_pcie_ops ls_pcie_ep_ops = {
+ .start_link = ls_pcie_establish_link,
+};
+
+static const struct of_device_id ls_pcie_ep_of_match[] = {
+ { .compatible = "fsl,ls-pcie-ep",},
+ { },
+};
+
+static void ls_pcie_ep_init(struct dw_pcie_ep *ep)
+{
+ struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
+ struct pci_epc *epc = ep->epc;
+ enum pci_barno bar;
+
+ for (bar = BAR_0; bar <= BAR_5; bar++)
+ dw_pcie_ep_reset_bar(pci, bar);
+
+ epc->features |= EPC_FEATURE_NO_LINKUP_NOTIFIER;
+}
+
+static int ls_pcie_ep_raise_irq(struct dw_pcie_ep *ep, u8 func_no,
+ enum pci_epc_irq_type type, u16 interrupt_num)
+{
+ struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
+
+ switch (type) {
+ case PCI_EPC_IRQ_LEGACY:
+ return dw_pcie_ep_raise_legacy_irq(ep, func_no);
+ case PCI_EPC_IRQ_MSI:
+ return dw_pcie_ep_raise_msi_irq(ep, func_no, interrupt_num);
+ case PCI_EPC_IRQ_MSIX:
+ return dw_pcie_ep_raise_msix_irq(ep, func_no, interrupt_num);
+ default:
+ dev_err(pci->dev, "UNKNOWN IRQ type\n");
+ return -EINVAL;
+ }
+}
+
+static struct dw_pcie_ep_ops pcie_ep_ops = {
+ .ep_init = ls_pcie_ep_init,
+ .raise_irq = ls_pcie_ep_raise_irq,
+};
+
+static int __init ls_add_pcie_ep(struct ls_pcie_ep *pcie,
+ struct platform_device *pdev)
+{
+ struct dw_pcie *pci = pcie->pci;
+ struct device *dev = pci->dev;
+ struct dw_pcie_ep *ep;
+ struct resource *res;
+ int ret;
+
+ ep = &pci->ep;
+ ep->ops = &pcie_ep_ops;
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "addr_space");
+ if (!res)
+ return -EINVAL;
+
+ ep->phys_base = res->start;
+ ep->addr_size = resource_size(res);
+
+ ret = dw_pcie_ep_init(ep);
+ if (ret) {
+ dev_err(dev, "failed to initialize endpoint\n");
+ return ret;
+ }
+
+ return 0;
+}
+
+static int __init ls_pcie_ep_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ struct dw_pcie *pci;
+ struct ls_pcie_ep *pcie;
+ struct resource *dbi_base;
+ int ret;
+
+ pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
+ if (!pcie)
+ return -ENOMEM;
+
+ pci = devm_kzalloc(dev, sizeof(*pci), GFP_KERNEL);
+ if (!pci)
+ return -ENOMEM;
+
+ dbi_base = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
+ pci->dbi_base = devm_pci_remap_cfg_resource(dev, dbi_base);
+ if (IS_ERR(pci->dbi_base))
+ return PTR_ERR(pci->dbi_base);
+
+ pci->dbi_base2 = pci->dbi_base + PCIE_DBI2_OFFSET;
+ pci->dev = dev;
+ pci->ops = &ls_pcie_ep_ops;
+ pcie->pci = pci;
+
+ platform_set_drvdata(pdev, pcie);
+
+ ret = ls_add_pcie_ep(pcie, pdev);
+
+ return ret;
+}
+
+static struct platform_driver ls_pcie_ep_driver = {
+ .driver = {
+ .name = "layerscape-pcie-ep",
+ .of_match_table = ls_pcie_ep_of_match,
+ .suppress_bind_attrs = true,
+ },
+};
+builtin_platform_driver_probe(ls_pcie_ep_driver, ls_pcie_ep_probe);
--
1.7.1
^ permalink raw reply related
* [PATCHv5 1/4] dt-bindings: add DT binding for the layerscape PCIe controller with EP mode
From: Xiaowei Bao @ 2019-01-21 9:44 UTC (permalink / raw)
To: bhelgaas, robh+dt, mark.rutland, shawnguo, leoyang.li, kishon,
lorenzo.pieralisi, arnd, gregkh, minghuan.Lian, mingkai.hu,
roy.zang, kstewart, cyrille.pitchen, pombredanne, shawn.lin,
niklas.cassel, linux-pci, devicetree, linux-kernel,
linux-arm-kernel, linuxppc-dev
Cc: Xiaowei Bao
Add the documentation for the Device Tree binding for the layerscape PCIe
controller with EP mode.
Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
---
v2:
- Add the SoC specific compatibles.
v3:
- modify the commit message.
v4:
- no change.
v5:
- no change.
.../devicetree/bindings/pci/layerscape-pci.txt | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/Documentation/devicetree/bindings/pci/layerscape-pci.txt b/Documentation/devicetree/bindings/pci/layerscape-pci.txt
index 9b2b8d6..e20ceaa 100644
--- a/Documentation/devicetree/bindings/pci/layerscape-pci.txt
+++ b/Documentation/devicetree/bindings/pci/layerscape-pci.txt
@@ -13,6 +13,7 @@ information.
Required properties:
- compatible: should contain the platform identifier such as:
+ RC mode:
"fsl,ls1021a-pcie"
"fsl,ls2080a-pcie", "fsl,ls2085a-pcie"
"fsl,ls2088a-pcie"
@@ -20,6 +21,8 @@ Required properties:
"fsl,ls1046a-pcie"
"fsl,ls1043a-pcie"
"fsl,ls1012a-pcie"
+ EP mode:
+ "fsl,ls1046a-pcie-ep", "fsl,ls-pcie-ep"
- reg: base addresses and lengths of the PCIe controller register blocks.
- interrupts: A list of interrupt outputs of the controller. Must contain an
entry for each entry in the interrupt-names property.
--
1.7.1
^ permalink raw reply related
* [PATCHv5 2/4] arm64: dts: Add the PCIE EP node in dts
From: Xiaowei Bao @ 2019-01-21 9:44 UTC (permalink / raw)
To: bhelgaas, robh+dt, mark.rutland, shawnguo, leoyang.li, kishon,
lorenzo.pieralisi, arnd, gregkh, minghuan.Lian, mingkai.hu,
roy.zang, kstewart, cyrille.pitchen, pombredanne, shawn.lin,
niklas.cassel, linux-pci, devicetree, linux-kernel,
linux-arm-kernel, linuxppc-dev
Cc: Xiaowei Bao
In-Reply-To: <20190121094500.10657-1-xiaowei.bao@nxp.com>
Add the PCIE EP node in dts for ls1046a.
Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
Reviewed-by: Minghuan Lian <minghuan.lian@nxp.com>
Reviewed-by: Zhiqiang Hou <zhiqiang.hou@nxp.com>
---
v2:
- Add the SoC specific compatibles.
v3:
- no change
v4:
- no change
v5:
- change the OB win number due to the RM update.
arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi | 34 +++++++++++++++++++++++-
1 files changed, 33 insertions(+), 1 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
index 0e762ca..cb71850 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
@@ -666,6 +666,17 @@
status = "disabled";
};
+ pcie_ep@3400000 {
+ compatible = "fsl,ls1046a-pcie-ep","fsl,ls-pcie-ep";
+ reg = <0x00 0x03400000 0x0 0x00100000
+ 0x40 0x00000000 0x8 0x00000000>;
+ reg-names = "regs", "addr_space";
+ num-ib-windows = <6>;
+ num-ob-windows = <8>;
+ num-lanes = <2>;
+ status = "disabled";
+ };
+
pcie@3500000 {
compatible = "fsl,ls1046a-pcie";
reg = <0x00 0x03500000 0x0 0x00100000 /* controller registers */
@@ -693,6 +704,17 @@
status = "disabled";
};
+ pcie_ep@3500000 {
+ compatible = "fsl,ls1046a-pcie-ep","fsl,ls-pcie-ep";
+ reg = <0x00 0x03500000 0x0 0x00100000
+ 0x48 0x00000000 0x8 0x00000000>;
+ reg-names = "regs", "addr_space";
+ num-ib-windows = <6>;
+ num-ob-windows = <8>;
+ num-lanes = <2>;
+ status = "disabled";
+ };
+
pcie@3600000 {
compatible = "fsl,ls1046a-pcie";
reg = <0x00 0x03600000 0x0 0x00100000 /* controller registers */
@@ -720,6 +742,17 @@
status = "disabled";
};
+ pcie_ep@3600000 {
+ compatible = "fsl,ls1046a-pcie-ep", "fsl,ls-pcie-ep";
+ reg = <0x00 0x03600000 0x0 0x00100000
+ 0x50 0x00000000 0x8 0x00000000>;
+ reg-names = "regs", "addr_space";
+ num-ib-windows = <6>;
+ num-ob-windows = <8>;
+ num-lanes = <2>;
+ status = "disabled";
+ };
+
qdma: dma-controller@8380000 {
compatible = "fsl,ls1046a-qdma", "fsl,ls1021a-qdma";
reg = <0x0 0x8380000 0x0 0x1000>, /* Controller regs */
@@ -740,7 +773,6 @@
queue-sizes = <64 64>;
big-endian;
};
-
};
reserved-memory {
--
1.7.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox