From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1757502AbdKGL7Y (ORCPT <rfc822;w@1wt.eu>);
        Tue, 7 Nov 2017 06:59:24 -0500
Received: from mail-pf0-f174.google.com ([209.85.192.174]:45609 "EHLO
        mail-pf0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752039AbdKGL7W (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 7 Nov 2017 06:59:22 -0500
X-Google-Smtp-Source: ABhQp+QSy3xj/NHhTUQSr1An5lVJTaFNsjWEDWZ64KifCTDO4zFwZqIjzt807yd/ozo0mQSy5HuSVw==
Date: Tue, 7 Nov 2017 20:59:18 +0900
From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
To: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>, linux-kernel@vger.kernel.org,
        Petr Mladek <pmladek@suse.com>,
        Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
        Steven Rostedt <rostedt@goodmis.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Aleksey Makarov <aleksey.makarov@linaro.org>,
        Ingo Molnar <mingo@kernel.org>,
        Nicolas Pitre <nicolas.pitre@linaro.org>,
        Dmitry Vyukov <dvyukov@google.com>,
        Andrey Ryabinin <aryabinin@virtuozzo.com>,
        Alexander Potapenko <glider@google.com>
Subject: Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in
 copyin+0xea/0x170
Message-ID: <20171107115918.GA404@jagdpanzerIV>
References: <20171107093921.ulnjqoaycig5qqoy@wfg-t540p.sh.intel.com>
 <20171107104517.GA470@jagdpanzerIV>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20171107104517.GA470@jagdpanzerIV>
User-Agent: Mutt/1.9.1 (2017-09-22)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On (11/07/17 19:45), Sergey Senozhatsky wrote:
[..]
> > [   22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170
> > [   22.258648] Write of size 26 at addr ffff880013432540 by task init/1
> > [   22.260272] 
> > [   22.260860] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc8 #14
> > [   22.262379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> > [   22.264441] Call Trace:
> > [   22.265206]  dump_stack+0x5d/0x81
> > [   22.266147]  print_address_description+0xa7/0x280
> > [   22.267369]  ? copyin+0xea/0x170
> > [   22.268282]  ? copyin+0xea/0x170
> > [   22.268990]  kasan_report+0xd3/0x150
> > [   22.269551]  ? quarantine_reduce+0x1/0x1a0
> > [   22.270177]  ? copyin+0xea/0x170
> > [   22.270703]  copyin+0xea/0x170
> > [   22.271202]  _copy_from_iter_full+0x14f/0x4f0
> > [   22.271857]  ? __kmalloc+0x1ad/0x2e0
> > [   22.272420]  devkmsg_write+0xb9/0x1a0
> > [   22.272999]  new_sync_write+0xd8/0x130
> > [   22.273579]  vfs_write+0x174/0x2b0
> > [   22.274113]  SyS_write+0x50/0xc0
> > [   22.274611]  do_int80_syscall_32+0x7a/0x1b0
> > [   22.275216]  entry_INT80_compat+0x2d/0x40
> >
> > [   22.276103] Allocated by task 1:
> > [   22.276597]  kasan_kmalloc+0x61/0xf0
> > [   22.277202]  __kmalloc+0x1ad/0x2e0
> > [   22.277720]  devkmsg_write+0x76/0x1a0
> > [   22.278268]  new_sync_write+0xd8/0x130
> > [   22.278826]  vfs_write+0x174/0x2b0
> > [   22.279342]  SyS_write+0x50/0xc0
> > [   22.279840]  do_int80_syscall_32+0x7a/0x1b0
> > [   22.280441]  entry_INT80_compat+0x2d/0x40
> >
> > [   22.281326] Freed by task 1:
> > [   22.281788]  kasan_slab_free+0xac/0x180
> > [   22.282354]  kfree+0x105/0x310
> > [   22.282837]  unpack_to_rootfs+0x260/0x2a1
> > [   22.283420]  populate_rootfs+0x5d/0x86
> > [   22.283977]  do_one_initcall+0x3b/0x180
> > [   22.284544]  do_basic_setup+0xb4/0xd0
> > [   22.285091]  kernel_init_freeable+0x7b/0xed
> > [   22.285680]  kernel_init+0xe/0x110
> > [   22.286171]  ret_from_fork+0x25/0x30

a quite similar KASAN report
https://marc.info/?l=linux-kernel&m=150900582526314&w=2

on my box "test_printf: all 260 tests passed".

	-ss