Messages in this thread | | | From | Dmitry Vyukov <> | Date | Sun, 27 Sep 2020 11:12:23 +0200 | Subject | KASAN: global-out-of-bounds in console_unlock |
| |
Hi printk maintainers,
I've got the following out-of-bounds in printk code. This is on next-20200925. Config is attached. This is just on pr_cont("\n"). Something overreads the string.
================================================================== BUG: KASAN: global-out-of-bounds in memchr+0x65/0x80 lib/string.c:1058 Read of size 1 at addr ffffffff8c68c860 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc6-next-20200925+ #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x14b/0x18f lib/dump_stack.c:118 print_address_description.constprop.0.cold+0x5/0x4c5 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 memchr+0x65/0x80 lib/string.c:1058 memchr include/linux/string.h:450 [inline] record_print_text+0x22d/0x310 kernel/printk/printk.c:1369 console_unlock+0x350/0xbc0 kernel/printk/printk.c:2477 vprintk_emit+0x348/0x4b0 kernel/printk/printk.c:2021 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393 printk+0xba/0xed kernel/printk/printk.c:2069 show_pwq+0x74d/0x7ee kernel/workqueue.c:4745 show_workqueue_state.cold+0xd0/0x3c9 kernel/workqueue.c:4784 wq_watchdog_timer_fn+0x2e5/0x370 kernel/workqueue.c:5798 call_timer_fn+0x38/0x2d0 kernel/time/timer.c:1413 expire_timers kernel/time/timer.c:1458 [inline] __run_timers kernel/time/timer.c:1755 [inline] __run_timers kernel/time/timer.c:1731 [inline] run_timer_softirq+0xad2/0x1440 kernel/time/timer.c:1770 __do_softirq+0x1f0/0x6c4 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x58/0x70 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x137/0x170 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x34/0xb0 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61 Code: ff cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d b4 9f 5e 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d a4 9f 5e 00 fb f4 <c3> cc 41 54 55 53 e8 57 b5 fd ff 0f 1f 44 00 00 e8 ed 88 72 f9 48 RSP: 0018:ffffffff89a07e20 EFLAGS: 00000282 RAX: 1ffffffff136c688 RBX: ffffffff89a3bc40 RCX: ffffffff87e7dae8 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffed100dd469e9 R10: ffff88806ea34f43 R11: ffffed100dd469e8 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff8b15e748 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:150 [inline] default_idle+0x2a/0x40 arch/x86/kernel/process.c:688 default_idle_call+0x9c/0x280 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:168 [inline] do_idle+0x3b5/0x690 kernel/sched/idle.c:273 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:369 start_kernel+0x435/0x456 init/main.c:1049 secondary_startup_64_no_verify+0xa6/0xab
The buggy address belongs to the variable: text.49461+0x400/0x420
Memory state around the buggy address: ffffffff8c68c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8c68c780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff8c68c800: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 ^ ffffffff8c68c880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff8c68c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== [unhandled content-type:application/octet-stream] | |