Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170

[Sergey Senozhatsky]

On (11/07/17 19:45), Sergey Senozhatsky wrote:
[..]
> > [   22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170
> > [   22.258648] Write of size 26 at addr ffff880013432540 by task init/1
> > [   22.260272] 
> > [   22.260860] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc8 #14
> > [   22.262379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> > [   22.264441] Call Trace:
> > [   22.265206]  dump_stack+0x5d/0x81
> > [   22.266147]  print_address_description+0xa7/0x280
> > [   22.267369]  ? copyin+0xea/0x170
> > [   22.268282]  ? copyin+0xea/0x170
> > [   22.268990]  kasan_report+0xd3/0x150
> > [   22.269551]  ? quarantine_reduce+0x1/0x1a0
> > [   22.270177]  ? copyin+0xea/0x170
> > [   22.270703]  copyin+0xea/0x170
> > [   22.271202]  _copy_from_iter_full+0x14f/0x4f0
> > [   22.271857]  ? __kmalloc+0x1ad/0x2e0
> > [   22.272420]  devkmsg_write+0xb9/0x1a0
> > [   22.272999]  new_sync_write+0xd8/0x130
> > [   22.273579]  vfs_write+0x174/0x2b0
> > [   22.274113]  SyS_write+0x50/0xc0
> > [   22.274611]  do_int80_syscall_32+0x7a/0x1b0
> > [   22.275216]  entry_INT80_compat+0x2d/0x40
> >
> > [   22.276103] Allocated by task 1:
> > [   22.276597]  kasan_kmalloc+0x61/0xf0
> > [   22.277202]  __kmalloc+0x1ad/0x2e0
> > [   22.277720]  devkmsg_write+0x76/0x1a0
> > [   22.278268]  new_sync_write+0xd8/0x130
> > [   22.278826]  vfs_write+0x174/0x2b0
> > [   22.279342]  SyS_write+0x50/0xc0
> > [   22.279840]  do_int80_syscall_32+0x7a/0x1b0
> > [   22.280441]  entry_INT80_compat+0x2d/0x40
> >
> > [   22.281326] Freed by task 1:
> > [   22.281788]  kasan_slab_free+0xac/0x180
> > [   22.282354]  kfree+0x105/0x310
> > [   22.282837]  unpack_to_rootfs+0x260/0x2a1
> > [   22.283420]  populate_rootfs+0x5d/0x86
> > [   22.283977]  do_one_initcall+0x3b/0x180
> > [   22.284544]  do_basic_setup+0xb4/0xd0
> > [   22.285091]  kernel_init_freeable+0x7b/0xed
> > [   22.285680]  kernel_init+0xe/0x110
> > [   22.286171]  ret_from_fork+0x25/0x30

a quite similar KASAN report
https://marc.info/?l=linux-kernel&m=150900582526314&w=2

on my box "test_printf: all 260 tests passed".

	-ss