Re: "lib: rework bitmap_parse()" triggers invalid access errors

[Qian Cai]

On Wed, 2019-06-05 at 08:01 +0000, Yuri Norov wrote:
> (Sorry for top-posting)
> 
> I can reproduce this on next-20190604. Is it new trace, or like one you've
> posted before?

Same thing, "nbits" causes an invalid access.

# ./scripts/faddr2line vmlinux bitmap_parse+0x20c/0x2d8
bitmap_parse+0x20c/0x2d8:
__bitmap_clear at lib/bitmap.c:280
(inlined by) bitmap_clear at include/linux/bitmap.h:390
(inlined by) bitmap_parse at lib/bitmap.c:662

This line,

while (len - bits_to_clear >= 0) {

[ÂÂ151.025490][ T3745]
==================================================================
[ÂÂ151.033437][ T3745] BUG: KASAN: invalid-access in bitmap_parse+0x20c/0x2d8
[ÂÂ151.040313][ T3745] Write of size 8 at addr 88ff80961f5637a0 by task
irqbalance/3745
[ÂÂ151.048052][ T3745] Pointer tag: [88], memory tag: [fe]
[ÂÂ151.053272][ T3745]Â
[ÂÂ151.055462][ T3745] CPU: 191 PID: 3745 Comm: irqbalance Tainted:
GÂÂÂÂÂÂÂÂWÂÂÂÂÂÂÂÂÂ5.2.0-rc3-next-20190606+ #2
[ÂÂ151.065548][ T3745] Hardware name: HPE Apollo
70ÂÂÂÂÂÂÂÂÂÂÂÂÂ/C01_APACHE_MBÂÂÂÂÂÂÂÂÂ, BIOS L50_5.13_1.0.9 03/01/2019
[ÂÂ151.076064][ T3745] Call trace:
[ÂÂ151.079218][ T3745]ÂÂdump_backtrace+0x0/0x268
[ÂÂ151.083574][ T3745]ÂÂshow_stack+0x20/0x2c
[ÂÂ151.087589][ T3745]ÂÂdump_stack+0xb4/0x108
[ÂÂ151.091691][ T3745]ÂÂprint_address_description+0x7c/0x330
[ÂÂ151.097088][ T3745]ÂÂ__kasan_report+0x194/0x1dc
[ÂÂ151.101616][ T3745]ÂÂkasan_report+0x10/0x18
[ÂÂ151.105799][ T3745]ÂÂ__hwasan_store8_noabort+0x74/0x7c
[ÂÂ151.110935][ T3745]ÂÂbitmap_parse+0x20c/0x2d8
[ÂÂ151.115291][ T3745]ÂÂbitmap_parse_user+0x40/0x64
[ÂÂ151.119910][ T3745]ÂÂwrite_irq_affinity+0x118/0x1a8
[ÂÂ151.124786][ T3745]ÂÂirq_affinity_proc_write+0x34/0x44
[ÂÂ151.129925][ T3745]ÂÂproc_reg_write+0xf4/0x130
[ÂÂ151.134376][ T3745]ÂÂ__vfs_write+0x88/0x33c
[ÂÂ151.138561][ T3745]ÂÂvfs_write+0x118/0x208
[ÂÂ151.142656][ T3745]ÂÂksys_write+0xa0/0x110
[ÂÂ151.146752][ T3745]ÂÂ__arm64_sys_write+0x54/0x88
[ÂÂ151.151377][ T3745]ÂÂel0_svc_handler+0x198/0x260
[ÂÂ151.155992][ T3745]ÂÂel0_svc+0x8/0xc
[ÂÂ151.159566][ T3745]Â
[ÂÂ151.161751][ T3745] Allocated by task 3745:
[ÂÂ151.165933][ T3745]ÂÂ__kasan_kmalloc+0x114/0x1d0
[ÂÂ151.170553][ T3745]ÂÂkasan_kmalloc+0x10/0x18
[ÂÂ151.174830][ T3745]ÂÂ__kmalloc_node+0x1e0/0x788
[ÂÂ151.179358][ T3745]ÂÂalloc_cpumask_var_node+0x48/0x94
[ÂÂ151.184407][ T3745]ÂÂalloc_cpumask_var+0x10/0x1c
[ÂÂ151.189022][ T3745]ÂÂwrite_irq_affinity+0xa8/0x1a8
[ÂÂ151.193811][ T3745]ÂÂirq_affinity_proc_write+0x34/0x44
[ÂÂ151.198947][ T3745]ÂÂproc_reg_write+0xf4/0x130
[ÂÂ151.203389][ T3745]ÂÂ__vfs_write+0x88/0x33c
[ÂÂ151.207573][ T3745]ÂÂvfs_write+0x118/0x208
[ÂÂ151.211668][ T3745]ÂÂksys_write+0xa0/0x110
[ÂÂ151.215764][ T3745]ÂÂ__arm64_sys_write+0x54/0x88
[ÂÂ151.220380][ T3745]ÂÂel0_svc_handler+0x198/0x260
[ÂÂ151.224996][ T3745]ÂÂel0_svc+0x8/0xc
[ÂÂ151.228566][ T3745]Â
[ÂÂ151.230749][ T3745] Freed by task 3745:
[ÂÂ151.234585][ T3745]ÂÂ__kasan_slab_free+0x154/0x228
[ÂÂ151.239374][ T3745]ÂÂkasan_slab_free+0xc/0x18
[ÂÂ151.243729][ T3745]ÂÂkfree+0x268/0xb70
[ÂÂ151.247484][ T3745]ÂÂfree_cpumask_var+0xc/0x14
[ÂÂ151.251932][ T3745]ÂÂwrite_irq_affinity+0x19c/0x1a8
[ÂÂ151.256807][ T3745]ÂÂirq_affinity_proc_write+0x34/0x44
[ÂÂ151.261943][ T3745]ÂÂproc_reg_write+0xf4/0x130
[ÂÂ151.266386][ T3745]ÂÂ__vfs_write+0x88/0x33c
[ÂÂ151.270567][ T3745]ÂÂvfs_write+0x118/0x208
[ÂÂ151.274661][ T3745]ÂÂksys_write+0xa0/0x110
[ÂÂ151.278756][ T3745]ÂÂ__arm64_sys_write+0x54/0x88
[ÂÂ151.283371][ T3745]ÂÂel0_svc_handler+0x198/0x260
[ÂÂ151.287986][ T3745]ÂÂel0_svc+0x8/0xc
[ÂÂ151.291556][ T3745]Â
[ÂÂ151.293742][ T3745] The buggy address belongs to the object at
ffff80961f563780
[ÂÂ151.293742][ T3745]ÂÂwhich belongs to the cache kmalloc-128 of size 128
[ÂÂ151.307647][ T3745] The buggy address is located 32 bytes inside of
[ÂÂ151.307647][ T3745]ÂÂ128-byte region [ffff80961f563780, ffff80961f563800)
[ÂÂ151.320681][ T3745] The buggy address belongs to the page:
[ÂÂ151.326167][ T3745] page:ffff7fe02587d580 refcount:1 mapcount:0
mapping:fdff800800010480 index:0x8aff80961f56dc80
[ÂÂ151.336429][ T3745] flags: 0x17ffffffc000200(slab)
[ÂÂ151.341222][ T3745] raw: 017ffffffc000200 ffff7fe025843788 e3ff808b7d00fd40
fdff800800010480
[ÂÂ151.349659][ T3745] raw: 8aff80961f56dc80 000000000066001d 00000001ffffffff
0000000000000000
[ÂÂ151.358092][ T3745] page dumped because: kasan: bad access detected
[ÂÂ151.364361][ T3745] page allocated via order 0, migratetype Unmovable,
gfp_mask 0x12800(GFP_NOWAIT|__GFP_NOWARN|__GFP_NORETRY)
[ÂÂ151.375757][ T3745]ÂÂprep_new_page+0x2f4/0x378
[ÂÂ151.380201][ T3745]ÂÂget_page_from_freelist+0x253c/0x2868
[ÂÂ151.385598][ T3745]ÂÂ__alloc_pages_nodemask+0x360/0x1c60
[ÂÂ151.390908][ T3745]ÂÂalloc_pages_current+0xd0/0xe0
[ÂÂ151.395699][ T3745]ÂÂnew_slab+0x15c/0x9d4
[ÂÂ151.399707][ T3745]ÂÂ___slab_alloc+0x57c/0x9e4
[ÂÂ151.404148][ T3745]ÂÂ__kmalloc+0x58c/0x5e0
[ÂÂ151.408247][ T3745]ÂÂmemcg_kmem_get_cache+0x150/0x65c
[ÂÂ151.413296][ T3745]ÂÂkmem_cache_alloc+0x208/0x568
[ÂÂ151.418010][ T3745]ÂÂ__anon_vma_prepare+0x60/0x210
[ÂÂ151.422799][ T3745]ÂÂdo_fault+0xc64/0xf80
[ÂÂ151.426807][ T3745]ÂÂhandle_pte_fault+0x4e4/0x15e8
[ÂÂ151.431597][ T3745]ÂÂhandle_mm_fault+0x6a4/0x95c
[ÂÂ151.436216][ T3745]ÂÂdo_page_fault+0x4a0/0x770
[ÂÂ151.440657][ T3745]ÂÂdo_translation_fault+0x60/0xa0
[ÂÂ151.445537][ T3745]ÂÂdo_mem_abort+0x58/0xf4
[ÂÂ151.449715][ T3745]Â
[ÂÂ151.451897][ T3745] Memory state around the buggy address:
[ÂÂ151.457381][ T3745]ÂÂffff80961f563500: 93 93 93 93 93 93 93 93 fe fe fe fe fe
fe fe fe
[ÂÂ151.465295][ T3745]ÂÂffff80961f563600: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ÂÂ151.473209][ T3745] >ffff80961f563700: fe fe fe fe fe fe fe fe 88 88 fe fe fe
fe fe fe
[ÂÂ151.481120][ T3745]ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ^
[ÂÂ151.487645][ T3745]ÂÂffff80961f563800: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ÂÂ151.495562][ T3745]ÂÂffff80961f563900: fe fe fe fe fe fe fe fe fe fe fe fe fe
fe fe fe
[ÂÂ151.503481][ T3745]
==================================================================
[ÂÂ151.511399][ T3745] Disabling lock debugging due to kernel taint