Hello, The following program triggers slab-out-of-bounds write in __apic_accept_irq: https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5) ================================================================== BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr ffff880035d4918f Write of size 1 by task a.out/27101 CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91 ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b 0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51 [<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159 [< inline >] print_address_description mm/kasan/report.c:197 [< inline >] kasan_report_error mm/kasan/report.c:286 [<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306 [<ffffffff819f106c>] __asan_report_store1_noabort+0x1c/0x20 mm/kasan/report.c:334 [<ffffffff8116fb53>] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905 [<ffffffff8117245e>] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495 [<ffffffff81184ea2>] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86 [<ffffffff8118064d>] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360 [<ffffffff811817c5>] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222 [< inline >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235 [<ffffffff81183653>] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670 [< inline >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668 [<ffffffff810dfe18>] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999 [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679 [< inline >] SYSC_ioctl fs/ioctl.c:694 [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685 [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 arch/x86/entry/entry_64.S:209 Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048 Allocated: PID = 27101 [ 291.279030] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20 [ 291.279030] [<ffffffff819efce3>] save_stack+0x43/0xd0 [ 291.279030] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0 [ 291.279030] [<ffffffff819ec32c>] kmem_cache_alloc_trace+0x12c/0x710 [ 291.279030] [<ffffffff81182ca0>] kvm_ioapic_init+0xa0/0x680 [ 291.279030] [<ffffffff810df5e7>] kvm_arch_vm_ioctl+0x11d7/0x23c0 [ 291.279030] [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70 [ 291.279030] [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 [ 291.279030] [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 [ 291.279030] [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 Memory state around the buggy address: ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Disabled LAPIC found during irq injection -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
