Dmitry, we are working on some fixes, but at least I have a hard time following the reports. Please take a break until we push some of the patches for now-known failures. :) Thanks, Paolo On 18/11/2016 11:22, Dmitry Vyukov wrote: > Hello, > > The following program triggers slab-out-of-bounds write in __apic_accept_irq: > > https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt > > On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5) > > ================================================================== > BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at > addr ffff880035d4918f > Write of size 1 by task a.out/27101 > CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91 > ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b > 0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95 > Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51 > [<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159 > [< inline >] print_address_description mm/kasan/report.c:197 > [< inline >] kasan_report_error mm/kasan/report.c:286 > [<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306 > [<ffffffff819f106c>] __asan_report_store1_noabort+0x1c/0x20 > mm/kasan/report.c:334 > [<ffffffff8116fb53>] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905 > [<ffffffff8117245e>] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495 > [<ffffffff81184ea2>] kvm_irq_delivery_to_apic+0x732/0xc10 > arch/x86/kvm/irq_comm.c:86 > [<ffffffff8118064d>] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360 > [<ffffffff811817c5>] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222 > [< inline >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235 > [<ffffffff81183653>] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670 > [< inline >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668 > [<ffffffff810dfe18>] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999 > [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099 > [< inline >] vfs_ioctl fs/ioctl.c:43 > [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679 > [< inline >] SYSC_ioctl fs/ioctl.c:694 > [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685 > [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 > arch/x86/entry/entry_64.S:209 > > Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048 > Allocated: > PID = 27101 > [ 291.279030] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20 > [ 291.279030] [<ffffffff819efce3>] save_stack+0x43/0xd0 > [ 291.279030] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0 > [ 291.279030] [<ffffffff819ec32c>] kmem_cache_alloc_trace+0x12c/0x710 > [ 291.279030] [<ffffffff81182ca0>] kvm_ioapic_init+0xa0/0x680 > [ 291.279030] [<ffffffff810df5e7>] kvm_arch_vm_ioctl+0x11d7/0x23c0 > [ 291.279030] [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70 > [ 291.279030] [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 > [ 291.279030] [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 > [ 291.279030] [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6 > > Memory state around the buggy address: > ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ^ > ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ================================================================== > Disabling lock debugging due to kernel taint > Disabled LAPIC found during irq injection > -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
