On 2023/11/21 23:06, kernel test robot wrote:
Hello,
kernel test robot noticed "BUG_kmalloc-rnd-#-#(Not_tainted):Object_padding_overwritten" on:
commit: cb53c2a822df305ec84b291e4c4a348c7d394b89 ("[PATCH] kasan: Improve free meta storage in Generic KASAN")
url: https://github.com/intel-lab-lkp/linux/commits/Juntong-Deng/kasan-Improve-free-meta-storage-in-Generic-KASAN/20231120-044846
base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything
patch link: https://lore.kernel.org/all/VI1P193MB0752DE2CCD9046B5FED0AA8E99B5A@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
patch subject: [PATCH] kasan: Improve free meta storage in Generic KASAN
in testcase: boot
compiler: clang-16
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+-------------------------------------------------------------+------------+------------+
| | a350566908 | cb53c2a822 |
+-------------------------------------------------------------+------------+------------+
| BUG_kmalloc-rnd-#-#(Not_tainted):Object_padding_overwritten | 0 | 17 |
| BUG_kmalloc-rnd-#-#(Tainted:G_B):Object_padding_overwritten | 0 | 21 |
| BUG_kmalloc-#(Tainted:G_B):Object_padding_overwritten | 0 | 21 |
| BUG_kmalloc-#(Not_tainted):Object_padding_overwritten | 0 | 4 |
+-------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202311212204.c9c64d29-oliver.sang@xxxxxxxxx
[ 1.104299][ T0] ** administrator! **
[ 1.104884][ T0] ** **
[ 1.105469][ T0] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **
[ 1.106054][ T0] **********************************************************
[ 1.109891][ T0] =============================================================================
[ 1.110637][ T0] BUG kmalloc-rnd-09-8 (Not tainted): Object padding overwritten
[ 1.111258][ T0] -----------------------------------------------------------------------------
[ 1.111258][ T0]
[ 1.112154][ T0] 0xffff888100078074-0xffff88810007807b @offset=116. First byte 0x0 instead of 0x5a
[ 1.112904][ T0] Slab 0xffffea0004001e00 objects=30 used=1 fp=0xffff888100078090 flags=0x8000000000000800(slab|zone=2)
[ 1.113798][ T0] Object 0xffff888100078008 @offset=8 fp=0xffff888100078090
[ 1.113798][ T0]
[ 1.114555][ T0] Redzone ffff888100078000: bb bb bb bb bb bb bb bb ........
[ 1.115329][ T0] Object ffff888100078008: 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkk.
[ 1.116098][ T0] Redzone ffff888100078010: bb bb bb bb bb bb bb bb ........
[ 1.116868][ T0] Padding ffff888100078074: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
[ 1.117691][ T0] Padding ffff888100078084: 5a 5a 5a 5a ZZZZ
[ 1.118432][ T0] CPU: 0 PID: 0 Comm: swapper Not tainted 6.7.0-rc1-00145-gcb53c2a822df #1
[ 1.119122][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 1.119953][ T0] Call Trace:
[ 1.120209][ T0] <TASK>
[ 1.120439][ T0] dump_stack_lvl+0xa2/0x100
[ 1.120808][ T0] check_bytes_and_report+0x113/0x160
[ 1.121240][ T0] check_object+0x1e1/0x380
[ 1.121599][ T0] alloc_debug_processing+0x10e/0x1f0
[ 1.122027][ T0] ___slab_alloc+0x81b/0xdd0
[ 1.122392][ T0] ? init_freelist_randomization+0x11/0x50
[ 1.122854][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.123308][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.123751][ T0] __kmem_cache_alloc_node+0x161/0x1f0
[ 1.124188][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.124637][ T0] __kmalloc+0xb5/0x1b0
[ 1.124968][ T0] cache_random_seq_create+0x49/0x110
[ 1.125395][ T0] init_cache_random_seq+0x2c/0xc0
[ 1.125809][ T0] init_freelist_randomization+0x2d/0x50
[ 1.126259][ T0] kmem_cache_init+0xac/0x120
[ 1.126630][ T0] mm_core_init+0x2a/0x60
[ 1.126972][ T0] start_kernel+0x156/0x370
[ 1.127334][ T0] x86_64_start_reservations+0x20/0x20
[ 1.127770][ T0] x86_64_start_kernel+0x59/0x60
[ 1.128162][ T0] secondary_startup_64_no_verify+0x167/0x16b
[ 1.128652][ T0] </TASK>
[ 1.128887][ T0] Disabling lock debugging due to kernel taint
[ 1.129373][ T0] FIX kmalloc-rnd-09-8: Restoring Object padding 0xffff888100078074-0xffff88810007807b=0x5a
[ 1.130544][ T0] =============================================================================
[ 1.131270][ T0] BUG kmalloc-rnd-09-8 (Tainted: G B ): Object padding overwritten
[ 1.132002][ T0] -----------------------------------------------------------------------------
[ 1.132002][ T0]
[ 1.132893][ T0] 0xffff8881000780fc-0xffff888100078103 @offset=252. First byte 0x0 instead of 0x5a
[ 1.133638][ T0] Slab 0xffffea0004001e00 objects=30 used=2 fp=0xffff888100078118 flags=0x8000000000000800(slab|zone=2)
[ 1.134524][ T0] Object 0xffff888100078090 @offset=144 fp=0xffff888100078118
[ 1.134524][ T0]
[ 1.135292][ T0] Redzone ffff888100078088: bb bb bb bb bb bb bb bb ........
[ 1.136060][ T0] Object ffff888100078090: 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkk.
[ 1.136827][ T0] Redzone ffff888100078098: bb bb bb bb bb bb bb bb ........
[ 1.137596][ T0] Padding ffff8881000780fc: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
[ 1.138418][ T0] Padding ffff88810007810c: 5a 5a 5a 5a ZZZZ
[ 1.139167][ T0] CPU: 0 PID: 0 Comm: swapper Tainted: G B 6.7.0-rc1-00145-gcb53c2a822df #1
[ 1.139971][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 1.140800][ T0] Call Trace:
[ 1.141054][ T0] <TASK>
[ 1.141281][ T0] dump_stack_lvl+0xa2/0x100
[ 1.141643][ T0] check_bytes_and_report+0x113/0x160
[ 1.142068][ T0] check_object+0x1e1/0x380
[ 1.142423][ T0] alloc_debug_processing+0x10e/0x1f0
[ 1.142848][ T0] ___slab_alloc+0x4fe/0xdd0
[ 1.143214][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.143654][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.144092][ T0] __kmem_cache_alloc_node+0x161/0x1f0
[ 1.144524][ T0] ? cache_random_seq_create+0x49/0x110
[ 1.144962][ T0] __kmalloc+0xb5/0x1b0
[ 1.145289][ T0] cache_random_seq_create+0x49/0x110
[ 1.145713][ T0] init_cache_random_seq+0x2c/0xc0
[ 1.146115][ T0] init_freelist_randomization+0x2d/0x50
[ 1.146561][ T0] kmem_cache_init+0xac/0x120
[ 1.146928][ T0] mm_core_init+0x2a/0x60
[ 1.147272][ T0] start_kernel+0x156/0x370
[ 1.147625][ T0] x86_64_start_reservations+0x20/0x20
[ 1.148057][ T0] x86_64_start_kernel+0x59/0x60
[ 1.148447][ T0] secondary_startup_64_no_verify+0x167/0x16b
[ 1.148929][ T0] </TASK>
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20231121/202311212204.c9c64d29-oliver.sang@xxxxxxxxx
This bug is caused by the fact that after improving the free meta
storage, kasan_metadata_size() continues to calculate the metadata
size according to the previous storage method.
I will fix this in a separate patch.
