Hi Russell:
Kingly ping
Thanks.
Boy.
On Fri, 2023-12-22 at 10:27 +0800, boy.wu wrote:
> From: Boy Wu <boy.wu@xxxxxxxxxxxx>
>
> We found below OOB crash:
>
> [ 33.452494]
> ==================================================================
> [ 33.453513] BUG: KASAN: stack-out-of-bounds in
> refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec
> [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0
> [ 33.455515]
> [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted:
> G O 6.1.25-mainline #1
> [ 33.456880] Hardware name: Generic DT based system
> [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c
> [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c
> [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4
> [ 33.459863] print_report from kasan_report+0x9c/0x148
> [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0
> [ 33.461424] kasan_check_range from memset+0x20/0x3c
> [ 33.462157] memset from
> refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec
> [ 33.463064] refresh_cpu_vm_stats.constprop.0 from
> tick_nohz_idle_stop_tick+0x180/0x53c
> [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354
> [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24
> [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4
> [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18
> [ 33.467397]
> [ 33.467644] The buggy address belongs to stack of task swapper/0/0
> [ 33.468493] and is located at offset 112 in frame:
> [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec
> [ 33.469917]
> [ 33.470165] This frame has 2 objects:
> [ 33.470696] [32, 76) 'global_zone_diff'
> [ 33.470729] [112, 276) 'global_node_diff'
> [ 33.471294]
> [ 33.472095] The buggy address belongs to the physical page:
> [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000
> index:0x0 pfn:0x41d03
> [ 33.473944] flags: 0x1000(reserved|zone=0)
> [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000
> 00000000 ffffffff 00000001
> [ 33.475656] raw: 00000000
> [ 33.476050] page dumped because: kasan: bad access detected
> [ 33.476816]
> [ 33.477061] Memory state around the buggy address:
> [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00
> [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
> 00 00
> [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1
> f1 f1
> [ 33.480415] ^
> [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3
> f3 f3
> [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
> 00 00
> [ 33.482978]
> ==================================================================
>
> We find the root cause of this OOB is that arm does not clear stale
> stack
> poison in the case of cpuidle.
>
> This patch refer to arch/arm64/kernel/sleep.S to resolve this issue.
>
> Signed-off-by: Boy Wu <boy.wu@xxxxxxxxxxxx>
> ---
> arch/arm/kernel/sleep.S | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
> index a86a1d4f3461..93afd1005b43 100644
> --- a/arch/arm/kernel/sleep.S
> +++ b/arch/arm/kernel/sleep.S
> @@ -127,6 +127,10 @@ cpu_resume_after_mmu:
> instr_sync
> #endif
> bl cpu_init @ restore the und/abt/irq
> banked regs
> +#if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK)
> + mov r0, sp
> + bl kasan_unpoison_task_stack_below
> +#endif
> mov r0, #0 @ return zero on success
> ldmfd sp!, {r4 - r11, pc}
> ENDPROC(cpu_resume_after_mmu)
