Hello, kernel test robot noticed "BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors" on: commit: b8fb6db6cb04e3c35d661d0f6cf6f8dc7444ce0c ("usb: f_uac1: adds support for SS and SSP") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master [test failed on linus/master abf2050f51fdca0fd146388f83cddd95a57a008d] [test failed on linux-next/master ef545bc03a65438cabe87beb1b9a15b0ffcb6ace] in testcase: boot compiler: clang-18 test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G (please refer to attached dmesg/kmsg for entire log/backtrace) +--------------------------------------------------------+------------+------------+ | | 36d586c057 | b8fb6db6cb | +--------------------------------------------------------+------------+------------+ | BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors | 0 | 6 | +--------------------------------------------------------+------------+------------+ If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <oliver.sang@xxxxxxxxx> | Closes: https://lore.kernel.org/oe-lkp/202409242143.d9949646-lkp@xxxxxxxxx [ 112.946534][ T1] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors (ld-temp.o:?) [ 112.947205][ T1] Read of size 160 at addr ffffffff87d27da0 by task swapper/1 [ 112.947348][ T1] [ 112.947348][ T1] CPU: 0 PID: 1 Comm: swapper Tainted: G T 6.7.0-rc5-00081-gb8fb6db6cb04 #1 0b74b627eecd14071872650b3288b2fae55c3c90 [ 112.947348][ T1] Call Trace: [ 112.947348][ T1] <TASK> [ 112.947348][ T1] dump_stack_lvl (ld-temp.o:?) [ 112.947348][ T1] print_report (ld-temp.o:?) [ 112.947348][ T1] ? start_report (ld-temp.o:?) [ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) [ 112.947348][ T1] kasan_report (ld-temp.o:?) [ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) [ 112.947348][ T1] kasan_check_range (ld-temp.o:?) [ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) [ 112.947348][ T1] __asan_memcpy (ld-temp.o:?) [ 112.947348][ T1] usb_copy_descriptors (ld-temp.o:?) [ 112.947348][ T1] usb_assign_descriptors (ld-temp.o:?) [ 112.947348][ T1] f_audio_bind (ld-temp.o:?) [ 112.947348][ T1] usb_add_function (ld-temp.o:?) [ 112.947348][ T1] ? f_audio_alloc (ld-temp.o:?) [ 112.947348][ T1] ? __cfi_audio_do_config (ld-temp.o:?) [ 112.947348][ T1] audio_do_config (ld-temp.o:?) [ 112.947348][ T1] usb_add_config (ld-temp.o:?) [ 112.947348][ T1] ? try_get_usb_function_instance (ld-temp.o:?) [ 112.947348][ T1] ? usb_get_function_instance (ld-temp.o:?) [ 112.947348][ T1] audio_bind (ld-temp.o:?) [ 112.947348][ T1] composite_bind (ld-temp.o:?) [ 112.947348][ T1] ? really_probe (ld-temp.o:?) [ 112.947348][ T1] ? __cfi_composite_bind (ld-temp.o:?) [ 112.947348][ T1] gadget_bind_driver (ld-temp.o:?) [ 112.947348][ T1] ? really_probe (ld-temp.o:?) [ 112.947348][ T1] really_probe (ld-temp.o:?) [ 112.947348][ T1] __driver_probe_device (ld-temp.o:?) [ 112.947348][ T1] driver_probe_device (ld-temp.o:?) [ 112.947348][ T1] __device_attach_driver (ld-temp.o:?) [ 112.947348][ T1] ? __cfi___device_attach_driver (ld-temp.o:?) [ 112.947348][ T1] bus_for_each_drv (ld-temp.o:?) [ 112.947348][ T1] __device_attach (ld-temp.o:?) [ 112.947348][ T1] ? bus_probe_device (ld-temp.o:?) [ 112.947348][ T1] bus_probe_device (ld-temp.o:?) [ 112.947348][ T1] device_add (ld-temp.o:?) [ 112.947348][ T1] usb_add_gadget (ld-temp.o:?) [ 112.947348][ T1] ? usb_add_gadget_udc_release (ld-temp.o:?) [ 112.947348][ T1] ? __cfi_usb_udc_nop_release (ld-temp.o:?) [ 112.947348][ T1] usb_add_gadget_udc_release (ld-temp.o:?) [ 112.947348][ T1] vudc_probe (ld-temp.o:?) [ 112.947348][ T1] platform_probe (ld-temp.o:?) [ 112.947348][ T1] really_probe (ld-temp.o:?) [ 112.947348][ T1] __driver_probe_device (ld-temp.o:?) [ 112.947348][ T1] driver_probe_device (ld-temp.o:?) [ 112.947348][ T1] __device_attach_driver (ld-temp.o:?) [ 112.947348][ T1] ? __cfi___device_attach_driver (ld-temp.o:?) [ 112.947348][ T1] bus_for_each_drv (ld-temp.o:?) [ 112.947348][ T1] __device_attach (ld-temp.o:?) [ 112.947348][ T1] ? bus_probe_device (ld-temp.o:?) [ 112.947348][ T1] bus_probe_device (ld-temp.o:?) [ 112.947348][ T1] device_add (ld-temp.o:?) [ 112.947348][ T1] platform_device_add (ld-temp.o:?) [ 112.947348][ T1] ? platform_device_alloc (ld-temp.o:?) [ 112.947348][ T1] vudc_init (ld-temp.o:?) [ 112.947348][ T1] do_one_initcall (init/main.c:1236) [ 112.947348][ T1] ? __cfi___initstub__kmod_usbip_vudc__683_89_vudc_init6 (ld-temp.o:?) [ 112.947348][ T1] ? lockdep_hardirqs_on_prepare (ld-temp.o:?) [ 112.947348][ T1] ? __schedule (ld-temp.o:?) [ 112.947348][ T1] ? lockdep_hardirqs_on_prepare (ld-temp.o:?) [ 112.947348][ T1] ? irqentry_exit (ld-temp.o:?) [ 112.947348][ T1] ? parameq (ld-temp.o:?) [ 112.947348][ T1] ? __cfi_ignore_unknown_bootoption (init/main.c:1283) [ 112.947348][ T1] ? parse_args (ld-temp.o:?) [ 112.947348][ T1] ? __kasan_slab_alloc (ld-temp.o:?) [ 112.947348][ T1] do_initcall_level (init/main.c:1297) [ 112.947348][ T1] do_initcalls (init/main.c:1311) [ 112.947348][ T1] kernel_init_freeable (init/main.c:1555) [ 112.947348][ T1] ? __cfi_kernel_init (init/main.c:1439) [ 112.947348][ T1] kernel_init (kernel/async.c:254 kernel/async.c:241 init/main.c:1443) [ 112.947348][ T1] ret_from_fork (ld-temp.o:?) [ 112.947348][ T1] ? __cfi_kernel_init (init/main.c:1439) [ 112.947348][ T1] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) [ 112.947348][ T1] </TASK> [ 112.947348][ T1] [ 112.947348][ T1] The buggy address belongs to the variable: [ 112.947348][ T1] ac_header_desc+0x0/0x20 [ 112.947348][ T1] [ 112.947348][ T1] The buggy address belongs to the physical page: [ 112.947348][ T1] page:ffffea00001f49c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d27 [ 112.947348][ T1] flags: 0x4000(reserved|zone=0) [ 112.947348][ T1] page_type: 0xffffffff() [ 112.947348][ T1] raw: 0000000000004000 ffffea00001f49c8 ffffea00001f49c8 0000000000000000 [ 112.947348][ T1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 112.947348][ T1] page dumped because: kasan: bad access detected [ 112.947348][ T1] page_owner info is not present (never set?) [ 112.947348][ T1] [ 112.947348][ T1] Memory state around the buggy address: [ 112.947348][ T1] ffffffff87d27c80: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 [ 112.947348][ T1] ffffffff87d27d00: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 [ 112.947348][ T1] >ffffffff87d27d80: 00 00 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 [ 112.947348][ T1] ^ [ 112.947348][ T1] ffffffff87d27e00: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 [ 112.947348][ T1] ffffffff87d27e80: 00 f9 f9 f9 00 f9 f9 f9 00 00 f9 f9 00 00 f9 f9 [ 112.947348][ T1] ================================================================== [ 113.005042][ T1] Disabling lock debugging due to kernel taint The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20240924/202409242143.d9949646-lkp@xxxxxxxxx -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki