[linus:master] [usb] b8fb6db6cb: BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




Hello,

kernel test robot noticed "BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors" on:

commit: b8fb6db6cb04e3c35d661d0f6cf6f8dc7444ce0c ("usb: f_uac1: adds support for SS and SSP")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

[test failed on linus/master      abf2050f51fdca0fd146388f83cddd95a57a008d]
[test failed on linux-next/master ef545bc03a65438cabe87beb1b9a15b0ffcb6ace]

in testcase: boot

compiler: clang-18
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+--------------------------------------------------------+------------+------------+
|                                                        | 36d586c057 | b8fb6db6cb |
+--------------------------------------------------------+------------+------------+
| BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors | 0          | 6          |
+--------------------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202409242143.d9949646-lkp@xxxxxxxxx


[ 112.946534][ T1] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors (ld-temp.o:?) 
[  112.947205][    T1] Read of size 160 at addr ffffffff87d27da0 by task swapper/1
[  112.947348][    T1]
[  112.947348][    T1] CPU: 0 PID: 1 Comm: swapper Tainted: G                T  6.7.0-rc5-00081-gb8fb6db6cb04 #1 0b74b627eecd14071872650b3288b2fae55c3c90
[  112.947348][    T1] Call Trace:
[  112.947348][    T1]  <TASK>
[ 112.947348][ T1] dump_stack_lvl (ld-temp.o:?) 
[ 112.947348][ T1] print_report (ld-temp.o:?) 
[ 112.947348][ T1] ? start_report (ld-temp.o:?) 
[ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) 
[ 112.947348][ T1] kasan_report (ld-temp.o:?) 
[ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) 
[ 112.947348][ T1] kasan_check_range (ld-temp.o:?) 
[ 112.947348][ T1] ? usb_copy_descriptors (ld-temp.o:?) 
[ 112.947348][ T1] __asan_memcpy (ld-temp.o:?) 
[ 112.947348][ T1] usb_copy_descriptors (ld-temp.o:?) 
[ 112.947348][ T1] usb_assign_descriptors (ld-temp.o:?) 
[ 112.947348][ T1] f_audio_bind (ld-temp.o:?) 
[ 112.947348][ T1] usb_add_function (ld-temp.o:?) 
[ 112.947348][ T1] ? f_audio_alloc (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi_audio_do_config (ld-temp.o:?) 
[ 112.947348][ T1] audio_do_config (ld-temp.o:?) 
[ 112.947348][ T1] usb_add_config (ld-temp.o:?) 
[ 112.947348][ T1] ? try_get_usb_function_instance (ld-temp.o:?) 
[ 112.947348][ T1] ? usb_get_function_instance (ld-temp.o:?) 
[ 112.947348][ T1] audio_bind (ld-temp.o:?) 
[ 112.947348][ T1] composite_bind (ld-temp.o:?) 
[ 112.947348][ T1] ? really_probe (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi_composite_bind (ld-temp.o:?) 
[ 112.947348][ T1] gadget_bind_driver (ld-temp.o:?) 
[ 112.947348][ T1] ? really_probe (ld-temp.o:?) 
[ 112.947348][ T1] really_probe (ld-temp.o:?) 
[ 112.947348][ T1] __driver_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] driver_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] __device_attach_driver (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi___device_attach_driver (ld-temp.o:?) 
[ 112.947348][ T1] bus_for_each_drv (ld-temp.o:?) 
[ 112.947348][ T1] __device_attach (ld-temp.o:?) 
[ 112.947348][ T1] ? bus_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] bus_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] device_add (ld-temp.o:?) 
[ 112.947348][ T1] usb_add_gadget (ld-temp.o:?) 
[ 112.947348][ T1] ? usb_add_gadget_udc_release (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi_usb_udc_nop_release (ld-temp.o:?) 
[ 112.947348][ T1] usb_add_gadget_udc_release (ld-temp.o:?) 
[ 112.947348][ T1] vudc_probe (ld-temp.o:?) 
[ 112.947348][ T1] platform_probe (ld-temp.o:?) 
[ 112.947348][ T1] really_probe (ld-temp.o:?) 
[ 112.947348][ T1] __driver_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] driver_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] __device_attach_driver (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi___device_attach_driver (ld-temp.o:?) 
[ 112.947348][ T1] bus_for_each_drv (ld-temp.o:?) 
[ 112.947348][ T1] __device_attach (ld-temp.o:?) 
[ 112.947348][ T1] ? bus_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] bus_probe_device (ld-temp.o:?) 
[ 112.947348][ T1] device_add (ld-temp.o:?) 
[ 112.947348][ T1] platform_device_add (ld-temp.o:?) 
[ 112.947348][ T1] ? platform_device_alloc (ld-temp.o:?) 
[ 112.947348][ T1] vudc_init (ld-temp.o:?) 
[ 112.947348][ T1] do_one_initcall (init/main.c:1236) 
[ 112.947348][ T1] ? __cfi___initstub__kmod_usbip_vudc__683_89_vudc_init6 (ld-temp.o:?) 
[ 112.947348][ T1] ? lockdep_hardirqs_on_prepare (ld-temp.o:?) 
[ 112.947348][ T1] ? __schedule (ld-temp.o:?) 
[ 112.947348][ T1] ? lockdep_hardirqs_on_prepare (ld-temp.o:?) 
[ 112.947348][ T1] ? irqentry_exit (ld-temp.o:?) 
[ 112.947348][ T1] ? parameq (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi_ignore_unknown_bootoption (init/main.c:1283) 
[ 112.947348][ T1] ? parse_args (ld-temp.o:?) 
[ 112.947348][ T1] ? __kasan_slab_alloc (ld-temp.o:?) 
[ 112.947348][ T1] do_initcall_level (init/main.c:1297) 
[ 112.947348][ T1] do_initcalls (init/main.c:1311) 
[ 112.947348][ T1] kernel_init_freeable (init/main.c:1555) 
[ 112.947348][ T1] ? __cfi_kernel_init (init/main.c:1439) 
[ 112.947348][ T1] kernel_init (kernel/async.c:254 kernel/async.c:241 init/main.c:1443) 
[ 112.947348][ T1] ret_from_fork (ld-temp.o:?) 
[ 112.947348][ T1] ? __cfi_kernel_init (init/main.c:1439) 
[ 112.947348][ T1] ret_from_fork_asm (arch/x86/entry/entry_64.S:250) 
[  112.947348][    T1]  </TASK>
[  112.947348][    T1]
[  112.947348][    T1] The buggy address belongs to the variable:
[ 112.947348][ T1] ac_header_desc+0x0/0x20 
[  112.947348][    T1]
[  112.947348][    T1] The buggy address belongs to the physical page:
[  112.947348][    T1] page:ffffea00001f49c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d27
[  112.947348][    T1] flags: 0x4000(reserved|zone=0)
[  112.947348][    T1] page_type: 0xffffffff()
[  112.947348][    T1] raw: 0000000000004000 ffffea00001f49c8 ffffea00001f49c8 0000000000000000
[  112.947348][    T1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[  112.947348][    T1] page dumped because: kasan: bad access detected
[  112.947348][    T1] page_owner info is not present (never set?)
[  112.947348][    T1]
[  112.947348][    T1] Memory state around the buggy address:
[  112.947348][    T1]  ffffffff87d27c80: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9
[  112.947348][    T1]  ffffffff87d27d00: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9
[  112.947348][    T1] >ffffffff87d27d80: 00 00 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9
[  112.947348][    T1]                                   ^
[  112.947348][    T1]  ffffffff87d27e00: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9
[  112.947348][    T1]  ffffffff87d27e80: 00 f9 f9 f9 00 f9 f9 f9 00 00 f9 f9 00 00 f9 f9
[  112.947348][    T1] ==================================================================
[  113.005042][    T1] Disabling lock debugging due to kernel taint



The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240924/202409242143.d9949646-lkp@xxxxxxxxx



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki





[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux