Search Linux Wireless

rtlwifi: rtl8192c_common: "BUG: KASAN: slab-out-of-bounds"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I ran a 4.9.7 kernel with CONFIG_KASAN=y on my machine and it detected the
following problem:

[   23.012238] rtl8192cu: MAC auto ON okay!
[   23.045656] rtl8192cu: Tx queue select: 0x05
[   23.541152] ==================================================================
[   23.541160] BUG: KASAN: slab-out-of-bounds in
rtl92c_dm_bt_coexist+0x858/0x1e40 [rtl8192c_common] at addr ffff8801c90edb08
[   23.541161] Read of size 1 by task kworker/0:1/38
[   23.541163] page:ffffea0007243800 count:1 mapcount:0 mapping:          (null)
index:0x0 compound_mapcount: 0
[   23.543194] flags: 0x8000000000004000(head)
[   23.545178] page dumped because: kasan: bad access detected
[   23.545181] CPU: 0 PID: 38 Comm: kworker/0:1 Not tainted 4.9.7-gentoo #3
[   23.545182] Hardware name: Gigabyte Technology Co., Ltd. To be filled by
O.E.M./Z77-DS3H, BIOS F11a 11/13/2013
[   23.545186] Workqueue: rtl92c_usb rtl_watchdog_wq_callback [rtlwifi]
[   23.545187]  0000000000000000 ffffffff829eea33 ffff8801d7f0fa30 ffff8801c90edb08
[   23.545189]  ffffffff824c0f09 ffff8801d4abee80 0000000000000004 0000000000000297
[   23.545191]  ffffffffc070b57c ffff8801c7aa7c48 ffff880100000004 ffffffff000003e8
[   23.545192] Call Trace:
[   23.545197]  [<ffffffff829eea33>] ? dump_stack+0x5c/0x79
[   23.545200]  [<ffffffff824c0f09>] ? kasan_report_error+0x4b9/0x4e0
[   23.545202]  [<ffffffffc070b57c>] ? _usb_read_sync+0x15c/0x280 [rtl_usb]
[   23.545204]  [<ffffffff824c0f75>] ? __asan_report_load1_noabort+0x45/0x50
[   23.545206]  [<ffffffffc06d7a88>] ? rtl92c_dm_bt_coexist+0x858/0x1e40
[rtl8192c_common]
[   23.545208]  [<ffffffffc06d7a88>] ? rtl92c_dm_bt_coexist+0x858/0x1e40
[rtl8192c_common]
[   23.545210]  [<ffffffffc06d0cbe>] ? rtl92c_dm_rf_saving+0x96e/0x1330
[rtl8192c_common]
[   23.545212]  [<ffffffffc06dab80>] ? rtl92c_dm_watchdog+0x1130/0x4590
[rtl8192c_common]
[   23.545214]  [<ffffffffc06d9a50>] ? rtl92c_dm_dynamic_txpower+0x9e0/0x9e0
[rtl8192c_common]
[   23.545216]  [<ffffffff8222038d>] ? pick_next_entity+0x18d/0x400
[   23.545218]  [<ffffffff8223fdde>] ? pick_next_task_fair+0xa6e/0xf60
[   23.545220]  [<ffffffff8207548a>] ? __switch_to+0x7ba/0x1160
[   23.545223]  [<ffffffffc0689a2b>] ? rtl_watchdog_wq_callback+0xb7b/0x1190
[rtlwifi]
[   23.545225]  [<ffffffffc0688eb0>] ? rtl_tx_mgmt_proc+0x2c0/0x2c0 [rtlwifi]
[   23.545228]  [<ffffffff82d1ecfe>] ? drm_fb_helper_dirty_work+0x25e/0x2f0
[   23.545230]  [<ffffffff83c65d20>] ? io_schedule_timeout+0x390/0x390
[   23.545233]  [<ffffffff82b8cef0>] ? update_attr.isra.2+0x170/0x170
[   23.545234]  [<ffffffff82b80a01>] ? fb_flashcursor+0x331/0x3e0
[   23.545237]  [<ffffffff821d7af9>] ? process_one_work+0x539/0x12b0
[   23.545239]  [<ffffffff821d894f>] ? worker_thread+0xdf/0x13e0
[   23.545240]  [<ffffffff8225343c>] ? __wake_up_common+0xbc/0x160
[   23.545242]  [<ffffffff821d8870>] ? process_one_work+0x12b0/0x12b0
[   23.545244]  [<ffffffff821e7f89>] ? kthread+0x1b9/0x210
[   23.545245]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.545247]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.545248]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.545250]  [<ffffffff83c724c5>] ? ret_from_fork+0x25/0x30
[   23.545251] Memory state around the buggy address:
[   23.545253]  ffff8801c90eda00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.545254]  ffff8801c90eda80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.545255] >ffff8801c90edb00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.545256]                       ^
[   23.545257]  ffff8801c90edb80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.545257]  ffff8801c90edc00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.545258] ==================================================================
[   23.545258] Disabling lock debugging due to kernel taint
[   23.545300] ==================================================================
[   23.545303] BUG: KASAN: slab-out-of-bounds in
rtl92c_dm_watchdog+0x3dfb/0x4590 [rtl8192c_common] at addr ffff8801c90edb1c
[   23.545304] Read of size 4 by task kworker/0:1/38
[   23.545305] page:ffffea0007243800 count:1 mapcount:0 mapping:          (null)
index:0x0 compound_mapcount: 0
[   23.547353] flags: 0x8000000000004000(head)
[   23.547354] page dumped because: kasan: bad access detected
[   23.547355] CPU: 0 PID: 38 Comm: kworker/0:1 Tainted: G    B
4.9.7-gentoo #3
[   23.547356] Hardware name: Gigabyte Technology Co., Ltd. To be filled by
O.E.M./Z77-DS3H, BIOS F11a 11/13/2013
[   23.547358] Workqueue: rtl92c_usb rtl_watchdog_wq_callback [rtlwifi]
[   23.547360]  0000000000000000 ffffffff829eea33 ffff8801d7f0fa80 ffff8801c90edb1c
[   23.547361]  ffffffff824c0f09 ffff8801c90e0748 ffff8801c90e1420 0000000000000297
[   23.547363]  ffff8801c90e1420 ffffffff824c0f75 ffff8801c90edb08 ffff8801c90edb08
[   23.547363] Call Trace:
[   23.547367]  [<ffffffff829eea33>] ? dump_stack+0x5c/0x79
[   23.547368]  [<ffffffff824c0f09>] ? kasan_report_error+0x4b9/0x4e0
[   23.547370]  [<ffffffff824c0f75>] ? __asan_report_load1_noabort+0x45/0x50
[   23.547371]  [<ffffffff824c1015>] ? __asan_report_load4_noabort+0x45/0x50
[   23.547373]  [<ffffffffc06dd84b>] ? rtl92c_dm_watchdog+0x3dfb/0x4590
[rtl8192c_common]
[   23.547375]  [<ffffffffc06dd84b>] ? rtl92c_dm_watchdog+0x3dfb/0x4590
[rtl8192c_common]
[   23.547377]  [<ffffffffc06d9a50>] ? rtl92c_dm_dynamic_txpower+0x9e0/0x9e0
[rtl8192c_common]
[   23.547378]  [<ffffffff8222038d>] ? pick_next_entity+0x18d/0x400
[   23.547380]  [<ffffffff8223fdde>] ? pick_next_task_fair+0xa6e/0xf60
[   23.547381]  [<ffffffff8207548a>] ? __switch_to+0x7ba/0x1160
[   23.547383]  [<ffffffffc0689a2b>] ? rtl_watchdog_wq_callback+0xb7b/0x1190
[rtlwifi]
[   23.547385]  [<ffffffffc0688eb0>] ? rtl_tx_mgmt_proc+0x2c0/0x2c0 [rtlwifi]
[   23.547387]  [<ffffffff82d1ecfe>] ? drm_fb_helper_dirty_work+0x25e/0x2f0
[   23.547388]  [<ffffffff83c65d20>] ? io_schedule_timeout+0x390/0x390
[   23.547390]  [<ffffffff82b8cef0>] ? update_attr.isra.2+0x170/0x170
[   23.547391]  [<ffffffff82b80a01>] ? fb_flashcursor+0x331/0x3e0
[   23.547393]  [<ffffffff821d7af9>] ? process_one_work+0x539/0x12b0
[   23.547394]  [<ffffffff821d894f>] ? worker_thread+0xdf/0x13e0
[   23.547396]  [<ffffffff8225343c>] ? __wake_up_common+0xbc/0x160
[   23.547398]  [<ffffffff821d8870>] ? process_one_work+0x12b0/0x12b0
[   23.547399]  [<ffffffff821e7f89>] ? kthread+0x1b9/0x210
[   23.547400]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.547401]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.547403]  [<ffffffff821e7dd0>] ? kthread_park+0x80/0x80
[   23.547404]  [<ffffffff83c724c5>] ? ret_from_fork+0x25/0x30
[   23.547405] Memory state around the buggy address:
[   23.547406]  ffff8801c90eda00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.547407]  ffff8801c90eda80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.547407] >ffff8801c90edb00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.547408]                             ^
[   23.547409]  ffff8801c90edb80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.547410]  ffff8801c90edc00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
[   23.547410] ==================================================================

-- 
Dmitry



[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux