| Message ID | 20200106163735.1826-1-cai@lca.pw (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | [-next] drivers/base/test: fix global-out-of-bounds error | expand |
On Mon, Jan 06, 2020 at 11:37:35AM -0500, Qian Cai wrote: > The commit c032ace71c29 ("software node: add basic tests for property > entries") introduced a global-out-of-bounds error because it forgot to > add a terminator of "nodes "for software_node_register_nodes() to > process. > > # Subtest: property-entry > 1..7 > ok 1 - pe_test_uints > ok 2 - pe_test_uint_arrays > ok 3 - pe_test_strings > ok 4 - pe_test_bool > ok 5 - pe_test_move_inline_u8 > ok 6 - pe_test_move_inline_str > ================================================================== > BUG: KASAN: global-out-of-bounds in > software_node_register_nodes+0x41/0x80 > Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316 > > CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted > 5.5.0-rc4-next-20200106+ #1 > Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 > 03/09/2018 > Call Trace: > dump_stack+0xa0/0xea > print_address_description.constprop.5.cold.7+0x64/0x384 > __kasan_report.cold.8+0x7a/0xc0 > kasan_report+0x12/0x20 > __asan_load8+0x71/0xa0 > software_node_register_nodes+0x41/0x80 > pe_test_reference+0x1eb/0x1200 > kunit_try_run_case+0x6b/0xd1 > kunit_generic_run_threadfn_adapter+0x29/0x50 > kthread+0x1e6/0x210 > ret_from_fork+0x27/0x50 > > The buggy address belongs to the variable: > nodes.21544+0x30/0x920 > > Memory state around the buggy address: > ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00 > ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa > ^ > ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa > ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa > ================================================================== > Disabling lock debugging due to kernel taint > ok 7 - pe_test_reference > ok 8 - property-entry > > Fixes: c032ace71c29 ("software node: add basic tests for property entries") > Signed-off-by: Qian Cai <cai@lca.pw> Thanks Qian. Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> > --- > drivers/base/test/property-entry-test.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c > index da812834b631..abe03315180f 100644 > --- a/drivers/base/test/property-entry-test.c > +++ b/drivers/base/test/property-entry-test.c > @@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test) > static const struct software_node nodes[] = { > { .name = "1", }, > { .name = "2", }, > + { } > }; > > static const struct software_node_ref_args refs[] = { > -- > 2.21.0 (Apple Git-122.2) >
On Mon, Jan 6, 2020 at 11:35 PM Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote: > > On Mon, Jan 06, 2020 at 11:37:35AM -0500, Qian Cai wrote: > > The commit c032ace71c29 ("software node: add basic tests for property > > entries") introduced a global-out-of-bounds error because it forgot to > > add a terminator of "nodes "for software_node_register_nodes() to > > process. > > > > # Subtest: property-entry > > 1..7 > > ok 1 - pe_test_uints > > ok 2 - pe_test_uint_arrays > > ok 3 - pe_test_strings > > ok 4 - pe_test_bool > > ok 5 - pe_test_move_inline_u8 > > ok 6 - pe_test_move_inline_str > > ================================================================== > > BUG: KASAN: global-out-of-bounds in > > software_node_register_nodes+0x41/0x80 > > Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316 > > > > CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted > > 5.5.0-rc4-next-20200106+ #1 > > Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 > > 03/09/2018 > > Call Trace: > > dump_stack+0xa0/0xea > > print_address_description.constprop.5.cold.7+0x64/0x384 > > __kasan_report.cold.8+0x7a/0xc0 > > kasan_report+0x12/0x20 > > __asan_load8+0x71/0xa0 > > software_node_register_nodes+0x41/0x80 > > pe_test_reference+0x1eb/0x1200 > > kunit_try_run_case+0x6b/0xd1 > > kunit_generic_run_threadfn_adapter+0x29/0x50 > > kthread+0x1e6/0x210 > > ret_from_fork+0x27/0x50 > > > > The buggy address belongs to the variable: > > nodes.21544+0x30/0x920 > > > > Memory state around the buggy address: > > ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00 > > ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa > > ^ > > ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa > > ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa > > ================================================================== > > Disabling lock debugging due to kernel taint > > ok 7 - pe_test_reference > > ok 8 - property-entry > > > > Fixes: c032ace71c29 ("software node: add basic tests for property entries") > > Signed-off-by: Qian Cai <cai@lca.pw> > > Thanks Qian. > > Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Applied, thanks! > > --- > > drivers/base/test/property-entry-test.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c > > index da812834b631..abe03315180f 100644 > > --- a/drivers/base/test/property-entry-test.c > > +++ b/drivers/base/test/property-entry-test.c > > @@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test) > > static const struct software_node nodes[] = { > > { .name = "1", }, > > { .name = "2", }, > > + { } > > }; > > > > static const struct software_node_ref_args refs[] = { > > --
diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c index da812834b631..abe03315180f 100644 --- a/drivers/base/test/property-entry-test.c +++ b/drivers/base/test/property-entry-test.c @@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test) static const struct software_node nodes[] = { { .name = "1", }, { .name = "2", }, + { } }; static const struct software_node_ref_args refs[] = {
The commit c032ace71c29 ("software node: add basic tests for property entries") introduced a global-out-of-bounds error because it forgot to add a terminator of "nodes "for software_node_register_nodes() to process. # Subtest: property-entry 1..7 ok 1 - pe_test_uints ok 2 - pe_test_uint_arrays ok 3 - pe_test_strings ok 4 - pe_test_bool ok 5 - pe_test_move_inline_u8 ok 6 - pe_test_move_inline_str ================================================================== BUG: KASAN: global-out-of-bounds in software_node_register_nodes+0x41/0x80 Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316 CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted 5.5.0-rc4-next-20200106+ #1 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 03/09/2018 Call Trace: dump_stack+0xa0/0xea print_address_description.constprop.5.cold.7+0x64/0x384 __kasan_report.cold.8+0x7a/0xc0 kasan_report+0x12/0x20 __asan_load8+0x71/0xa0 software_node_register_nodes+0x41/0x80 pe_test_reference+0x1eb/0x1200 kunit_try_run_case+0x6b/0xd1 kunit_generic_run_threadfn_adapter+0x29/0x50 kthread+0x1e6/0x210 ret_from_fork+0x27/0x50 The buggy address belongs to the variable: nodes.21544+0x30/0x920 Memory state around the buggy address: ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00 ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa ^ ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa ================================================================== Disabling lock debugging due to kernel taint ok 7 - pe_test_reference ok 8 - property-entry Fixes: c032ace71c29 ("software node: add basic tests for property entries") Signed-off-by: Qian Cai <cai@lca.pw> --- drivers/base/test/property-entry-test.c | 1 + 1 file changed, 1 insertion(+)