# git rev-parse -q --verify ba439a6cbfa2936a6713f64cb499de7943673fe3^{commit} # git fetch -q -n -f git://fs.ozlabs.ibm.com/kernel/crypto master error: The last gc run reported the following. Please correct the root cause and remove .git/gc.log. Automatic cleanup will not be performed until the file is removed. warning: There are too many unreachable loose objects; run 'git prune' to remove them. # git rev-parse -q --verify ba439a6cbfa2936a6713f64cb499de7943673fe3^{commit} ba439a6cbfa2936a6713f64cb499de7943673fe3 # git checkout -q -f -B kisskb ba439a6cbfa2936a6713f64cb499de7943673fe3 # git clean -qxdf # < git log -1 # commit ba439a6cbfa2936a6713f64cb499de7943673fe3 # Author: Waiman Long # Date: Sat Sep 22 20:41:55 2018 -0400 # # crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe() # # The following KASAN warning was printed when booting a 64-bit kernel # on some systems with Intel CPUs: # # [ 44.512826] ================================================================== # [ 44.520165] BUG: KASAN: stack-out-of-bounds in find_first_bit+0xb0/0xc0 # [ 44.526786] Read of size 8 at addr ffff88041e02fc50 by task kworker/0:2/124 # # [ 44.535253] CPU: 0 PID: 124 Comm: kworker/0:2 Tainted: G X --------- --- 4.18.0-12.el8.x86_64+debug #1 # [ 44.545858] Hardware name: Intel Corporation PURLEY/PURLEY, BIOS BKVDTRL1.86B.0005.D08.1712070559 12/07/2017 # [ 44.555682] Workqueue: events work_for_cpu_fn # [ 44.560043] Call Trace: # [ 44.562502] dump_stack+0x9a/0xe9 # [ 44.565832] print_address_description+0x65/0x22e # [ 44.570683] ? find_first_bit+0xb0/0xc0 # [ 44.570689] kasan_report.cold.6+0x92/0x19f # [ 44.578726] find_first_bit+0xb0/0xc0 # [ 44.578737] adf_probe+0x9eb/0x19a0 [qat_c62x] # [ 44.578751] ? adf_remove+0x110/0x110 [qat_c62x] # [ 44.591490] ? mark_held_locks+0xc8/0x140 # [ 44.591498] ? _raw_spin_unlock+0x30/0x30 # [ 44.591505] ? trace_hardirqs_on_caller+0x381/0x570 # [ 44.604418] ? adf_remove+0x110/0x110 [qat_c62x] # [ 44.604427] local_pci_probe+0xd4/0x180 # [ 44.604432] ? pci_device_shutdown+0x110/0x110 # [ 44.617386] work_for_cpu_fn+0x51/0xa0 # [ 44.621145] process_one_work+0x8fe/0x16e0 # [ 44.625263] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 # [ 44.629799] ? lock_acquire+0x14c/0x400 # [ 44.633645] ? move_linked_works+0x12e/0x2a0 # [ 44.637928] worker_thread+0x536/0xb50 # [ 44.641690] ? __kthread_parkme+0xb6/0x180 # [ 44.645796] ? process_one_work+0x16e0/0x16e0 # [ 44.650160] kthread+0x30c/0x3d0 # [ 44.653400] ? kthread_create_worker_on_cpu+0xc0/0xc0 # [ 44.658457] ret_from_fork+0x3a/0x50 # # [ 44.663557] The buggy address belongs to the page: # [ 44.668350] page:ffffea0010780bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 # [ 44.676356] flags: 0x17ffffc0000000() # [ 44.680023] raw: 0017ffffc0000000 ffffea0010780bc8 ffffea0010780bc8 0000000000000000 # [ 44.687769] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 # [ 44.695510] page dumped because: kasan: bad access detected # # [ 44.702578] Memory state around the buggy address: # [ 44.707372] ffff88041e02fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # [ 44.714593] ffff88041e02fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # [ 44.721810] >ffff88041e02fc00: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 # [ 44.729028] ^ # [ 44.734864] ffff88041e02fc80: f2 f2 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 # [ 44.742082] ffff88041e02fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # [ 44.749299] ================================================================== # # Looking into the code: # # int ret, bar_mask; # : # for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, # # It is casting a 32-bit integer pointer to a 64-bit unsigned long # pointer. There are two problems here. First, the 32-bit pointer address # may not be 64-bit aligned. Secondly, it is accessing an extra 4 bytes. # # This is fixed by changing the bar_mask type to unsigned long. # # Cc: # Signed-off-by: Waiman Long # Signed-off-by: Herbert Xu # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < git log --format=%s --max-count=1 ba439a6cbfa2936a6713f64cb499de7943673fe3 # < make -s -j 10 ARCH=powerpc O=/kisskb/build/crypto_pseries_defconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- pseries_defconfig # make -s -j 10 ARCH=powerpc O=/kisskb/build/crypto_pseries_defconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/kernel/cgroup/cgroup-v1.c: In function 'cgroup1_mount': /kisskb/src/kernel/cgroup/cgroup-v1.c:1256:20: warning: 'root' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:185:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/mm/swap_state.c: In function '__add_to_swap_cache': /kisskb/src/mm/swap_state.c:135:5: warning: 'error' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/mm/hugetlb.c: In function 'alloc_pool_huge_page': /kisskb/src/mm/hugetlb.c:1433:5: warning: 'page' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function 'regmap_raw_read': /kisskb/src/drivers/base/regmap/regmap.c:2511:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function '_regmap_raw_write': /kisskb/src/drivers/base/regmap/regmap.c:1833:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/bridge/br_netlink.c: In function 'br_afspec': /kisskb/src/net/bridge/br_netlink.c:647:7: warning: 'err' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/i2c/i2c-core-base.c: In function 'i2c_generic_scl_recovery': /kisskb/src/drivers/i2c/i2c-core-base.c:235:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:65:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:341:21: note: 'pdeo' was declared here /kisskb/src/fs/nfsd/nfs4xdr.c: In function 'nfsd4_encode_components_esc': /kisskb/src/fs/nfsd/nfs4xdr.c:2069:9: warning: 'str' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/udf/unicode.c: In function 'udf_name_conv_char': /kisskb/src/fs/udf/unicode.c:132:8: warning: 'c' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c: In function 'tun_get_user': /kisskb/src/drivers/net/tun.c:1836:30: warning: 'copylen' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c:1746:46: warning: 'linear' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/tty/serial/8250/8250_core.c: In function 'univ8250_release_irq': /kisskb/src/drivers/tty/serial/8250/8250_core.c:251:18: warning: 'i' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/tty/serial/8250/8250_core.c:231:19: note: 'i' was declared here Completed OK # rm -rf /kisskb/build/crypto_pseries_defconfig_powerpc # Build took: 0:02:54.720374