Machine freezes after running KASAN KUnit test 21 with a GCC 13.2 built kernel but runs tests fine with a CLANG 18 build kernel (v6.9-rc5, 32bit ppc, PowerMac G4 DP)

[Erhard Furtner]

On Fri, 17 May 2024 15:02:28 +0200
Andrey Konovalov <andreyknvl at gmail.com> wrote:

> +Nico, who also encountered this issue.
> 
> Mailed a patch that should fix this:
> https://lore.kernel.org/linux-mm/20240517130118.759301-1-andrey.konovalov@linux.dev/T/#u
> 
> You can consider disabling CONFIG_FORTIFY_SOURCE for now as a workaround.
> 
> Thank you!

The patch fixes the issue on ppc too. Thanks!

The test run continues and I get a failing one later on (though not '31 rcu_uaf' Nico reported but) '65 vmalloc_oob':
[...]
BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x1d0/0x3cc
Read of size 1 at addr f10457f3 by task kunit_try_catch/190

CPU: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N 6.9.1-PMacG4-dirty #1
Hardware name: PowerMac3,1 7450 0x80000201 PowerMac
Call Trace:
[f197bd60] [c15f48ac] dump_stack_lvl+0x80/0xac (unreliable)
[f197bd80] [c04c3f14] print_report+0xd4/0x4fc
[f197bdd0] [c04c456c] kasan_report+0xf8/0x10c
[f197be50] [c04c723c] vmalloc_oob+0x1d0/0x3cc
[f197bed0] [c0c29e98] kunit_try_run_case+0x3bc/0x5d8
[f197bfa0] [c0c2f1c8] kunit_generic_run_threadfn_adapter+0xa4/0xf8
[f197bfc0] [c00facf8] kthread+0x384/0x394
[f197bff0] [c002e304] start_kernel_thread+0x10/0x14

The buggy address belongs to the virtual mapping at
 [f1045000, f1047000) created by:
 vmalloc_oob+0x70/0x3cc

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x79f8b
flags: 0x80000000(zone=2)
page_type: 0xffffffff()
raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001
raw: 00000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 f1045680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 f1045700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>f1045780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
                                                     ^
 f1045800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 f1045880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x294/0x3cc
Read of size 1 at addr f10457f8 by task kunit_try_catch/190

CPU: 0 PID: 190 Comm: kunit_try_catch Tainted: G    B            N 6.9.1-PMacG4-dirty #1
Hardware name: PowerMac3,1 7450 0x80000201 PowerMac
Call Trace:
[f197bd60] [c15f48ac] dump_stack_lvl+0x80/0xac (unreliable)
[f197bd80] [c04c3f14] print_report+0xd4/0x4fc
[f197bdd0] [c04c456c] kasan_report+0xf8/0x10c
[f197be50] [c04c7300] vmalloc_oob+0x294/0x3cc
[f197bed0] [c0c29e98] kunit_try_run_case+0x3bc/0x5d8
[f197bfa0] [c0c2f1c8] kunit_generic_run_threadfn_adapter+0xa4/0xf8
[f197bfc0] [c00facf8] kthread+0x384/0x394
[f197bff0] [c002e304] start_kernel_thread+0x10/0x14

The buggy address belongs to the virtual mapping at
 [f1045000, f1047000) created by:
 vmalloc_oob+0x70/0x3cc

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x79f8b
flags: 0x80000000(zone=2)
page_type: 0xffffffff()
raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001
raw: 00000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 f1045680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 f1045700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>f1045780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f8
                                                        ^
 f1045800: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 f1045880: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
    # vmalloc_oob: ASSERTION FAILED at mm/kasan/kasan_test.c:1680
    Expected p_ptr is not null, but is
    not ok 65 vmalloc_oob
[...]

This is in line with my CLANG 18 build where I get the same vmalloc_oob failure: https://github.com/ClangBuiltLinux/linux/issues/2020.

There Nathan already found out this happens when the machine got more than 867 MB of RAM. Probably this test failing may be a ppc specific issue. I can also open a new thread for that if you'd like.

I run my attached .config kernel build on qemu via: qemu-system-ppc -machine mac99,via=pmu -cpu 7450 -m 2G -nographic -append console=ttyS0 -kernel /var/cache/distfiles/vmlinux-6.9.1-PMacG4-dirty -hda Debian-VM_g4.img

Regards,
Erhard
-------------- next part --------------
A non-text attachment was scrubbed...
Name: config_691_g4+
Type: application/octet-stream
Size: 112181 bytes
Desc: not available
URL: <http://lists.ozlabs.org/pipermail/linuxppc-dev/attachments/20240518/ad1252c9/attachment-0001.obj>