On Sun, Sep 27, 2020 at 11:12:23AM +0200, Dmitry Vyukov wrote:
> Hi printk maintainers,
>
> I've got the following out-of-bounds in printk code.
> This is on next-20200925. Config is attached.
> This is just on pr_cont("\n"). Something overreads the string.
>
> ==================================================================
> BUG: KASAN: global-out-of-bounds in memchr+0x65/0x80 lib/string.c:1058
> Read of size 1 at addr ffffffff8c68c860 by task swapper/0/0
Would be helpful to show the text before this, so we have a better idea of
where it happened.
-- Steve
>
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc6-next-20200925+ #43
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1
> 04/01/2014
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x14b/0x18f lib/dump_stack.c:118
> print_address_description.constprop.0.cold+0x5/0x4c5 mm/kasan/report.c:385
> __kasan_report mm/kasan/report.c:545 [inline]
> kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
> memchr+0x65/0x80 lib/string.c:1058
> memchr include/linux/string.h:450 [inline]
> record_print_text+0x22d/0x310 kernel/printk/printk.c:1369
> console_unlock+0x350/0xbc0 kernel/printk/printk.c:2477
> vprintk_emit+0x348/0x4b0 kernel/printk/printk.c:2021
> vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
> printk+0xba/0xed kernel/printk/printk.c:2069
> show_pwq+0x74d/0x7ee kernel/workqueue.c:4745
> show_workqueue_state.cold+0xd0/0x3c9 kernel/workqueue.c:4784
> wq_watchdog_timer_fn+0x2e5/0x370 kernel/workqueue.c:5798
> call_timer_fn+0x38/0x2d0 kernel/time/timer.c:1413
> expire_timers kernel/time/timer.c:1458 [inline]
> __run_timers kernel/time/timer.c:1755 [inline]
> __run_timers kernel/time/timer.c:1731 [inline]
> run_timer_softirq+0xad2/0x1440 kernel/time/timer.c:1770
> __do_softirq+0x1f0/0x6c4 kernel/softirq.c:298
> asm_call_irq_on_stack+0xf/0x20
