• Andrey Ryabinin's avatar
    sched/numa: Fix out of bounds read in sched_init_numa() · c123588b
    Andrey Ryabinin authored
    On latest mm + KASan patchset I've got this:
    
        ==================================================================
        BUG: AddressSanitizer: out of bounds access in sched_init_smp+0x3ba/0x62c at addr ffff88006d4bee6c
        =============================================================================
        BUG kmalloc-8 (Not tainted): kasan error
        -----------------------------------------------------------------------------
    
        Disabling lock debugging due to kernel taint
        INFO: Allocated in alloc_vfsmnt+0xb0/0x2c0 age=75 cpu=0 pid=0
         __slab_alloc+0x4b4/0x4f0
         __kmalloc_track_caller+0x15f/0x1e0
         kstrdup+0x44/0x90
         alloc_vfsmnt+0xb0/0x2c0
         vfs_kern_mount+0x35/0x190
         kern_mount_data+0x25/0x50
         pid_ns_prepare_proc+0x19/0x50
         alloc_pid+0x5e2/0x630
         copy_process.part.41+0xdf5/0x2aa0
         do_fork+0xf5/0x460
         kernel_thread+0x21/0x30
         rest_init+0x1e/0x90
         start_kernel+0x522/0x531
         x86_64_start_reservations+0x2a/0x2c
         x86_64_start_kernel+0x15b/0x16a
        INFO: Slab 0xffffea0001b52f80 objects=24 used=22 fp=0xffff88006d4befc0 flags=0x100000000004080
        INFO: Object 0xffff88006d4bed20 @offset=3360 fp=0xffff88006d4bee70
    
        Bytes b4 ffff88006d4bed10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  ........ZZZZZZZZ
        Object ffff88006d4bed20: 70 72 6f 63 00 6b 6b a5                          proc.kk.
        Redzone ffff88006d4bed28: cc cc cc cc cc cc cc cc                          ........
        Padding ffff88006d4bee68: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
        CPU: 0 PID: 1 Comm: swapper/0 Tainted: G    B          3.18.0-rc3-mm1+ #108
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
         ffff88006d4be000 0000000000000000 ffff88006d4bed20 ffff88006c86fd18
         ffffffff81cd0a59 0000000000000058 ffff88006d404240 ffff88006c86fd48
         ffffffff811fa3a8 ffff88006d404240 ffffea0001b52f80 ffff88006d4bed20
        Call Trace:
        dump_stack (lib/dump_stack.c:52)
        print_trailer (mm/slub.c:645)
        object_err (mm/slub.c:652)
        ? sched_init_smp (kernel/sched/core.c:6552 kernel/sched/core.c:7063)
        kasan_report_error (mm/kasan/report.c:102 mm/kasan/report.c:178)
        ? kasan_poison_shadow (mm/kasan/kasan.c:48)
        ? kasan_unpoison_shadow (mm/kasan/kasan.c:54)
        ? kasan_poison_shadow (mm/kasan/kasan.c:48)
        ? kasan_kmalloc (mm/kasan/kasan.c:311)
        __asan_load4 (mm/kasan/kasan.c:371)
        ? sched_init_smp (kernel/sched/core.c:6552 kernel/sched/core.c:7063)
        sched_init_smp (kernel/sched/core.c:6552 kernel/sched/core.c:7063)
        kernel_init_freeable (init/main.c:869 init/main.c:997)
        ? finish_task_switch (kernel/sched/sched.h:1036 kernel/sched/core.c:2248)
        ? rest_init (init/main.c:924)
        kernel_init (init/main.c:929)
        ? rest_init (init/main.c:924)
        ret_from_fork (arch/x86/kernel/entry_64.S:348)
        ? rest_init (init/main.c:924)
        Read of size 4 by task swapper/0:
        Memory state around the buggy address:
         ffff88006d4beb80: fc fc fc fc fc fc fc fc fc fc 00 fc fc fc fc fc
         ffff88006d4bec00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
         ffff88006d4bec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
         ffff88006d4bed00: fc fc fc fc 00 fc fc fc fc fc fc fc fc fc fc fc
         ffff88006d4bed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
        >ffff88006d4bee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc 04 fc
                                                                  ^
         ffff88006d4bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
         ffff88006d4bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
         ffff88006d4bef80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
         ffff88006d4bf000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
         ffff88006d4bf080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
        ==================================================================
    
    Zero 'level' (e.g. on non-NUMA system) causing out of bounds
    access in this line:
    
         sched_max_numa_distance = sched_domains_numa_distance[level - 1];
    
    Fix this by exiting from sched_init_numa() earlier.
    Signed-off-by: default avatarAndrey Ryabinin <a.ryabinin@samsung.com>
    Reviewed-by: default avatarRik van Riel <riel@redhat.com>
    Fixes: 9942f79b ("sched/numa: Export info needed for NUMA balancing on complex topologies")
    Cc: peterz@infradead.org
    Link: http://lkml.kernel.org/r/1415372020-1871-1-git-send-email-a.ryabinin@samsung.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    c123588b
core.c 196 KB