Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     Nathan Lynch <nathanl@linux.ibm.com>
CC:     Yury Norov <yury.norov@gmail.com>,
        "linuxppc-dev@lists.ozlabs.org" <linuxppc-dev@lists.ozlabs.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: power9 slab-out-of-bounds in _find_First_zero_bit
Thread-Topic: power9 slab-out-of-bounds in _find_First_zero_bit
Thread-Index: AQHYiA3x5VQrcuJdXESkF1Wg/+Ovsq1fOpyAgAAgzYA=
Date:   Sat, 25 Jun 2022 01:49:17 +0000
Message-ID: <20220625014909.v4mv7tnb6fbe5uq5@revolver>
References: <20220624210400.gic4akzlwwdqkxym@revolver>
 <87pmixmxgu.fsf@linux.ibm.com>
In-Reply-To: <87pmixmxgu.fsf@linux.ibm.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ZIgPcVbrzGr67W4WEQ8JPnfGCICvOaY/08EoIDlYG2JLVxUk3dTozQh/TiDL?=
 =?us-ascii?Q?KlvawSyc8vEIevX0O8OOVlRY2sy5L8Y4M1TaMMziL0zrdMlGpOUfWjjNr5cC?=
 =?us-ascii?Q?/c5wU9sEB2Q0zpCqr2fh6rjM1MCf00H3WM1fLwuAPZAEKKH9dBc3NLOt3CDB?=
 =?us-ascii?Q?G8tp1d+smSyMTTQoxcViePVJ2sN0DFOPvViKGLwlBmgA4jGBHt0xekydrjEx?=
 =?us-ascii?Q?UkYk3/8kaH2fn/gyJ0rpPNKZX9NC+l0SjvLWbGE1wIGO8CqqB3ARQTLb3sAR?=
 =?us-ascii?Q?trfpKnlRNAE0U2VxZqJ1IddBLTsOHpcr1TegRrHKiE1fXFUd4qjwnNFN1+HM?=
 =?us-ascii?Q?3IGTnRAu0DTaEai9ogW8awXCU3Q64lGfay3b3MTes/eJ3Wq41jJ8jiTSzOWx?=
 =?us-ascii?Q?T3JApX4K7Q8Sge9VB1cRQVN0lZB494O0fP0Kf9MwKwKo5y6q0CdMByAQi+Yg?=
 =?us-ascii?Q?whYjbXFyn1bUOi10z5yQHl2HCutgXn6y+r9Q1lYL7f7C+/FILwiKCirHZNcM?=
 =?us-ascii?Q?044TQEapdZWecG3lMyVUIA+j3UwOfDFnLmmMS4/lqJ4NiERN0Uky35UJB/V4?=
 =?us-ascii?Q?5UcpwY9nLu5e2ByIkaR99ydHdIweLBz4d27fTbotSmZSlu8csQKcgFHW2UUL?=
 =?us-ascii?Q?IAz7Wv88HhcXHxYrOfMgICsel1SQk8v8VcQyKO4oJvoHLygqujL4kvI9do7y?=
 =?us-ascii?Q?Pmc1uNW+3Ui4poJ5zUIOn2qcV+j6tekPRRvstoIaKCtUlLZ4IZvGlCSfgBbr?=
 =?us-ascii?Q?bs9Pm871BOM21ConoXTElye9kP0cAnbSjF3tUsXxGAx9bCdzWUI+PEi/xws9?=
 =?us-ascii?Q?fRWOKodyytG8haqEaNNCFE0CUDbajPleXoo0d1FVy4SZ7EAP4+WrpHKLTBAh?=
 =?us-ascii?Q?z4FYC2fi/+phBh3yDWSwpmoSOaJZ4qh82gmZCFTVEQcSdWMekBzp4JfK/CU7?=
 =?us-ascii?Q?VAW1wFNv/Nq3sTqoMoQxQgGOKAZ8a8dHmm3+7ilv3bzvG2nrnDPJBuYolZ1L?=
 =?us-ascii?Q?9vhwV6z0r4MzFbFS8T/vURXwyI+tDE/ZtDxXjqcOBxOtNlFSGqpDTxQgJsyT?=
 =?us-ascii?Q?5KmEqS3TtOMYfjRHMd2dgbpq3YBKmC4egXbuYaJOzI0qRxYNrU1tJKqZytuc?=
 =?us-ascii?Q?bNkXfq1rPlgX/XSwd7c3K5mlSUF4oLqfLXPrLGyJJxVgRHeygDlXfDjqpXxn?=
 =?us-ascii?Q?l7ozsJjEl/+TU2RmbhD1EIL8Irval8WYS9SC7coU8O6Xs6XIHHmaJzaPNwvL?=
 =?us-ascii?Q?RDLw74fWdidn/hjOR8VFCexnYYXdLfmoVuRQQBdjrU7lLQrizkmA3MbmGVSj?=
 =?us-ascii?Q?qRJpApYdPmXmZmBOGoVxkS8EjxmY7b2ospxtHAse7o/hTFwr5JPx5uNfjfkw?=
 =?us-ascii?Q?dnqjHmZDPS8b26kOw+8BomLrOx7J+COXUKtp8YrmFQjDCFYaHABJ1ZyytIA6?=
 =?us-ascii?Q?s5VtbWRynJQhYVRoOWMHOobTgU2Wf3yWs+42IH4iNyqUzX9+ZK2SJ9DxT+/r?=
 =?us-ascii?Q?pJuzf0+8Nn2GZiOyS6Nn75fLD9VkueSoIrMFYNl7wZvrfTcDlWYTLwNvEm0h?=
 =?us-ascii?Q?F55G0LYaE1RCMVTZf8haGdMLJdmdsH7UxufrnNuzE5jXKlrOLjI1k7VNKENu?=
 =?us-ascii?Q?DA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2B25C26EA7BF97458511C50FA5A2CC83@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c3da45e4-d951-46e6-4779-08da564cea81
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jun 2022 01:49:17.7722
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 8qN6E0e2F0u7v9WsvLYIOaG06WvjVB5vKlrCfp0yZ0frXi1Haw520BEp4d2XnvnL2Q5LhosAQlHwPa9ZpKO7Yw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB6200
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-06-24_10:2022-06-24,2022-06-24 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 phishscore=0
 malwarescore=0 mlxlogscore=999 spamscore=0 adultscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2204290000
 definitions=main-2206250005
X-Proofpoint-GUID: JKTNe2aL2G7Od5jN8McG8qc_8BY6mIkE
X-Proofpoint-ORIG-GUID: JKTNe2aL2G7Od5jN8McG8qc_8BY6mIkE
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* Nathan Lynch <nathanl@linux.ibm.com> [220624 19:51]:
> Hi Liam,
>=20
> Liam Howlett <liam.howlett@oracle.com> writes:
> >
> > When trying v5.19-rc3 on my ppc64 VM with KASANs enabled, I get the
> > following on boot:
> >
> > [    0.174621] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > [    0.175501] BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0=
x40/0x140
> > [    0.176132] Read of size 8 at addr c00000000f7f0410 by task swapper/=
0/1
> > [    0.176900]=20
> > [    0.177844] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W       =
  5.19.0-rc3+ #8
> > [    0.179461] Call Trace:
> > [    0.179907] [c0000000119677d0] [c0000000075af350] dump_stack_lvl+0x7=
4/0xa8 (unreliable)
> > [    0.181107] [c000000011967810] [c000000000632220] print_report+0x330=
/0x740
> > [    0.181977] [c0000000119678e0] [c000000000632980] kasan_report+0x100=
/0x1f0
> > [    0.182788] [c0000000119679c0] [c000000000634de4] __asan_load8+0xa4/=
0xe0
> > [    0.183560] [c0000000119679e0] [c0000000018b92b0] _find_first_zero_b=
it+0x40/0x140
> > [    0.184119] [c000000011967a20] [c0000000000c5f7c] xive_spapr_get_ipi=
+0xcc/0x220
> > [    0.184689] [c000000011967ad0] [c0000000000c1adc] xive_setup_cpu_ipi=
+0x1ec/0x420
> > [    0.185231] [c000000011967b90] [c00000000a033b3c] pSeries_smp_probe+=
0x44/0xd4
> > [    0.185825] [c000000011967bc0] [c00000000a01c77c] smp_prepare_cpus+0=
x62c/0x688
> > [    0.186359] [c000000011967cb0] [c00000000a00ea94] kernel_init_freeab=
le+0x24c/0x520
> > [    0.186893] [c000000011967d90] [c000000000012b00] kernel_init+0x30/0=
x1c0
> > [    0.187395] [c000000011967e10] [c00000000000ce54] ret_from_kernel_th=
read+0x5c/0x64
>=20
> [...]
>=20
> Please try "powerpc/xive/spapr: correct bitmap allocation size", posted y=
esterday:
>=20
> https://lore.kernel.org/linuxppc-dev/20220623182509.3985625-1-nathanl@lin=
ux.ibm.com/

Thanks, that works.