Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Sven Schnelle <svens@linux.ibm.com>
To:     Steven Rostedt <rostedt@goodmis.org>
Cc:     linux-kernel@vger.kernel.org
Subject: Re: BUG: KASAN: slab-out-of-bounds in print_synth_event+0xa68/0xa78
References: <yt9dsf8zfhw8.fsf@linux.ibm.com>
        <20230807215310.068fce2f@gandalf.local.home>
Date:   Tue, 08 Aug 2023 07:58:59 +0200
In-Reply-To: <20230807215310.068fce2f@gandalf.local.home> (Steven Rostedt's
        message of "Mon, 7 Aug 2023 21:53:10 -0400")
Message-ID: <yt9dmsz2qdlo.fsf@linux.ibm.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Steven Rostedt <rostedt@goodmis.org> writes:

> On Fri, 04 Aug 2023 08:20:23 +0200
> Sven Schnelle <svens@linux.ibm.com> wrote:
>
>> Hi Steven,
>>
>> i noticed the following KASAN splat in CI (on s390):
>
> Could this actually be a bug in KASAN?
>
> The reason I ask, is because of the report.

I don't think so. I looked into the trace file when the problem occurred
yesterday, and it looked like this:

kworker/0:2-83      [000] d..4.    59.260107: wake_lat: pid=2654624 delta=55 stack=STACK:
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
=> 0x6b6b6b6b6b6b6b6b
[..]

Somtimes the number is 0xcc, which is POISON_FREE_INITMEM instead of POISON_FREE.

In other entries delta and pid are also wrong:

swapper/0-1       [002] .....     5.864575: wake_lat: pid=5437496 delta=7880749591624456 stack=STACK:

Of course PID could have gone away, but that delta looks interesting. So
it looks like the whole entry is just random data not owned by tracing,
and not the data that was allocated in the ringbuffer code.