2023-03-08 01:37:26

by Ben Greear

[permalink] [raw]
Subject: 6.2.2+ ksoftirqd kasan splat

I have seen this a few times during reboot/shutdown. This is on a system
with 24 mtk7922 radios in it, so probably related to that piece of hardware
somehow. The splat doesn't tell me much though, so not sure how to make
progress.

==================================================================
BUG: KASAN: use-after-free in tasklet_action_common.constprop.0+0xa4/0x200
Read of size 4 at addr ffff888147d1a670 by task ksoftirqd/5/40

CPU: 5 PID: 40 Comm: ksoftirqd/5 Not tainted 6.2.2+ #28
Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020
Call Trace:
<TASK>
dump_stack_lvl+0x44/0x58
print_report+0x17c/0x481
? __virt_addr_valid+0xab/0x130
? tasklet_action_common.constprop.0+0xa4/0x200
? tasklet_action_common.constprop.0+0xa4/0x200
kasan_report+0xad/0x130
? tasklet_action_common.constprop.0+0xa4/0x200
tasklet_action_common.constprop.0+0xa4/0x200
__do_softirq+0xee/0x38a
? trace_event_raw_event_irq_handler_entry+0x180/0x180
run_ksoftirqd+0x1f/0x30
smpboot_thread_fn+0x156/0x2c0
? sort_range+0x20/0x20
kthread+0x14c/0x180
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x1f/0x30
</TASK>

The buggy address belongs to the physical page:

Memory state around the buggy address:
ffff888147d1a500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888147d1a580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888147d1a600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888147d1a680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888147d1a700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
reboot: Power down

Thanks,
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com