Received-SPF: pass (google.com: domain of linux-wireless+bounces-8302-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Thu, 30 May 2024 00:34:06 -0700
From: Dan Williams <dan.j.williams@intel.com>
To: Kalle Valo <kvalo@kernel.org>, Dave Jiang <dave.jiang@intel.com>, "Dan
 Williams" <dan.j.williams@intel.com>, Bjorn Helgaas <bhelgaas@google.com>
CC: <linux-wireless@vger.kernel.org>, <ath11k@lists.infradead.org>,
	<regressions@lists.linux.dev>, Jeff Johnson <quic_jjohnson@quicinc.com>,
	<linux-kernel@vger.kernel.org>, <linux-cxl@vger.kernel.org>,
	<linux-pci@vger.kernel.org>
Subject: Re: [regression] BUG: KASAN: use-after-free in
 lockdep_register_key+0x755/0x8f0
Message-ID: <66582bee45da8_6ec329496@dwillia2-mobl3.amr.corp.intel.com.notmuch>
References: <87v82y6wvi.fsf@kernel.org>
 <87wmncwqxf.fsf@kernel.org>
 <87sexzx02f.fsf@kernel.org>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <87sexzx02f.fsf@kernel.org>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?NZc4XMVkaODW0WWFatE1V77H9Ij9ZsfzND3SnE+1URd54tO7KZQDYuZIZV0h?=
 =?us-ascii?Q?fBdUvS48fL6rrfnaSQsDvJ80gQRB2rey8QLLVBc2iuQYpEur59IvL9FpCQ9z?=
 =?us-ascii?Q?wqBELn6sxsqK0TMxx7+C4Vm7wy6f/TI06JWHRanC+ZPaMHjEhrzZOv6ltxWz?=
 =?us-ascii?Q?eAFla2RUmIGtBiRU5wtip5Wlu8xXjDg5zVQ1aGj8E6pWM6oeuk1ESOPNrqpq?=
 =?us-ascii?Q?icNTbKQZ5LwzBfZcLxUIyiGbGiSQkQr/LkPfXjRPWlLqdPLc35idAmkOwQ5z?=
 =?us-ascii?Q?pTQu9iSH2Z0Z0LP48Nur4BIvFQJemIZrEi1EG15hxCwnhfufXQvj+PYgbMC5?=
 =?us-ascii?Q?ZkUyenNZHTu1K6wco/ObNLBIVHL+CMH+yjmr3Zk2aKyh2+6CLpHf+A8aJVSv?=
 =?us-ascii?Q?W+yaq95Ml8QsZfWHhIwlKZjEXm4X4RGnQlmuNXA0htSQBlx16wfvDF0Der4W?=
 =?us-ascii?Q?BpY/SwJ/0jhzw0uHJxwGWAWfYORuHne1Y5m8eXjA2LeUZoqcSZ0KKifeYNyr?=
 =?us-ascii?Q?zuxwFxyA98be7Qergy1i0MJ/znYpGBy0WeDYEF2Z6YfAK1b8LmG8Fuf20idZ?=
 =?us-ascii?Q?B74AxxJXLZY2BuSwDb3gcCDQHjEiHh5Mbqh94bo7KbVW/kkRGs4MfxR78pZy?=
 =?us-ascii?Q?9HRm9+JQh9ugbGWGfBjro4lwBuEXRvZE9EIOJ/3GBAOhfZ4NYb+wosju2yb5?=
 =?us-ascii?Q?a7VPYhU/rAZimFtRIM/5CkPYIKxHGNj4ZTSAblo1VFO4G0flo6/nsESxwBi0?=
 =?us-ascii?Q?EkYKHHwJB+wLPTOJ79bkhj2BsqRLwzqhkp6KqiTOWVMCdcaufCcAX+TgcIcv?=
 =?us-ascii?Q?7urRasFtRj3rHBhgoKKQaNDQ60Rvk1NuieiQkr5uVWSwWF31wRbdQBYnf8Ye?=
 =?us-ascii?Q?l2TLjXNBn/Bh7WgBxW4Mokgd9QyNNoKcTY9IBwk7+kHvnr99C3ncN/xRS2Dh?=
 =?us-ascii?Q?cOKow3KfuGzu4Bvm78LpoRasM5E/Hez5/N9d7rUVS097RB8ye65HOxDRymbM?=
 =?us-ascii?Q?BilHB0mMvy+1De8ABAOUDc4GmbMRCHEJqHezCdD7YVb67XeU+pU8u20Oz9+S?=
 =?us-ascii?Q?Dv1jkXZnPZ1gwhc5mUMa3RDLD2s0wz/fhtCuYMptSSBZseQZVp8bCexP5C2K?=
 =?us-ascii?Q?OrzmKTOmLzTpGW/1fsnWSakS3sOl3VtNdW/BlsrXLL/l2rKhNYWqAtZ7an0P?=
 =?us-ascii?Q?jcvS9im+qDg9QVKw6Wn4L1S12TKB8ZGIK+FPu6iVIW8SweUBnbkc5XfTZ5Ra?=
 =?us-ascii?Q?5Fd6CbsKSSOydXiGVDfEiuPmKShhRfgHXNHvebVURcE8qC9hD1Y352gm/dBp?=
 =?us-ascii?Q?xOZyaekLYjdUjyCLwPggWC16Hz8QmEFO5JmeIH5zdn7U2Og1IkNmVMoyIlKI?=
 =?us-ascii?Q?V+uVAAechXupePXX3KkgxpYfJ4p0y5YdpcL/PWhBmp3GLbWPJ/C3STdOMqNW?=
 =?us-ascii?Q?QG0PIni9DoM+poGyagEpNG1e+O4jZ2N8LQVvczg2HL2EfFfJ5vBV9DE/cmqQ?=
 =?us-ascii?Q?5RJV2YqMR3GEkERj7IMDQZM3sgQVo+lr2pbd5PsfepmcECyPxNgEqtZQn0LC?=
 =?us-ascii?Q?wZrJLvvfssMsiHwIN8cS0xqbrZ9zQe7bNFrrQvv3/CO6ygx6ZYTsBmF3KvZ8?=
 =?us-ascii?Q?QA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: a3436705-2a42-428a-6dd3-08dc807ae4ae
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2024 07:34:09.1613
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: dQJUvQ1puUTLZ7T7oFUk0joz+x1NslXpJZQ1LcenMlL2uNLjxf1KpRl28RfR9WLTGBHU/wXrb+ZeQACy1Ps0LpS9zVtL89jSFWRJShn/8oc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB8520
X-OriginatorOrg: intel.com

Kalle Valo wrote:
> Kalle Valo <kvalo@kernel.org> writes:
> 
> > Kalle Valo <kvalo@kernel.org> writes:
> >
> >> Yesterday I run our ath11k regression tests with v6.10-rc1 and our
> >> simple ath11k module reload stress started failing reliably with various
> >> KASAN errors. The test removes and inserts ath11k and other wireless
> >> modules in a loop. Usually I run it at least 100 times, some times even
> >> more, and no issues until yesterday.
> >>
> >> I have verified that the last wireless-next pull request (tag
> >> wireless-next-2024-05-08) works without issues and v6.10-rc1 fails
> >> always, usually within 50 module reload loops. From this I'm _guessing_
> >> that we have a regression outside wireless, most probably introduced
> >> between v6.9 and v6.10-rc1. But of course I cannot be sure of anything
> >> yet.
> >>
> >> I see different KASAN warnings and lockdep seems to be always visible in
> >> the stack traces. I think I can reproduce the issue within 15 minutes or
> >> so. Before I start bisecting has anyone else seen anything similar? Or
> >> any suggestions how to debug this further?
> >>
> >> I have included some crash logs below, they are retrieved using
> >> netconsole. Here's a summary of the errors:
> >>
> >> [ 159.970765] KASAN: maybe wild-memory-access in range
> >> [0xbbbbbbbbbbbbbbb8-0xbbbbbbbbbbbbbbbf]
> >> [  700.017632] BUG: KASAN: use-after-free in lockdep_register_key+0x755/0x8f0
> >> [  224.695821] BUG: KASAN: slab-out-of-bounds in lockdep_register_key+0x755/0x8f0
> >> [  259.666542] BUG: KASAN: slab-use-after-free in lockdep_register_key+0x755/0x8f0

The proposed fix for that is here:

http://lore.kernel.org/r/66560aa9dbedb_195e294b0@dwillia2-mobl3.amr.corp.intel.com.notmuch