KASAN use-after-free bug and a warning in etm4_cpu_pm_notify() with "arm,coresight-loses-context-with-cpu"
Hi,
Since adding "arm,coresight-loses-context-with-cpu" property, have been seeing warnings during boot on QCOM SC7180, one is the kasan use-after-free warning in etm4_cpu_pm_notify() and the other warning also in etm4_cpu_pm_notify().
1) KASAN use-after-free bug in etm4_cpu_pm_notify():
[ 8.574566] coresight etm0: CPU0: ETM v4.2 initialized [ 8.581920] BUG: KASAN: use-after-free in etm4_cpu_pm_notify+0x580/0x2024 [ 8.581925] Read of size 8 at addr ffffff813304f8c8 by task swapper/3/0 [ 8.581927] [ 8.581934] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S W 5.4.28 #314 [ 8.587775] coresight etm1: CPU1: ETM v4.2 initialized [ 8.594195] Call trace: [ 8.594205] dump_backtrace+0x0/0x188 [ 8.594209] show_stack+0x20/0x2c [ 8.594216] dump_stack+0xdc/0x144 [ 8.594227] print_address_description+0x3c/0x494 [ 8.594232] __kasan_report+0x144/0x168 [ 8.601598] coresight etm2: CPU2: ETM v4.2 initialized [ 8.602563] kasan_report+0x10/0x18 [ 8.602568] check_memory_region+0x1a4/0x1b4 [ 8.602572] __kasan_check_read+0x18/0x24 [ 8.602577] etm4_cpu_pm_notify+0x580/0x2024 [ 8.665945] notifier_call_chain+0x5c/0x90 [ 8.670166] __atomic_notifier_call_chain+0x90/0xf8 [ 8.675182] cpu_pm_notify+0x40/0x6c [ 8.678858] cpu_pm_enter+0x38/0x80 [ 8.682451] psci_enter_idle_state+0x34/0x70 [ 8.686844] cpuidle_enter_state+0xb8/0x20c [ 8.691143] cpuidle_enter+0x38/0x4c [ 8.694820] call_cpuidle+0x3c/0x68 [ 8.698408] do_idle+0x1a0/0x280 [ 8.701729] cpu_startup_entry+0x24/0x28 [ 8.705768] secondary_start_kernel+0x15c/0x170 [ 8.710423] [ 8.711972] Allocated by task 242: [ 8.715473] __kasan_kmalloc+0xf0/0x1ac [ 8.719426] kasan_slab_alloc+0x14/0x1c [ 8.723375] __kmalloc_track_caller+0x23c/0x388 [ 8.728040] devm_kmalloc+0x38/0x94 [ 8.731632] etm4_probe+0x48/0x3c8 [ 8.735140] amba_probe+0xbc/0x158 [ 8.738645] really_probe+0x144/0x408 [ 8.742412] driver_probe_device+0x70/0x140 [ 8.746716] __device_attach_driver+0x9c/0x110 [ 8.751287] bus_for_each_drv+0x90/0xd8 [ 8.755236] __device_attach+0xb4/0x164 [ 8.759188] device_initial_probe+0x20/0x2c [ 8.763490] bus_probe_device+0x34/0x94 [ 8.767436] device_add+0x34c/0x3e0 [ 8.771029] amba_device_try_add+0x68/0x440 [ 8.775332] amba_deferred_retry_func+0x48/0xc8 [ 8.779997] process_one_work+0x344/0x648 [ 8.784127] worker_thread+0x2ac/0x47c [ 8.787987] kthread+0x128/0x138 [ 8.791313] ret_from_fork+0x10/0x18 [ 8.794993] [ 8.796532] Freed by task 242: [ 8.799684] __kasan_slab_free+0x15c/0x22c [ 8.803897] kasan_slab_free+0x10/0x1c [ 8.807761] kfree+0x25c/0x4bc [ 8.810913] release_nodes+0x240/0x2b0 [ 8.814767] devres_release_all+0x3c/0x54 [ 8.818887] really_probe+0x178/0x408 [ 8.822661] driver_probe_device+0x70/0x140 [ 8.826963] __device_attach_driver+0x9c/0x110 [ 8.831539] bus_for_each_drv+0x90/0xd8 [ 8.835487] __device_attach+0xb4/0x164 [ 8.839431] device_initial_probe+0x20/0x2c [ 8.843732] bus_probe_device+0x34/0x94 [ 8.847678] device_add+0x34c/0x3e0 [ 8.851274] amba_device_try_add+0x68/0x440 [ 8.855576] amba_deferred_retry_func+0x48/0xc8 [ 8.860240] process_one_work+0x344/0x648 [ 8.864366] worker_thread+0x2ac/0x47c [ 8.868228] kthread+0x128/0x138 [ 8.871557] ret_from_fork+0x10/0x18 [ 8.875231] [ 8.876782] The buggy address belongs to the object at ffffff813304f800 [ 8.876782] which belongs to the cache kmalloc-1k of size 1024 [ 8.889632] The buggy address is located 200 bytes inside of [ 8.889632] 1024-byte region [ffffff813304f800, ffffff813304fc00) [ 8.901761] The buggy address belongs to the page: [ 8.906695] page:ffffffff04ac1200 refcount:1 mapcount:0 mapping:ffffff8146c03800 index:0x0 compound_mapcount: 0 [ 8.917047] flags: 0x4000000000010200(slab|head) [ 8.921799] raw: 4000000000010200 dead000000000100 dead000000000122 ffffff8146c03800 [ 8.929753] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 8.937703] page dumped because: kasan: bad access detected [ 8.943433] [ 8.944974] Memory state around the buggy address: [ 8.949903] ffffff813304f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 8.957320] ffffff813304f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.964742] >ffffff813304f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.972157] ^ [ 8.977886] ffffff813304f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.985298] ffffff813304f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.992713] ================================================================== [ 9.000577] coresight etm3: CPU3: ETM v4.2 initialized [ 9.006385] coresight etm4: CPU4: ETM v4.2 initialized [ 9.012203] coresight etm5: CPU5: ETM v4.2 initialized [ 9.018126] coresight etm6: CPU6: ETM v4.2 initialized [ 9.023906] coresight etm7: CPU7: ETM v4.2 initialized
2) WARN_ON_ONCE(drvdata->cpu != cpu) in etm4_cpu_pm_notify():
6.219155] WARNING: CPU: 3 PID: 0 at v5.4/drivers/hwtracing/coresight/coresight-etm4x.c:1347 etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219156] Modules linked in: [ 6.219163] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S 5.4.35 #1 [ 6.219168] pstate: 20c00089 (nzCv daIf +PAN +UAO) [ 6.219171] pc : etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219176] lr : notifier_call_chain+0x58/0x90 [ 6.219178] sp : ffffffc010213d80 [ 6.219179] x29: ffffffc010213d90 x28: 0000000000000000 [ 6.219182] x27: ffffffe5b7106138 x26: ffffffe5b7412000 [ 6.219185] x25: ffffffe5b7412148 x24: 0000000000000001 [ 6.219188] x23: 0000000000000000 x22: 6b6b6b6b6b6b6b6b [ 6.219191] x21: 0000000000000002 x20: 0000000000000002 [ 6.219194] x19: ffffff816d8a1080 x18: 0000000000000000 [ 6.219197] x17: 0000000000000000 x16: 0000000000000000 [ 6.219200] x15: 0000000000000000 x14: ffffff8175f164c0 [ 6.219203] x13: ffffff8001d39000 x12: 00000000000000f0 [ 6.219206] x11: 0000000000000020 x10: 00000000ffffffff [ 6.219208] x9 : 0000000070732f69 x8 : 0000000000000003 [ 6.219211] x7 : 000000b2b5593519 x6 : 00000000003033ff [ 6.219214] x5 : 0000000000000000 x4 : 0000000000000700 [ 6.219217] x3 : 00000000ffffffff x2 : 0000000000000000 [ 6.219219] x1 : 0000000000000002 x0 : ffffffe5b74f2a28 [ 6.219223] Call trace: [ 6.219226] etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219228] notifier_call_chain+0x58/0x90 [ 6.219231] __atomic_notifier_call_chain+0x48/0x68 [ 6.219236] cpu_pm_notify+0x40/0x6c [ 6.219239] cpu_pm_exit+0x1c/0x24 [ 6.219242] psci_enter_idle_state+0x4c/0x70 [ 6.219246] cpuidle_enter_state+0xb8/0x204 [ 6.219249] cpuidle_enter+0x38/0x4c [ 6.219254] do_idle+0x1a4/0x2a8 [ 6.219257] cpu_startup_entry+0x24/0x28 [ 6.219262] secondary_start_kernel+0x148/0x154 [ 6.219264] ---[ end trace 41dac5fc09746c13 ]---
Thanks, Sai
Hi Sai On 05/05/2020 09:03 PM, Sai Prakash Ranjan wrote:
Hi,
Since adding "arm,coresight-loses-context-with-cpu" property, have been seeing warnings during boot on QCOM SC7180, one is the kasan use-after-free warning in etm4_cpu_pm_notify() and the other warning also in etm4_cpu_pm_notify().,
Thanks for the bug report. Does the following patch fix the issue ?
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c index a90d757f7043..a6d6c7a3abcb 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x.c +++ b/drivers/hwtracing/coresight/coresight-etm4x.c @@ -1527,6 +1527,7 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) return 0;
err_arch_supported: + etmdrvdata[drvdata->cpu] = NULL; if (--etm4_count == 0) { etm4_cpu_pm_unregister();
Cheers Suzuki
- KASAN use-after-free bug in etm4_cpu_pm_notify():
[ 8.574566] coresight etm0: CPU0: ETM v4.2 initialized [ 8.581920] BUG: KASAN: use-after-free in etm4_cpu_pm_notify+0x580/0x2024 [ 8.581925] Read of size 8 at addr ffffff813304f8c8 by task swapper/3/0 [ 8.581927] [ 8.581934] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S W 5.4.28 #314 [ 8.587775] coresight etm1: CPU1: ETM v4.2 initialized [ 8.594195] Call trace: [ 8.594205] dump_backtrace+0x0/0x188 [ 8.594209] show_stack+0x20/0x2c [ 8.594216] dump_stack+0xdc/0x144 [ 8.594227] print_address_description+0x3c/0x494 [ 8.594232] __kasan_report+0x144/0x168 [ 8.601598] coresight etm2: CPU2: ETM v4.2 initialized [ 8.602563] kasan_report+0x10/0x18 [ 8.602568] check_memory_region+0x1a4/0x1b4 [ 8.602572] __kasan_check_read+0x18/0x24 [ 8.602577] etm4_cpu_pm_notify+0x580/0x2024 [ 8.665945] notifier_call_chain+0x5c/0x90 [ 8.670166] __atomic_notifier_call_chain+0x90/0xf8 [ 8.675182] cpu_pm_notify+0x40/0x6c [ 8.678858] cpu_pm_enter+0x38/0x80 [ 8.682451] psci_enter_idle_state+0x34/0x70 [ 8.686844] cpuidle_enter_state+0xb8/0x20c [ 8.691143] cpuidle_enter+0x38/0x4c [ 8.694820] call_cpuidle+0x3c/0x68 [ 8.698408] do_idle+0x1a0/0x280 [ 8.701729] cpu_startup_entry+0x24/0x28 [ 8.705768] secondary_start_kernel+0x15c/0x170 [ 8.710423] [ 8.711972] Allocated by task 242: [ 8.715473] __kasan_kmalloc+0xf0/0x1ac [ 8.719426] kasan_slab_alloc+0x14/0x1c [ 8.723375] __kmalloc_track_caller+0x23c/0x388 [ 8.728040] devm_kmalloc+0x38/0x94 [ 8.731632] etm4_probe+0x48/0x3c8 [ 8.735140] amba_probe+0xbc/0x158 [ 8.738645] really_probe+0x144/0x408 [ 8.742412] driver_probe_device+0x70/0x140 [ 8.746716] __device_attach_driver+0x9c/0x110 [ 8.751287] bus_for_each_drv+0x90/0xd8 [ 8.755236] __device_attach+0xb4/0x164 [ 8.759188] device_initial_probe+0x20/0x2c [ 8.763490] bus_probe_device+0x34/0x94 [ 8.767436] device_add+0x34c/0x3e0 [ 8.771029] amba_device_try_add+0x68/0x440 [ 8.775332] amba_deferred_retry_func+0x48/0xc8 [ 8.779997] process_one_work+0x344/0x648 [ 8.784127] worker_thread+0x2ac/0x47c [ 8.787987] kthread+0x128/0x138 [ 8.791313] ret_from_fork+0x10/0x18 [ 8.794993] [ 8.796532] Freed by task 242: [ 8.799684] __kasan_slab_free+0x15c/0x22c [ 8.803897] kasan_slab_free+0x10/0x1c [ 8.807761] kfree+0x25c/0x4bc [ 8.810913] release_nodes+0x240/0x2b0 [ 8.814767] devres_release_all+0x3c/0x54 [ 8.818887] really_probe+0x178/0x408 [ 8.822661] driver_probe_device+0x70/0x140 [ 8.826963] __device_attach_driver+0x9c/0x110 [ 8.831539] bus_for_each_drv+0x90/0xd8 [ 8.835487] __device_attach+0xb4/0x164 [ 8.839431] device_initial_probe+0x20/0x2c [ 8.843732] bus_probe_device+0x34/0x94 [ 8.847678] device_add+0x34c/0x3e0 [ 8.851274] amba_device_try_add+0x68/0x440 [ 8.855576] amba_deferred_retry_func+0x48/0xc8 [ 8.860240] process_one_work+0x344/0x648 [ 8.864366] worker_thread+0x2ac/0x47c [ 8.868228] kthread+0x128/0x138 [ 8.871557] ret_from_fork+0x10/0x18 [ 8.875231] [ 8.876782] The buggy address belongs to the object at ffffff813304f800 [ 8.876782] which belongs to the cache kmalloc-1k of size 1024 [ 8.889632] The buggy address is located 200 bytes inside of [ 8.889632] 1024-byte region [ffffff813304f800, ffffff813304fc00) [ 8.901761] The buggy address belongs to the page: [ 8.906695] page:ffffffff04ac1200 refcount:1 mapcount:0 mapping:ffffff8146c03800 index:0x0 compound_mapcount: 0 [ 8.917047] flags: 0x4000000000010200(slab|head) [ 8.921799] raw: 4000000000010200 dead000000000100 dead000000000122 ffffff8146c03800 [ 8.929753] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 8.937703] page dumped because: kasan: bad access detected [ 8.943433] [ 8.944974] Memory state around the buggy address: [ 8.949903] ffffff813304f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 8.957320] ffffff813304f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.964742] >ffffff813304f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.972157] ^ [ 8.977886] ffffff813304f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.985298] ffffff813304f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.992713] ================================================================== [ 9.000577] coresight etm3: CPU3: ETM v4.2 initialized [ 9.006385] coresight etm4: CPU4: ETM v4.2 initialized [ 9.012203] coresight etm5: CPU5: ETM v4.2 initialized [ 9.018126] coresight etm6: CPU6: ETM v4.2 initialized [ 9.023906] coresight etm7: CPU7: ETM v4.2 initialized
- WARN_ON_ONCE(drvdata->cpu != cpu) in etm4_cpu_pm_notify():
6.219155] WARNING: CPU: 3 PID: 0 at v5.4/drivers/hwtracing/coresight/coresight-etm4x.c:1347 etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219156] Modules linked in: [ 6.219163] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S 5.4.35 #1 [ 6.219168] pstate: 20c00089 (nzCv daIf +PAN +UAO) [ 6.219171] pc : etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219176] lr : notifier_call_chain+0x58/0x90 [ 6.219178] sp : ffffffc010213d80 [ 6.219179] x29: ffffffc010213d90 x28: 0000000000000000 [ 6.219182] x27: ffffffe5b7106138 x26: ffffffe5b7412000 [ 6.219185] x25: ffffffe5b7412148 x24: 0000000000000001 [ 6.219188] x23: 0000000000000000 x22: 6b6b6b6b6b6b6b6b [ 6.219191] x21: 0000000000000002 x20: 0000000000000002 [ 6.219194] x19: ffffff816d8a1080 x18: 0000000000000000 [ 6.219197] x17: 0000000000000000 x16: 0000000000000000 [ 6.219200] x15: 0000000000000000 x14: ffffff8175f164c0 [ 6.219203] x13: ffffff8001d39000 x12: 00000000000000f0 [ 6.219206] x11: 0000000000000020 x10: 00000000ffffffff [ 6.219208] x9 : 0000000070732f69 x8 : 0000000000000003 [ 6.219211] x7 : 000000b2b5593519 x6 : 00000000003033ff [ 6.219214] x5 : 0000000000000000 x4 : 0000000000000700 [ 6.219217] x3 : 00000000ffffffff x2 : 0000000000000000 [ 6.219219] x1 : 0000000000000002 x0 : ffffffe5b74f2a28 [ 6.219223] Call trace: [ 6.219226] etm4_cpu_pm_notify+0x1708/0x1c24 [ 6.219228] notifier_call_chain+0x58/0x90 [ 6.219231] __atomic_notifier_call_chain+0x48/0x68 [ 6.219236] cpu_pm_notify+0x40/0x6c [ 6.219239] cpu_pm_exit+0x1c/0x24 [ 6.219242] psci_enter_idle_state+0x4c/0x70 [ 6.219246] cpuidle_enter_state+0xb8/0x204 [ 6.219249] cpuidle_enter+0x38/0x4c [ 6.219254] do_idle+0x1a4/0x2a8 [ 6.219257] cpu_startup_entry+0x24/0x28 [ 6.219262] secondary_start_kernel+0x148/0x154 [ 6.219264] ---[ end trace 41dac5fc09746c13 ]---
Thanks, Sai
Hi Suzuki,
On 2020-05-06 15:36, Suzuki K Poulose wrote:
Hi Sai On 05/05/2020 09:03 PM, Sai Prakash Ranjan wrote:
Hi,
Since adding "arm,coresight-loses-context-with-cpu" property, have been seeing warnings during boot on QCOM SC7180, one is the kasan use-after-free warning in etm4_cpu_pm_notify() and the other warning also in etm4_cpu_pm_notify().,
Thanks for the bug report. Does the following patch fix the issue ?
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c index a90d757f7043..a6d6c7a3abcb 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x.c +++ b/drivers/hwtracing/coresight/coresight-etm4x.c @@ -1527,6 +1527,7 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) return 0;
err_arch_supported:
- etmdrvdata[drvdata->cpu] = NULL; if (--etm4_count == 0) { etm4_cpu_pm_unregister();
Thanks for getting back so fast and for the patch. I don't see the warnings anymore.
Tested-by: Sai Prakash Ranjan saiprakash.ranjan@codeaurora.org
Thanks, Sai
-
Sai Prakash Ranjan -
Suzuki K Poulose