[LU-13039] BUG: KASAN: stack-out-of-bounds in strchr+0x2d/0x50

Sat, 18 Jan 2020 15:02:14 +0000
Nov 27 02:56:55 mds kernel: BUG: KASAN: stack-out-of-bounds in strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: Read of size 1 at addr ffff88808d9f7c85 by task badarea_io/28126
Nov 27 02:56:55 mds kernel: 
Nov 27 02:56:55 mds kernel: CPU: 1 PID: 28126 Comm: badarea_io Tainted: P O 5.4.0-1.ldiskfs.d.el7.x86_64 #1
Nov 27 02:56:55 mds kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Nov 27 02:56:55 mds kernel: Call Trace:
Nov 27 02:56:55 mds kernel: dump_stack+0x7b/0xba
Nov 27 02:56:55 mds kernel: ? strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: print_address_description.constprop.7.cold.9+0x9/0x350
Nov 27 02:56:55 mds kernel: ? strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: ? strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: __kasan_report.cold.10+0x1b/0x3f
Nov 27 02:56:55 mds kernel: ? __kmem_cache_shutdown.cold.101+0x12f/0x140
Nov 27 02:56:55 mds kernel: ? strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: kasan_report+0x12/0x20
Nov 27 02:56:55 mds kernel: __asan_load1+0x47/0x50
Nov 27 02:56:55 mds kernel: strchr+0x2d/0x50
Nov 27 02:56:55 mds kernel: qsd_enabled_seq_write+0xf0/0x300 [lquota]
Nov 27 02:56:55 mds kernel: ? qsd_state_seq_show+0x520/0x520 [lquota]
Nov 27 02:56:55 mds kernel: ? init_object+0x7e/0x90
Nov 27 02:56:55 mds kernel: ? restore_nameidata+0x7f/0xa0
Nov 27 02:56:55 mds kernel: proc_reg_write+0x12e/0x190
Nov 27 02:56:55 mds kernel: ? proc_reg_unlocked_ioctl+0x180/0x180
Nov 27 02:56:55 mds kernel: ? security_file_permission+0x62/0x180
Nov 27 02:56:55 mds kernel: __vfs_write+0x50/0xa0
Nov 27 02:56:55 mds kernel: vfs_write+0xf3/0x280
Nov 27 02:56:55 mds kernel: ksys_write+0xc0/0x160
Nov 27 02:56:55 mds kernel: ? __ia32_sys_read+0x50/0x50
Nov 27 02:56:55 mds kernel: ? __audit_syscall_exit+0x374/0x470
Nov 27 02:56:55 mds kernel: __x64_sys_write+0x43/0x50
Nov 27 02:56:55 mds kernel: do_syscall_64+0x78/0x200
Nov 27 02:56:55 mds kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
Nov 27 02:56:55 mds kernel: RIP: 0033:0x7fd02707a9b0
Nov 27 02:56:55 mds kernel: Code: 73 01 c3 48 8b 0d c0 74 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d ed d5 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee cb 01 00 48 89 04 24
Nov 27 02:56:55 mds kernel: RSP: 002b:00007fff21478d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
Nov 27 02:56:55 mds kernel: RAX: ffffffffffffffda RBX: 00007fff21478d7c RCX: 00007fd02707a9b0
Nov 27 02:56:55 mds kernel: RDX: 0000000000000000 RSI: 00007fff21478d7c RDI: 0000000000000003
Nov 27 02:56:55 mds kernel: RBP: 00007fff21478e78 R08: 00007fd027353e80 R09: 0000000000000000
Nov 27 02:56:55 mds kernel: R10: 00007fff214787e0 R11: 0000000000000246 R12: 00000000004006cc
Nov 27 02:56:55 mds kernel: R13: 00007fff21478e70 R14: 0000000000000000 R15: 0000000000000000
Nov 27 02:56:55 mds kernel: 
Nov 27 02:56:55 mds kernel: The buggy address belongs to the page:
Nov 27 02:56:55 mds kernel: page:ffffea0002367dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
Nov 27 02:56:55 mds kernel: flags: 0xfffffc0000000()
Nov 27 02:56:55 mds kernel: raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000
Nov 27 02:56:55 mds kernel: raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
Nov 27 02:56:55 mds kernel: page dumped because: kasan: bad access detected
Nov 27 02:56:55 mds kernel: 
Nov 27 02:56:55 mds kernel: addr ffff88808d9f7c85 is located in stack of task badarea_io/28126 at offset 37 in frame:
Nov 27 02:56:55 mds kernel: qsd_enabled_seq_write+0x0/0x300 [lquota]
Nov 27 02:56:55 mds kernel: 
Nov 27 02:56:55 mds kernel: this frame has 2 objects:
Nov 27 02:56:55 mds kernel: [32, 37) 'valstr'
Nov 27 02:56:55 mds kernel: [96, 105) 'fsname'
Nov 27 02:56:55 mds kernel: 
Nov 27 02:56:55 mds kernel: Memory state around the buggy address:
Nov 27 02:56:55 mds kernel: ffff88808d9f7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Nov 27 02:56:55 mds kernel: ffff88808d9f7c00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
Nov 27 02:56:55 mds kernel: >ffff88808d9f7c80: 05 f2 f2 f2 f2 f2 f2 f2 00 01 f2 f2 00 00 00 00
Nov 27 02:56:55 mds kernel: ^
Nov 27 02:56:55 mds kernel: ffff88808d9f7d00: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
Nov 27 02:56:55 mds kernel: ffff88808d9f7d80: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Nov 27 02:56:55 mds kernel: ==================================================================
Whamcloud Community JIRA

[LU-13039] BUG: KASAN: stack-out-of-bounds in strchr+0x2d/0x50
