BUG: KASAN: vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]

[Mikhail Gavrilov]

Hi,
After enabling KASAN sanitizer the message "BUG: KASAN:
vmalloc-out-of-bounds in mt7921_check_offload_capability+0x3fa/0x430
[mt7921_common]" chase me at every boot.

[   27.514098] ==================================================================
[   27.514103] BUG: KASAN: vmalloc-out-of-bounds in
mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[   27.514118] Read of size 1 at addr ffffc900063dda69 by task (udev-worker)/792

[   27.514123] CPU: 1 PID: 792 Comm: (udev-worker) Tainted: G        W
   L    -------  ---
6.3.0-0.rc2.20230317git38e04b3e4240.27.fc39.x86_64+debug #1
[   27.514128] Hardware name: ASUSTeK COMPUTER INC. ROG Strix
G513QY_G513QY/G513QY, BIOS G513QY.320 09/07/2022
[   27.514130] Call Trace:
[   27.514132]  <TASK>
[   27.514135]  dump_stack_lvl+0x72/0xc0
[   27.514143]  print_report+0xcf/0x670
[   27.514150]  ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[   27.514161]  ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[   27.514172]  kasan_report+0xa4/0xe0
[   27.514177]  ? mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[   27.514191]  mt7921_check_offload_capability+0x3fa/0x430 [mt7921_common]
[   27.514203]  ? __pfx_mt7921_check_offload_capability+0x10/0x10
[mt7921_common]
[   27.514214]  ? __pfx_pcibios_set_master+0x10/0x10
[   27.514219]  ? pcim_iomap_regions+0xf3/0x250
[   27.514226]  ? __pfx_mt7921_pci_probe+0x10/0x10 [mt7921e]
[   27.514236]  mt7921_pci_probe+0xf1/0xc20 [mt7921e]
[   27.514243]  ? _raw_spin_unlock_irqrestore+0x4b/0x80
[   27.514249]  ? __pfx_mt7921_pci_probe+0x10/0x10 [mt7921e]
[   27.514256]  local_pci_probe+0xd9/0x190
[   27.514261]  pci_device_probe+0x236/0x770
[   27.514265]  ? kernfs_add_one+0x129/0x460
[   27.514270]  ? __pfx_pci_device_probe+0x10/0x10
[   27.514275]  ? kernfs_create_link+0x167/0x230
[   27.514280]  ? kernfs_put+0x18/0x40
[   27.514283]  ? sysfs_do_create_link_sd+0x8e/0x100
[   27.514289]  really_probe+0x3e2/0xb60
[   27.514296]  __driver_probe_device+0x18c/0x460
[   27.514301]  driver_probe_device+0x4a/0x120
[   27.514305]  __driver_attach+0x1e1/0x4a0
[   27.514310]  ? __pfx___driver_attach+0x10/0x10
[   27.514313]  bus_for_each_dev+0x105/0x180
[   27.514317]  ? __pfx_bus_for_each_dev+0x10/0x10
[   27.514324]  bus_add_driver+0x29d/0x570
[   27.514328]  ? __pfx_init_module+0x10/0x10 [mt7921e]
[   27.514337]  ? __pfx_init_module+0x10/0x10 [mt7921e]
[   27.514344]  driver_register+0x130/0x450
[   27.514349]  ? __pfx_init_module+0x10/0x10 [mt7921e]
[   27.514356]  do_one_initcall+0xd1/0x3b0
[   27.514361]  ? __pfx_do_one_initcall+0x10/0x10
[   27.514368]  ? kasan_unpoison+0x23/0x50
[   27.514374]  do_init_module+0x190/0x670
[   27.514382]  load_module+0x7059/0x7d90
[   27.514395]  ? __pfx_load_module+0x10/0x10
[   27.514401]  ? lock_acquire+0x1a0/0x4e0
[   27.514405]  ? find_held_lock+0x34/0x120
[   27.514416]  ? __pfx___might_resched+0x10/0x10
[   27.514422]  ? __do_sys_init_module+0x208/0x240
[   27.514426]  __do_sys_init_module+0x208/0x240
[   27.514429]  ? __pfx___do_sys_init_module+0x10/0x10
[   27.514438]  ? seqcount_lockdep_reader_access.constprop.0+0xa5/0xb0
[   27.514443]  ? ktime_get_coarse_real_ts64+0x3d/0xc0
[   27.514450]  do_syscall_64+0x5b/0x80
[   27.514457]  ? asm_exc_page_fault+0x22/0x30
[   27.514461]  ? lockdep_hardirqs_on+0x7d/0x100
[   27.514466]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[   27.514469] RIP: 0033:0x7f5f101348ce
[   27.514488] Code: 48 8b 0d 3d 15 0c 00 f7 d8 64 89 01 48 83 c8 ff
c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00
00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0a 15 0c 00 f7 d8 64 89
01 48
[   27.514492] RSP: 002b:00007ffd2ab47908 EFLAGS: 00000246 ORIG_RAX:
00000000000000af
[   27.514497] RAX: ffffffffffffffda RBX: 0000560016d1b1c0 RCX: 00007f5f101348ce
[   27.514499] RDX: 00007f5f1060907d RSI: 000000000003b946 RDI: 00005600180ae4d0
[   27.514501] RBP: 00007ffd2ab479c0 R08: 0000560016cfa0f0 R09: 000000000003a000
[   27.514503] R10: 0000560576ce1d7a R11: 0000000000000246 R12: 00007f5f1060907d
[   27.514505] R13: 0000000000020000 R14: 0000560016d1b010 R15: 0000560016d02040
[   27.514512]  </TASK>

[   27.514515] Memory state around the buggy address:
[   27.514518]  ffffc900063dd900: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[   27.514520]  ffffc900063dd980: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[   27.514522] >ffffc900063dda00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[   27.514523]                                                           ^
[   27.514525]  ffffc900063dda80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[   27.514528]  ffffc900063ddb00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
f8 f8 f8 f8
[   27.514529] ==================================================================
[   27.514531] Disabling lock debugging due to kernel taint
[   27.517884] mt7921e 0000:05:00.0: ASIC revision: 79610010
[   27.582536] usbcore: registered new interface driver btusb
[   27.614430] mt7921e 0000:05:00.0: HW/SW Version: 0x8a108a10, Build
Time: 20230302150916a

I do not know which information would be also useful. Please ask me.

I attached a full kernel log if someone would be interested to see it.

-- 
Best Regards,
Mike Gavrilov.

Attachment: dmesg.tar.xz
Description: Binary data