[sched] 1827adb11a BUG kmalloc-128 (Not tainted): Poison overwritten

[Fengguang Wu]

Hi Ingo,

FYI this also shows up in next-20170308 and tip/master 7f27de49
("Merge branch 'WIP.sched/core'"). The attached reproduce-* script may
help, however note that this bug may not show up in every boot.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

commit 1827adb11ad26b2290dc9fe2aaf54976b2439865
Merge: 7876991 5eca1c1
Author: Linus Torvalds <torv...@linux-foundation.org>
AuthorDate: Fri Mar 3 10:16:38 2017 -0800
Commit: Linus Torvalds <torv...@linux-foundation.org>
CommitDate: Fri Mar 3 10:16:38 2017 -0800

Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull sched.h split-up from Ingo Molnar:
"The point of these changes is to significantly reduce the
<linux/sched.h> header footprint, to speed up the kernel build and to
have a cleaner header structure.

After these changes the new <linux/sched.h>'s typical preprocessed
size goes down from a previous ~0.68 MB (~22K lines) to ~0.45 MB (~15K
lines), which is around 40% faster to build on typical configs.

Not much changed from the last version (-v2) posted three weeks ago: I
eliminated quirks, backmerged fixes plus I rebased it to an upstream
SHA1 from yesterday that includes most changes queued up in -next plus
all sched.h changes that were pending from Andrew.

I've re-tested the series both on x86 and on cross-arch defconfigs,
and did a bisectability test at a number of random points.

I tried to test as many build configurations as possible, but some
build breakage is probably still left - but it should be mostly
limited to architectures that have no cross-compiler binaries
available on kernel.org, and non-default configurations"

* 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (146 commits)
sched/headers: Clean up <linux/sched.h>
sched/headers: Remove #ifdefs from <linux/sched.h>
sched/headers: Remove the <linux/topology.h> include from <linux/sched.h>
sched/headers, hrtimer: Remove the <linux/wait.h> include from <linux/hrtimer.h>
sched/headers, x86/apic: Remove the <linux/pm.h> header inclusion from <asm/apic.h>
sched/headers, timers: Remove the <linux/sysctl.h> include from <linux/timer.h>
sched/headers: Remove <linux/magic.h> from <linux/sched/task_stack.h>
sched/headers: Remove <linux/sched.h> from <linux/sched/init.h>
sched/core: Remove unused prefetch_stack()
sched/headers: Remove <linux/rculist.h> from <linux/sched.h>
sched/headers: Remove the 'init_pid_ns' prototype from <linux/sched.h>
sched/headers: Remove <linux/signal.h> from <linux/sched.h>
sched/headers: Remove <linux/rwsem.h> from <linux/sched.h>
sched/headers: Remove the runqueue_is_locked() prototype
sched/headers: Remove <linux/sched.h> from <linux/sched/hotplug.h>
sched/headers: Remove <linux/sched.h> from <linux/sched/debug.h>
sched/headers: Remove <linux/sched.h> from <linux/sched/nohz.h>
sched/headers: Remove <linux/sched.h> from <linux/sched/stat.h>
sched/headers: Remove the <linux/gfp.h> include from <linux/sched.h>
sched/headers: Remove <linux/rtmutex.h> from <linux/sched.h>
...

78769912f6 Merge tag 'linux-kselftest-4.11-rc1-urgent_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
5eca1c10cb sched/headers: Clean up <linux/sched.h>
1827adb11a Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
+-----------------------------------------------+------------+------------+------------+
| | 78769912f6 | 5eca1c10cb | 1827adb11a |
+-----------------------------------------------+------------+------------+------------+
| boot_successes | 69 | 32 | 166 |
| boot_failures | 0 | 0 | 2 |
| BUG_kmalloc-#(Not_tainted):Poison_overwritten | 0 | 0 | 2 |
| INFO:#-#.First_byte#instead_of | 0 | 0 | 2 |
| INFO:Allocated_in_ida_pre_get_age=#cpu=#pid= | 0 | 0 | 2 |
| INFO:Freed_in_ida_pre_get_age=#cpu=#pid= | 0 | 0 | 2 |
| INFO:Slab#objects=#used=#fp=0x(null)flags= | 0 | 0 | 2 |
| INFO:Object#@offset=#fp= | 0 | 0 | 2 |
+-----------------------------------------------+------------+------------+------------+

[ 2.792346] .................................... done.
[ 2.793824] Using IPI No-Shortcut mode
[ 2.806241] Key type trusted registered
[ 2.807779] ima: No TPM chip found, activating TPM-bypass! (rc=-19)
[ 2.810445] =============================================================================
[ 2.813344] BUG kmalloc-128 (Not tainted): Poison overwritten
[ 2.813344] -----------------------------------------------------------------------------
[ 2.813344]
[ 2.813344] Disabling lock debugging due to kernel taint
[ 2.813344] INFO: 0xd6ede140-0xd6ede1be. First byte 0xff instead of 0x6b
[ 2.813344] INFO: Allocated in ida_pre_get+0x3f/0x6a age=71 cpu=0 pid=19
[ 2.813344] ___slab_alloc+0x4c6/0x4d8
[ 2.813344] __slab_alloc+0x40/0x6a
[ 2.813344] kmem_cache_alloc_trace+0x8b/0x150
[ 2.813344] ida_pre_get+0x3f/0x6a
[ 2.813344] ida_simple_get+0x8f/0x108

# HH:MM RESULT GOOD BAD GOOD_BUT_DIRTY DIRTY_NOT_BAD
git bisect start f7f74b7bdd6cbca19825b59e7b5a126dd38d1bbd c470abd4fde40ea6a0846a2beab642a578c0b8cd --
git bisect bad 507eda8a922cef9ce495cdaa575f426363846153 # 03:51 B 0 5 16 0 Merge 'davejiang/davejiang/ioatdma' into devel-spot-201703041051
git bisect bad 6f37d50d389dd0905c0249dafeb9a2c4d6f187bd # 04:06 B 0 3 14 0 Merge 'block/for-linus' into devel-spot-201703041051
git bisect good e3970327faad76348bb43b15501d2469e9599bcf # 04:19 G 10 0 0 0 Merge 'rcar/drm/du/vsp-race-v2.1' into devel-spot-201703041051
git bisect good c98d6d458fed6cb67187f95c33ba1c9a0599f60d # 04:31 G 11 0 0 0 Merge 'linux-review/Tuomo-Rinne/staging-speakup-Fixed-coding-style-errors-and-aligned-indents/20170304-061810' into devel-spot-201703041051
git bisect good 96e410f081d62b36da02fe71417f8266b05f6e34 # 04:42 G 11 0 0 0 Merge 'arm-integrator/apq8060-dragonboard-wm8903' into devel-spot-201703041051
git bisect good b4226ea1775995a06d8ee2d05e4b1294b8d2c9f9 # 04:56 G 11 0 0 0 Merge 'arm-integrator/apq8060-dragonboard-sdc5' into devel-spot-201703041051
git bisect good 3f80dd67c367878aaad16e458eebc3c8980bb841 # 04:56 G 11 0 0 0 Merge tag 'acpi-extra-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
git bisect good 5a2d6880f461faa416c0d329d46a128cf342c1eb # 04:56 G 11 0 0 0 sched/headers: Remove <linux/sched.h> from <linux/sched/loadavg.h>
git bisect good 78769912f680fc0a79a67e798a0ae76f07e63a7b # 04:56 G 11 0 0 0 Merge tag 'linux-kselftest-4.11-rc1-urgent_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
git bisect bad 1827adb11ad26b2290dc9fe2aaf54976b2439865 # 04:56 B 11 2 0 0 Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 4f079e98a0db5f067c0981a526ff8938e21c52e2 # 05:13 G 11 0 0 0 sched/headers: Remove <linux/sched.h> from <linux/sched/debug.h>
git bisect good 5c0d0f36414f9f8a292b42e797f9284b127d79c2 # 05:26 G 11 0 0 0 sched/headers: Remove <linux/sched.h> from <linux/sched/init.h>
git bisect good 283cb90305cf1686594ed537c7a8cb188eba1a4d # 05:38 G 11 0 0 0 sched/headers, hrtimer: Remove the <linux/wait.h> include from <linux/hrtimer.h>
git bisect good 7f5f8e8d97d77edf33f2836259d1f19c6f4d94f5 # 05:48 G 11 0 0 0 sched/headers: Remove #ifdefs from <linux/sched.h>
git bisect good 5eca1c10cbaa9c366c18ca79f81f21c731e3dcc7 # 05:59 G 11 0 0 0 sched/headers: Clean up <linux/sched.h>
# first bad commit: [1827adb11ad26b2290dc9fe2aaf54976b2439865] Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 78769912f680fc0a79a67e798a0ae76f07e63a7b # 06:02 G 31 0 0 0 Merge tag 'linux-kselftest-4.11-rc1-urgent_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
git bisect good 5eca1c10cbaa9c366c18ca79f81f21c731e3dcc7 # 06:06 G 30 0 0 0 sched/headers: Clean up <linux/sched.h>
# extra tests on HEAD of linux-devel/devel-spot-201703041051
git bisect bad f7f74b7bdd6cbca19825b59e7b5a126dd38d1bbd # 06:06 B 0 39 53 0 0day head guard for 'devel-spot-201703041051'
# extra tests on tree/branch linus/master
git bisect bad c1ae3cfa0e89fa1a7ecc4c99031f5e9ae99d9201 # 06:16 B 0 11 22 0 Linux 4.11-rc1
# extra tests on tree/branch linux-next/master
git bisect good c0b7b2b33bd17f7155956d0338ce92615da686c9 # 06:16 G 11 0 0 0 Add linux-next specific files for 20170303

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/lkp Intel Corporation

[Dmitry Vyukov]

On Thu, Mar 9, 2017 at 4:01 AM, Fengguang Wu <fenggu...@intel.com> wrote:
> Hi Ingo,
>
> FYI this also shows up in next-20170308 and tip/master 7f27de49
> ("Merge branch 'WIP.sched/core'"). The attached reproduce-* script may
> help, however note that this bug may not show up in every boot.

This is not KASAN-detected bug, this is slub debug or something.
The crash looks like the issue that I fixed here few days ago:
https://groups.google.com/d/msg/syzkaller/dpZ6ou1WOiI/7zfgSe1QEAAJ

> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+...@googlegroups.com.
> To post to this group, send email to kasa...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20170309030157.vzkijmdia77xwafv%40wfg-t540p.sh.intel.com.
> For more options, visit https://groups.google.com/d/optout.