KASAN: out-of-bounds Read in vsnprintf

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 021c91791a5e Linux 4.18-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11236592400000
kernel config: https://syzkaller.appspot.com/x/.config?x=f62553dc846b0692
dashboard link: https://syzkaller.appspot.com/bug?extid=31b6e2c6ded6c73f5742
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
CC: [linux-...@vger.kernel.org pml...@suse.com
ros...@goodmis.org sergey.se...@gmail.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+31b6e2...@syzkaller.appspotmail.com

binder: 18317:18318 IncRefs 0 refcount change on invalid ref 0 ret -22
binder: 18317:18318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: 18317:18318 DecRefs 0 refcount change on invalid ref 0 ret -22
binder: 18317:18318 IncRefs 0 refcount change on invalid ref 4 ret -22
==================================================================
BUG: KASAN: out-of-bounds in vsnprintf+0x19f7/0x1b60 lib/vsprintf.c:2267
Read of size 8 at addr ffff8801d97ce8b0 by task syz-executor3/18332

CPU: 0 PID: 18332 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #127
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
vsnprintf+0x19f7/0x1b60 lib/vsprintf.c:2267
vscnprintf+0x2d/0x80 lib/vsprintf.c:2370
vprintk_emit+0x1ab/0xdf0 kernel/printk/printk.c:1853

The buggy address belongs to the page:
page:ffffea000765f380 count:0 mapcount:0 mapping:0000000000000000
index:0xffff8801d97ceac0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000
raw: ffff8801d97ceac0 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801d97ce780: f2 01 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00
ffff8801d97ce800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8801d97ce880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8801d97ce900: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
ffff8801d97ce980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.