Hello,
The following program triggers slab-out-of-bounds write in __apic_accept_irq:
https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt
On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5)
==================================================================
BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at
addr ffff880035d4918f
Write of size 1 by task a.out/27101
CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91
ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b
0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
[<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159
[< inline >] print_address_description mm/kasan/report.c:197
[< inline >] kasan_report_error mm/kasan/report.c:286
[<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306
[<ffffffff819f106c>] __asan_report_store1_noabort+0x1c/0x20
mm/kasan/report.c:334
[<ffffffff8116fb53>] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
[<ffffffff8117245e>] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
[<ffffffff81184ea2>] kvm_irq_delivery_to_apic+0x732/0xc10
arch/x86/kvm/irq_comm.c:86
[<ffffffff8118064d>] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
[<ffffffff811817c5>] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
[< inline >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
[<ffffffff81183653>] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
[< inline >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
[<ffffffff810dfe18>] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
[<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
[< inline >] SYSC_ioctl fs/ioctl.c:694
[<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
[<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6
arch/x86/entry/entry_64.S:209
Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048
Allocated:
PID = 27101
[ 291.279030] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20
[ 291.279030] [<ffffffff819efce3>] save_stack+0x43/0xd0
[ 291.279030] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0
[ 291.279030] [<ffffffff819ec32c>] kmem_cache_alloc_trace+0x12c/0x710
[ 291.279030] [<ffffffff81182ca0>] kvm_ioapic_init+0xa0/0x680
[ 291.279030] [<ffffffff810df5e7>] kvm_arch_vm_ioctl+0x11d7/0x23c0
[ 291.279030] [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
[ 291.279030] [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630
[ 291.279030] [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0
[ 291.279030] [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to kernel taint
Disabled LAPIC found during irq injection