mirror of
https://github.com/torvalds/linux.git
synced 2026-05-23 06:31:58 +02:00
66fbfb35da
Problem can be reproduced by unloading snd_soc_simple_card, because in
devm_get_clk_from_child() devres data is allocated as `struct clk`, but
devm_clk_release() expects devres data to be `struct devm_clk_state`.
KASAN report:
==================================================================
BUG: KASAN: slab-out-of-bounds in devm_clk_release+0x20/0x54
Read of size 8 at addr ffffff800ee09688 by task (udev-worker)/287
Call trace:
dump_backtrace+0xe8/0x11c
show_stack+0x1c/0x30
dump_stack_lvl+0x60/0x78
print_report+0x150/0x450
kasan_report+0xa8/0xf0
__asan_load8+0x78/0xa0
devm_clk_release+0x20/0x54
release_nodes+0x84/0x120
devres_release_all+0x144/0x210
device_unbind_cleanup+0x1c/0xac
really_probe+0x2f0/0x5b0
__driver_probe_device+0xc0/0x1f0
driver_probe_device+0x68/0x120
__driver_attach+0x140/0x294
bus_for_each_dev+0xec/0x160
driver_attach+0x38/0x44
bus_add_driver+0x24c/0x300
driver_register+0xf0/0x210
__platform_driver_register+0x48/0x54
asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card]
do_one_initcall+0xac/0x340
do_init_module+0xd0/0x300
load_module+0x2ba4/0x3100
__do_sys_init_module+0x2c8/0x300
__arm64_sys_init_module+0x48/0x5c
invoke_syscall+0x64/0x190
el0_svc_common.constprop.0+0x124/0x154
do_el0_svc+0x44/0xdc
el0_svc+0x14/0x50
el0t_64_sync_handler+0xec/0x11c
el0t_64_sync+0x14c/0x150
Allocated by task 287:
kasan_save_stack+0x38/0x60
kasan_set_track+0x28/0x40
kasan_save_alloc_info+0x20/0x30
__kasan_kmalloc+0xac/0xb0
__kmalloc_node_track_caller+0x6c/0x1c4
__devres_alloc_node+0x44/0xb4
devm_get_clk_from_child+0x44/0xa0
asoc_simple_parse_clk+0x1b8/0x1dc [snd_soc_simple_card_utils]
simple_parse_node.isra.0+0x1ec/0x230 [snd_soc_simple_card]
simple_dai_link_of+0x1bc/0x334 [snd_soc_simple_card]
__simple_for_each_link+0x2ec/0x320 [snd_soc_simple_card]
asoc_simple_probe+0x468/0x4dc [snd_soc_simple_card]
platform_probe+0x90/0xf0
really_probe+0x118/0x5b0
__driver_probe_device+0xc0/0x1f0
driver_probe_device+0x68/0x120
__driver_attach+0x140/0x294
bus_for_each_dev+0xec/0x160
driver_attach+0x38/0x44
bus_add_driver+0x24c/0x300
driver_register+0xf0/0x210
__platform_driver_register+0x48/0x54
asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card]
do_one_initcall+0xac/0x340
do_init_module+0xd0/0x300
load_module+0x2ba4/0x3100
__do_sys_init_module+0x2c8/0x300
__arm64_sys_init_module+0x48/0x5c
invoke_syscall+0x64/0x190
el0_svc_common.constprop.0+0x124/0x154
do_el0_svc+0x44/0xdc
el0_svc+0x14/0x50
el0t_64_sync_handler+0xec/0x11c
el0t_64_sync+0x14c/0x150
The buggy address belongs to the object at ffffff800ee09600
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 136 bytes inside of
256-byte region [ffffff800ee09600, ffffff800ee09700)
The buggy address belongs to the physical page:
page:000000002d97303b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ee08
head:000000002d97303b order:1 compound_mapcount:0 compound_pincount:0
flags: 0x10200(slab|head|zone=0)
raw: 0000000000010200 0000000000000000 dead000000000122 ffffff8002c02480
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffff800ee09580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff800ee09600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffff800ee09680: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffffff800ee09700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffff800ee09780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fixes:
|
||
|---|---|---|
| .. | ||
| actions | ||
| analogbits | ||
| at91 | ||
| axis | ||
| axs10x | ||
| baikal-t1 | ||
| bcm | ||
| berlin | ||
| davinci | ||
| hisilicon | ||
| imgtec | ||
| imx | ||
| ingenic | ||
| keystone | ||
| mediatek | ||
| meson | ||
| microchip | ||
| mmp | ||
| mstar | ||
| mvebu | ||
| mxs | ||
| nuvoton | ||
| nxp | ||
| pistachio | ||
| pxa | ||
| qcom | ||
| ralink | ||
| renesas | ||
| rockchip | ||
| samsung | ||
| sifive | ||
| socfpga | ||
| spear | ||
| sprd | ||
| st | ||
| starfive | ||
| stm32 | ||
| sunxi | ||
| sunxi-ng | ||
| tegra | ||
| ti | ||
| uniphier | ||
| ux500 | ||
| versatile | ||
| visconti | ||
| x86 | ||
| xilinx | ||
| zynq | ||
| zynqmp | ||
| .kunitconfig | ||
| clk_test.c | ||
| clk-apple-nco.c | ||
| clk-asm9260.c | ||
| clk-aspeed.c | ||
| clk-aspeed.h | ||
| clk-ast2600.c | ||
| clk-axi-clkgen.c | ||
| clk-axm5516.c | ||
| clk-bd718x7.c | ||
| clk-bm1880.c | ||
| clk-bulk.c | ||
| clk-cdce706.c | ||
| clk-cdce925.c | ||
| clk-clps711x.c | ||
| clk-composite.c | ||
| clk-conf.c | ||
| clk-cs2000-cp.c | ||
| clk-devres.c | ||
| clk-divider.c | ||
| clk-en7523.c | ||
| clk-fixed-factor.c | ||
| clk-fixed-mmio.c | ||
| clk-fixed-rate.c | ||
| clk-fractional-divider.c | ||
| clk-fractional-divider.h | ||
| clk-fsl-flexspi.c | ||
| clk-fsl-sai.c | ||
| clk-gate_test.c | ||
| clk-gate.c | ||
| clk-gemini.c | ||
| clk-gpio.c | ||
| clk-hi655x.c | ||
| clk-highbank.c | ||
| clk-hsdk-pll.c | ||
| clk-k210.c | ||
| clk-lan966x.c | ||
| clk-lmk04832.c | ||
| clk-lochnagar.c | ||
| clk-loongson1.c | ||
| clk-loongson2.c | ||
| clk-max9485.c | ||
| clk-max77686.c | ||
| clk-milbeaut.c | ||
| clk-moxart.c | ||
| clk-multiplier.c | ||
| clk-mux.c | ||
| clk-nomadik.c | ||
| clk-npcm7xx.c | ||
| clk-nspire.c | ||
| clk-oxnas.c | ||
| clk-palmas.c | ||
| clk-plldig.c | ||
| clk-pwm.c | ||
| clk-qoriq.c | ||
| clk-renesas-pcie.c | ||
| clk-rk808.c | ||
| clk-s2mps11.c | ||
| clk-scmi.c | ||
| clk-scpi.c | ||
| clk-si514.c | ||
| clk-si521xx.c | ||
| clk-si544.c | ||
| clk-si570.c | ||
| clk-si5341.c | ||
| clk-si5351.c | ||
| clk-si5351.h | ||
| clk-sp7021.c | ||
| clk-sparx5.c | ||
| clk-stm32f4.c | ||
| clk-stm32h7.c | ||
| clk-stm32mp1.c | ||
| clk-tps68470.c | ||
| clk-twl6040.c | ||
| clk-versaclock5.c | ||
| clk-versaclock7.c | ||
| clk-vt8500.c | ||
| clk-wm831x.c | ||
| clk-xgene.c | ||
| clk.c | ||
| clk.h | ||
| clkdev.c | ||
| Kconfig | ||
| Makefile | ||