Bug 220035 - vmalloc-out-of-bounds in scomp_acomp_comp_decomp
Summary: vmalloc-out-of-bounds in scomp_acomp_comp_decomp
Status: NEW
Alias: None
Product: Memory Management
Classification: Unclassified
Component: Other (show other bugs)
Hardware: ARM Linux
: P3 normal
Assignee: Andrew Morton
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-19 08:12 UTC by Marius Dinu
Modified: 2025-05-02 16:15 UTC (History)
1 user (show)

See Also:
Kernel Version:
Subsystem:
Regression: Yes
Bisected commit-id: 01d5b167dc230cf3b6eb9dd7205f6a705026d1ce

Attachments
kernel config (134.20 KB, text/plain)
2025-04-19 08:12 UTC, Marius Dinu 		Details
dmesg error (27.36 KB, text/plain)
2025-04-19 08:13 UTC, Marius Dinu 		Details
Add an attachment (proposed patch, testcase, etc.)

Description Marius Dinu 2025-04-19 08:12:54 UTC 
Created attachment 307994 [details]
kernel config

Asus Tinkerboard S (RK3288, armv7, 2GB RAM)

When I enable zswap, and the memory is getting full, I start getting errors like this and the process freezes:

BUG: KASAN: vmalloc-out-of-bounds in scomp_acomp_comp_decomp+0xdb8/0xe8c

It can be reproduced by running "stress-ng --pageswap 1". When zswap is enabled, this command crashes immediately.

I did a git bisect and the result was this:
first bad commit: [01d5b167dc230cf3b6eb9dd7205f6a705026d1ce] Merge tag 'modules-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux

I'm attaching the kernel config and the complete error with debugging enabled.
Comment 1 Marius Dinu 2025-04-19 08:13:43 UTC 
Created attachment 307995 [details]
dmesg error
Comment 2 Marius Dinu 2025-04-19 08:14:01 UTC 
Thank you.
Comment 3 Guilherme 2025-05-01 18:16:26 UTC 
You have KASAN able. 

Can you send for me your output for this commands? 

grep -E "CONFIG_KASAN|CONFIG_KASAN_(GENERIC|SW_TAGS|HW_TAGS)" /boot/config-$(uname -r)


cat /proc/cpuinfo | grep -i mte


cat /proc/cmdline | grep -o "kasan=[^ ]*"
Comment 4 Marius Dinu 2025-05-02 16:15:34 UTC 
No need. The bug was found. See here:

https://lore.kernel.org/all/aAW8E9NrKWq1Xk2w@gondor.apana.org.au/
Note You need to log in before you can comment on or make changes to this bug.