423f75083a: BUG:KASAN:global-out-of-bounds_in_insert_header

Hello,

kernel test robot noticed "BUG:KASAN:global-out-of-bounds_in_insert_header" on:

commit: 423f75083acd947804c8d5c31ad1e1b5fcb3c020 ("scheduler: Remove the now superfluous sentinel elements from ctl_table array")
https://protect2.fireeye.com/v1/url?k=f16b7e8b-9010d41c-f16af5c4-74fe4860001d-9593d622a157bf33&q=1&e=8a7fa261-c965-4e86-9b45-a85e043a6025&u=https%3A%2F%2Fgithub.com%2FJoelgranados%2Flinux.git jag/sysctl_remove_empty_elem_kernel

in testcase: boot

compiler: gcc-9
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)

+---------------------------------------------------+------------+------------+
|                                                   | 9bd138a89a | 423f75083a |
+---------------------------------------------------+------------+------------+
| BUG:KASAN:global-out-of-bounds_in_insert_header   | 0          | 14         |
+---------------------------------------------------+------------+------------+

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-lkp/[email protected]

[ 19.917748][ T1] BUG: KASAN: global-out-of-bounds in insert_header (fs/proc/proc_sysctl.c:236) 
[   19.917748][    T1] Read of size 4 at addr ffffffff86ade6b8 by task swapper/0/1
[   19.917748][    T1]
[   19.917748][    T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.0-rc2-00030-g423f75083acd #1 ed4fb2c8ca9b9b9984dcf540593bcadd356bb772
[   19.917748][    T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   19.917748][    T1] Call Trace:
[   19.917748][    T1]  <TASK>
[ 19.917748][ T1] dump_stack_lvl (lib/dump_stack.c:108) 
[ 19.917748][ T1] print_address_description+0x66/0x390 
[ 19.917748][ T1] ? insert_header (fs/proc/proc_sysctl.c:236) 
[ 19.917748][ T1] print_report (mm/kasan/report.c:476) 
[ 19.917748][ T1] ? kasan_addr_to_slab (mm/kasan/common.c:35) 
[ 19.917748][ T1] kasan_report (mm/kasan/report.c:590) 
[ 19.917748][ T1] ? insert_header (fs/proc/proc_sysctl.c:236) 
[ 19.917748][ T1] insert_header (fs/proc/proc_sysctl.c:236) 
[ 19.917748][ T1] ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2155 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:115) 
[ 19.917748][ T1] ? __kasan_kmalloc (mm/kasan/common.c:384) 
[ 19.917748][ T1] __register_sysctl_table (fs/proc/proc_sysctl.c:1395) 
[ 19.917748][ T1] ? mix_pool_bytes (drivers/char/random.c:918) 
[ 19.917748][ T1] __register_sysctl_init (fs/proc/proc_sysctl.c:1454) 
[ 19.917748][ T1] ? user_namespace_sysctl_init (kernel/sched/core.c:4717) 
[ 19.917748][ T1] sched_core_sysctl_init (kernel/sched/core.c:4720) 
[ 19.917748][ T1] do_one_initcall (init/main.c:1236) 
[ 19.917748][ T1] ? trace_event_raw_event_initcall_level (init/main.c:1227) 
[ 19.917748][ T1] ? parameq (kernel/params.c:171) 
[ 19.917748][ T1] ? _raw_spin_trylock_bh (include/linux/spinlock_api_smp.h:174 kernel/locking/spinlock.c:146) 
[ 19.917748][ T1] ? kasan_set_track (mm/kasan/common.c:52) 
[ 19.917748][ T1] ? __kasan_kmalloc (mm/kasan/common.c:384) 
[ 19.917748][ T1] kernel_init_freeable (init/main.c:1297 init/main.c:1314 init/main.c:1333 init/main.c:1551) 
[ 19.917748][ T1] ? rest_init (init/main.c:1433) 
[ 19.917748][ T1] kernel_init (init/main.c:1443) 
[ 19.917748][ T1] ? _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:77 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202) 
[ 19.917748][ T1] ret_from_fork (arch/x86/kernel/process.c:153) 
[ 19.917748][ T1] ? rest_init (init/main.c:1433) 
[ 19.917748][ T1] ret_from_fork_asm (arch/x86/entry/entry_64.S:312) 
[   19.917748][    T1]  </TASK>
[   19.917748][    T1]
[   19.917748][    T1] The buggy address belongs to the variable:
[ 19.917748][ T1] sched_core_sysctls+0x18/0x20 
[   19.917748][    T1]
[   19.917748][    T1] The buggy address belongs to the physical page:
[   19.917748][    T1] page:ffffea00001ab780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6ade
[   19.917748][    T1] flags: 0x4000000000004000(reserved|zone=1)
[   19.917748][    T1] page_type: 0xffffffff()
[   19.917748][    T1] raw: 4000000000004000 ffffea00001ab788 ffffea00001ab788 0000000000000000
[   19.917748][    T1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   19.917748][    T1] page dumped because: kasan: bad access detected
[   19.917748][    T1] page_owner info is not present (never set?)
[   19.917748][    T1]
[   19.917748][    T1] Memory state around the buggy address:
[   19.917748][    T1]  ffffffff86ade580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   19.917748][    T1]  ffffffff86ade600: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 04 f9 f9 f9
[   19.917748][    T1] >ffffffff86ade680: f9 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
[   19.917748][    T1]                                         ^
[   19.917748][    T1]  ffffffff86ade700: 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
[   19.917748][    T1]  ffffffff86ade780: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
[   19.917748][    T1] ==================================================================
[   19.956634][    T1] Disabling lock debugging due to kernel taint

The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20231120/[email protected]

Signature · 2 lines

0-DAY CI Kernel Test Service
https://protect2.fireeye.com/v1/url?k=affeaf70-ce8505e7-afff243f-74fe4860001d-3fbea93df14d4e36&q=1&e=8a7fa261-c965-4e86-9b45-a85e043a6025&u=https%3A%2F%2Fgithub.com%2Fintel%2Flkp-tests%2Fwiki