lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220608153324.GC31193@xsang-OptiPlex-9020> Date: Wed, 8 Jun 2022 23:33:24 +0800 From: kernel test robot <oliver.sang@...el.com> To: "Matthew Wilcox (Oracle)" <willy@...radead.org> Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>, linux-mm@...ck.org, lkp@...ts.01.org, linux-fsdevel@...r.kernel.org, "Matthew Wilcox (Oracle)" <willy@...radead.org>, linux-ext4@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net, linux-nilfs@...r.kernel.org Subject: [vmscan] bc9eb0d5ef: BUG:KASAN:stack-out-of-bounds_in_check_move_unevictable_pages Greeting, FYI, we noticed the following commit (built with gcc-11): commit: bc9eb0d5ef0a437e399f0fe3b7430b9da5ef9f95 ("[PATCH 08/10] vmscan: Add check_move_unevictable_folios()") url: https://github.com/intel-lab-lkp/linux/commits/Matthew-Wilcox-Oracle/Convert-to-filemap_get_folios/20220606-034220 base: https://git.kernel.org/cgit/linux/kernel/git/tytso/ext4.git dev patch link: https://lore.kernel.org/linux-fsdevel/20220605193854.2371230-9-willy@infradead.org in testcase: boot on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): +---------------------------------------------------------------+------------+------------+ | | 9f1a7a0465 | bc9eb0d5ef | +---------------------------------------------------------------+------------+------------+ | boot_successes | 24 | 0 | | boot_failures | 0 | 26 | | BUG:KASAN:stack-out-of-bounds_in_check_move_unevictable_pages | 0 | 26 | | canonical_address#:#[##] | 0 | 26 | | RIP:check_move_unevictable_folios | 0 | 26 | | Kernel_panic-not_syncing:Fatal_exception | 0 | 26 | +---------------------------------------------------------------+------------+------------+ If you fix the issue, kindly add following tag Reported-by: kernel test robot <oliver.sang@...el.com> [ 40.053150][ T1] ================================================================== [ 40.054793][ T1] BUG: KASAN: stack-out-of-bounds in check_move_unevictable_pages+0x34c/0x40f [ 40.056610][ T1] Write of size 8 at addr ffff88810083fd88 by task swapper/0/1 [ 40.056720][ T1] [ 40.056720][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc5-00033-gbc9eb0d5ef0a #1 [ 40.056720][ T1] Call Trace: [ 40.056720][ T1] <TASK> [ 40.056720][ T1] dump_stack_lvl+0x45/0x59 [ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f [ 40.056720][ T1] print_address_description.cold+0xcc/0x404 [ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f [ 40.056720][ T1] print_report.cold+0x36/0x20b [ 40.056720][ T1] kasan_report+0xbe/0x199 [ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f [ 40.056720][ T1] check_move_unevictable_pages+0x34c/0x40f [ 40.056720][ T1] ? check_move_unevictable_folios+0xba6/0xba6 [ 40.056720][ T1] ? lock_is_held_type+0x9c/0x111 [ 40.056720][ T1] ? lru_lazyfree_fn+0x245/0x245 [ 40.056720][ T1] ? lock_release+0xdf/0x1fb [ 40.056720][ T1] ? mlock_page_drain_local+0x1a9/0x31b [ 40.056720][ T1] ? lock_is_held_type+0x96/0x111 [ 40.056720][ T1] drm_gem_put_pages+0x206/0x363 [ 40.056720][ T1] ? drm_gem_vm_open+0x75/0x75 [ 40.056720][ T1] ? slab_free_freelist_hook+0xba/0x167 [ 40.056720][ T1] ? drm_gem_shmem_vunmap+0x121/0x1a2 [ 40.056720][ T1] drm_gem_shmem_put_pages_locked+0xf8/0x1f2 [ 40.056720][ T1] drm_gem_shmem_vunmap+0x13a/0x1a2 [ 40.056720][ T1] drm_gem_vunmap+0xcb/0x1d0 [ 40.056720][ T1] drm_fbdev_cleanup+0x251/0x33d [ 40.056720][ T1] drm_fbdev_client_hotplug+0x3fa/0x50e [ 40.056720][ T1] drm_fbdev_generic_setup+0x16b/0x3f0 [ 40.056720][ T1] vkms_create+0x401/0x470 [ 40.056720][ T1] ? drm_sched_pick_best.cold+0x32/0x32 [ 40.056720][ T1] ? drm_sched_fence_slab_init+0x31/0x31 [ 40.056720][ T1] ? __kasan_kmalloc+0x81/0x95 [ 40.056720][ T1] ? vgem_init+0x1cb/0x1cb [ 40.056720][ T1] do_one_initcall+0xbc/0x3db [ 40.056720][ T1] ? trace_event_raw_event_initcall_level+0x19c/0x19c [ 40.056720][ T1] ? parameq+0xcc/0xcc [ 40.056720][ T1] do_initcalls+0x1ce/0x202 [ 40.056720][ T1] kernel_init_freeable+0x21f/0x250 [ 40.056720][ T1] ? rest_init+0x202/0x202 [ 40.056720][ T1] kernel_init+0x19/0x12b [ 40.056720][ T1] ret_from_fork+0x22/0x30 [ 40.056720][ T1] </TASK> [ 40.056720][ T1] [ 40.056720][ T1] The buggy address belongs to stack of task swapper/0/1 [ 40.056720][ T1] and is located at offset 120 in frame: [ 40.056720][ T1] vkms_create+0x0/0x470 [ 40.056720][ T1] [ 40.056720][ T1] This frame has 1 object: [ 40.056720][ T1] [32, 120) 'pdevinfo' [ 40.056720][ T1] [ 40.056720][ T1] The buggy address belongs to the physical page: [ 40.056720][ T1] page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10083f [ 40.056720][ T1] flags: 0x8000000000000000(zone=2) [ 40.056720][ T1] raw: 8000000000000000 ffffea0004020fc8 ffffea0004020fc8 0000000000000000 [ 40.056720][ T1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 40.056720][ T1] page dumped because: kasan: bad access detected [ 40.056720][ T1] page_owner tracks the page as allocated [ 40.056720][ T1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 22266683981, free_ts 0 [ 40.056720][ T1] register_early_stack+0x65/0xa4 [ 40.056720][ T1] init_page_owner+0x2a/0xa7 [ 40.056720][ T1] kernel_init_freeable+0x1d7/0x250 [ 40.056720][ T1] kernel_init+0x19/0x12b [ 40.056720][ T1] page_owner free stack trace missing [ 40.056720][ T1] [ 40.056720][ T1] Memory state around the buggy address: [ 40.056720][ T1] ffff88810083fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.056720][ T1] ffff88810083fd00: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 [ 40.056720][ T1] >ffff88810083fd80: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 [ 40.056720][ T1] ^ [ 40.056720][ T1] ffff88810083fe00: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3 f3 [ 40.056720][ T1] ffff88810083fe80: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.056720][ T1] ================================================================== [ 40.146127][ T1] Disabling lock debugging due to kernel taint [ 40.147606][ T1] general protection fault, probably for non-canonical address 0xdffffc0000000048: 0000 [#1] SMP KASAN PTI [ 40.150060][ T1] KASAN: null-ptr-deref in range [0x0000000000000240-0x0000000000000247] [ 40.150060][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.18.0-rc5-00033-gbc9eb0d5ef0a #1 [ 40.150060][ T1] RIP: 0010:check_move_unevictable_folios+0x140/0xba6 [ 40.150060][ T1] Code: 48 c1 e8 03 80 3c 28 00 0f 85 b1 07 00 00 48 63 c3 4d 8b 7c c5 08 be 08 00 00 00 4c 89 ff e8 e2 e6 12 00 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 a8 07 00 00 49 8b 07 a9 00 00 01 00 74 05 0f 1f [ 40.150060][ T1] RSP: 0000:ffff88810083f930 EFLAGS: 00010207 [ 40.150060][ T1] RAX: 0000000000000048 RBX: 0000000000000000 RCX: ffffffff8154d44e [ 40.150060][ T1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000246 [ 40.150060][ T1] RBP: dffffc0000000000 R08: 000000000000024e R09: 0000000000000000 [ 40.150060][ T1] R10: ffffffff8154d44e R11: fffffbfff0e09dc8 R12: ffff88810083f9e0 [ 40.150060][ T1] R13: ffff88810083f9d8 R14: 000000000000007e R15: 0000000000000246 [ 40.150060][ T1] FS: 0000000000000000(0000) GS:ffff8883aec00000(0000) knlGS:0000000000000000 [ 40.150060][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.150060][ T1] CR2: ffff88843ffff000 CR3: 0000000005466000 CR4: 00000000000406f0 [ 40.150060][ T1] Call Trace: [ 40.150060][ T1] <TASK> [ 40.150060][ T1] ? kasan_report.cold+0x10/0x1a [ 40.150060][ T1] check_move_unevictable_pages+0x156/0x40f [ 40.150060][ T1] ? check_move_unevictable_folios+0xba6/0xba6 [ 40.150060][ T1] ? lock_is_held_type+0xa5/0x111 [ 40.150060][ T1] ? lru_lazyfree_fn+0x245/0x245 [ 40.150060][ T1] ? lock_release+0xdf/0x1fb [ 40.150060][ T1] ? mlock_page_drain_local+0x1a9/0x31b [ 40.150060][ T1] ? lock_is_held_type+0x96/0x111 [ 40.150060][ T1] drm_gem_put_pages+0x206/0x363 [ 40.150060][ T1] ? drm_gem_vm_open+0x75/0x75 [ 40.150060][ T1] ? slab_free_freelist_hook+0xba/0x167 [ 40.150060][ T1] ? drm_gem_shmem_vunmap+0x121/0x1a2 [ 40.150060][ T1] drm_gem_shmem_put_pages_locked+0xf8/0x1f2 [ 40.150060][ T1] drm_gem_shmem_vunmap+0x13a/0x1a2 [ 40.150060][ T1] drm_gem_vunmap+0xcb/0x1d0 [ 40.150060][ T1] drm_fbdev_cleanup+0x251/0x33d [ 40.150060][ T1] drm_fbdev_client_hotplug+0x3fa/0x50e [ 40.150060][ T1] drm_fbdev_generic_setup+0x16b/0x3f0 [ 40.150060][ T1] vkms_create+0x401/0x470 [ 40.150060][ T1] ? drm_sched_pick_best.cold+0x32/0x32 [ 40.150060][ T1] ? drm_sched_fence_slab_init+0x31/0x31 [ 40.150060][ T1] ? vgem_init+0x1cb/0x1cb [ 40.150060][ T1] do_one_initcall+0xbc/0x3db [ 40.150060][ T1] ? trace_event_raw_event_initcall_level+0x19c/0x19c [ 40.150060][ T1] ? parameq+0xcc/0xcc [ 40.150060][ T1] do_initcalls+0x1ce/0x202 [ 40.150060][ T1] kernel_init_freeable+0x21f/0x250 [ 40.150060][ T1] ? rest_init+0x202/0x202 [ 40.150060][ T1] kernel_init+0x19/0x12b [ 40.150060][ T1] ret_from_fork+0x22/0x30 [ 40.150060][ T1] </TASK> To reproduce: # build kernel cd linux cp config-5.18.0-rc5-00033-gbc9eb0d5ef0a .config make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install cd <mod-install-dir> find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email # if come across any failure that blocks the test, # please remove ~/.lkp and /lkp dir to run from a clean state. -- 0-DAY CI Kernel Test Service https://01.org/lkp View attachment "config-5.18.0-rc5-00033-gbc9eb0d5ef0a" of type "text/plain" (141683 bytes) View attachment "job-script" of type "text/plain" (4936 bytes) Download attachment "dmesg.xz" of type "application/x-xz" (11676 bytes)
Powered by blists - more mailing lists