linux-kernel - Re: [ring_buffer_entries] BUG: unable to handle kernel NULL pointer dereference at (null)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1369856184.15552.76.camel@gandalf.local.home>
Date:	Wed, 29 May 2013 15:36:24 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Fengguang Wu <fengguang.wu@...el.com>
Cc:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [ring_buffer_entries] BUG: unable to handle kernel NULL pointer
 dereference at   (null)

On Wed, 2013-05-29 at 22:13 +0800, Fengguang Wu wrote:
> Hi Rostedt,
> 
> I got the below BUG and the first bad commit could be any of:
> 
> ce9bae55972b228cf7bac34350c4d2caf8ea0d0b
> 121aaee7b0a82605d33af200c7e9ebab6fd6e444
> 737223fbca3b1c91feb947c7f571b35749b743b6
> 45ad21ca5530efdca6a19e4a5ac5e7bd6e24f996
> a695cb5816228f86576f5f5c6809fdf8ed382ece
> 6de58e6269cd0568ca5fbae14423914eff0f7811
> ad909e21bbe69f1d39055d346540abd827190eca
> 0b85ffc293044393623059eda9904a7d5b644e36
> f5eb5588262cab7232ed1d77cf612b327db50767
> f1affcaaa861f27752a769f889bf1486ebd301fe
> f4e781c0a89d5810729772290441ac7d61f321ec
> 12883efb670c28dff57dcd7f4f995a1ffe153b2d
> 55034cd6e648155393b0d665eef76b38d49ad6bf
> 153e8ed913b022d2003866a848af9fadc041403f
> 
> We cannot bisect more due to broken builds.

No need to bisect. The bug is pretty obvious:

$ grep trace_test_buffer kernel/trace/trace_selftest.c
static int trace_test_buffer_cpu(struct trace_buffer *buf, int cpu)
static int trace_test_buffer(struct trace_buffer *buf, unsigned long
*count)
         * The trace_test_buffer_cpu runs a while loop to consume all
data.
                ret = trace_test_buffer_cpu(buf, cpu);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
        ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
        ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, NULL);
                ret = trace_test_buffer(&tr->max_buffer, &count);
        ret = trace_test_buffer(&tr->trace_buffer, &count);
        ret = trace_test_buffer(tr, &count);


Notice that all but the last one passes in &tr->trace_buffer or
&tr->max_buffer. That last one happens to be in:
trace_selftest_startup_branch()

Thanks!

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/