| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150714051957.GB19723@wfg-t540p.sh.intel.com>
Date: Tue, 14 Jul 2015 13:19:57 +0800
From: Fengguang Wu <fengguang.wu@...el.com>
To: Thomas Graf <tgraf@...g.ch>
Cc: fengguang.wu@...el.com, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, LKP <lkp@...org>
Subject: [rhashtable] WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:301
__debug_object_init()
Greetings,
0day kernel testing robot got the below dmesg and the first bad commit is
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
commit 97defe1ecf868b8127f8e62395499d6a06e4c4b1
Author: Thomas Graf <tgraf@...g.ch>
AuthorDate: Fri Jan 2 23:00:20 2015 +0100
Commit: David S. Miller <davem@...emloft.net>
CommitDate: Sat Jan 3 14:32:57 2015 -0500
rhashtable: Per bucket locks & deferred expansion/shrinking
Introduces an array of spinlocks to protect bucket mutations. The number
of spinlocks per CPU is configurable and selected based on the hash of
the bucket. This allows for parallel insertions and removals of entries
which do not share a lock.
The patch also defers expansion and shrinking to a worker queue which
allows insertion and removal from atomic context. Insertions and
deletions may occur in parallel to it and are only held up briefly
while the particular bucket is linked or unzipped.
Mutations of the bucket table pointer is protected by a new mutex, read
access is RCU protected.
In the event of an expansion or shrinking, the new bucket table allocated
is exposed as a so called future table as soon as the resize process
starts. Lookups, deletions, and insertions will briefly use both tables.
The future table becomes the main table after an RCU grace period and
initial linking of the old to the new table was performed. Optimization
of the chains to make use of the new number of buckets follows only the
new table is in use.
The side effect of this is that during that RCU grace period, a bucket
traversal using any rht_for_each() variant on the main table will not see
any insertions performed during the RCU grace period which would at that
point land in the future table. The lookup will see them as it searches
both tables if needed.
Having multiple insertions and removals occur in parallel requires nelems
to become an atomic counter.
Signed-off-by: Thomas Graf <tgraf@...g.ch>
Signed-off-by: David S. Miller <davem@...emloft.net>
+------------------------------------------------------+------------+------------+------------+
| | 113948d841 | 97defe1ecf | 05016b0f0a |
+------------------------------------------------------+------------+------------+------------+
| boot_successes | 61 | 0 | 0 |
| boot_failures | 27 | 22 | 1931 |
| WARNING:at_net/netlink/genetlink.c:#genl_unbind() | 27 | 1 | |
| backtrace:do_group_exit | 27 | 1 | |
| backtrace:SyS_exit_group | 27 | 1 | |
| WARNING:at_lib/debugobjects.c:#__debug_object_init() | 0 | 22 | 1931 |
| backtrace:__debug_object_init | 0 | 22 | 1931 |
| backtrace:warn_slowpath_null | 0 | 22 | 1931 |
| backtrace:debug_object_init | 0 | 22 | 1931 |
| backtrace:__init_work | 0 | 22 | 1931 |
| backtrace:rhashtable_init | 0 | 22 | 1931 |
| backtrace:test_rht_init | 0 | 22 | 1931 |
| backtrace:kernel_init_freeable | 0 | 22 | 1931 |
| backtrace:init_timer_key | 0 | 22 | |
| RIP:__asan_load8 | 0 | 0 | 6 |
| Kernel_panic-not_syncing:softlockup:hung_tasks | 0 | 0 | 18 |
| backtrace:erase_augmented | 0 | 0 | 4 |
| backtrace:rbtree_test_init | 0 | 0 | 18 |
| RIP:__asan_loadN | 0 | 0 | 4 |
| backtrace:insert_augmented | 0 | 0 | 5 |
| RIP:__asan_load4 | 0 | 0 | 2 |
| backtrace:apic_timer_interrupt | 0 | 0 | 6 |
| RIP:insert_augmented | 0 | 0 | 2 |
| backtrace:rb_erase | 0 | 0 | 1 |
| invoked_oom-killer:gfp_mask=0x | 0 | 0 | 29 |
| Mem-Info | 0 | 0 | 29 |
| Out_of_memory:Kill_process | 0 | 0 | 29 |
| backtrace:__mm_populate | 0 | 0 | 24 |
| backtrace:SyS_mlockall | 0 | 0 | 23 |
| backtrace:vm_mmap_pgoff | 0 | 0 | 2 |
| backtrace:SyS_mmap_pgoff | 0 | 0 | 2 |
| backtrace:SyS_mmap | 0 | 0 | 2 |
| backtrace:SyS_brk | 0 | 0 | 1 |
| backtrace:SyS_mlock | 0 | 0 | 2 |
| backtrace:insert | 0 | 0 | 2 |
| RIP:__rb_insert_augmented | 0 | 0 | 2 |
| RIP:rb_erase | 0 | 0 | 1 |
| RIP:__asan_store8 | 0 | 0 | 1 |
+------------------------------------------------------+------------+------------+------------+
[ 0.067580] Running resizable hashtable tests...
[ 0.068019] ODEBUG: object is on stack, but not annotated
[ 0.068499] ------------[ cut here ]------------
[ 0.068917] WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:301 __debug_object_init+0x4a5/0x51c()
[ 0.069833] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-rc2-00323-g97defe1 #1
[ 0.070000] 0000000000000000 ffff880000167b18 ffffffff819a17c8 0000000000000000
[ 0.070000] 0000000000000009 ffff880000167b58 ffffffff8108e5fd ffff880000167b78
[ 0.070000] ffffffff81344308 00000000000e0b40 ffff880000167d20 ffff880000040528
[ 0.070000] Call Trace:
[ 0.070000] [<ffffffff819a17c8>] dump_stack+0x7f/0xa7
[ 0.070000] [<ffffffff8108e5fd>] warn_slowpath_common+0xc6/0xdf
[ 0.070000] [<ffffffff81344308>] ? __debug_object_init+0x4a5/0x51c
[ 0.070000] [<ffffffff8108e6c4>] warn_slowpath_null+0x15/0x17
[ 0.070000] [<ffffffff81344308>] __debug_object_init+0x4a5/0x51c
[ 0.070000] [<ffffffff8132b764>] ? rhashtable_init+0x199/0x263
[ 0.070000] [<ffffffff813443aa>] debug_object_init+0x2b/0x2d
[ 0.070000] [<ffffffff810aec83>] __init_work+0x32/0x34
[ 0.070000] [<ffffffff8132b7a5>] rhashtable_init+0x1da/0x263
[ 0.070000] [<ffffffff82686321>] ? test_rht_lookup+0x127/0x127
[ 0.070000] [<ffffffff826863af>] test_rht_init+0x8e/0x7ba
[ 0.070000] [<ffffffff813299c2>] ? percpu_ida_free_tags+0x40/0x40
[ 0.070000] [<ffffffff81329aec>] ? jhash+0x12a/0x12a
[ 0.070000] [<ffffffff81329b04>] ? rht_grow_above_75+0x18/0x18
[ 0.070000] [<ffffffff813299c2>] ? percpu_ida_free_tags+0x40/0x40
[ 0.070000] [<ffffffff81329aec>] ? jhash+0x12a/0x12a
[ 0.070000] [<ffffffff81329b04>] ? rht_grow_above_75+0x18/0x18
[ 0.070000] [<ffffffff82686321>] ? test_rht_lookup+0x127/0x127
[ 0.070000] [<ffffffff8264b4d6>] do_one_initcall+0x195/0x29d
[ 0.070000] [<ffffffff810b8a74>] ? parse_args+0x45c/0x599
[ 0.070000] [<ffffffff8264b7f2>] kernel_init_freeable+0x214/0x2d4
[ 0.070000] [<ffffffff8199a31a>] ? rest_init+0x15f/0x15f
[ 0.070000] [<ffffffff8199a323>] kernel_init+0x9/0x157
[ 0.070000] [<ffffffff819aea3c>] ret_from_fork+0x7c/0xb0
[ 0.070000] [<ffffffff8199a31a>] ? rest_init+0x15f/0x15f
[ 0.070000] ---[ end trace 46f45e814d896ecc ]---
[ 0.070060] ODEBUG: object is on stack, but not annotated
git bisect start 05016b0f0a9d900e976db7f50a7761c0aefe5a1c v3.19 --
git bisect bad d3f180ea1a44aecba1b0dab2a253428e77f906bf # 08:50 0- 19 Merge tag 'powerpc-3.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux
git bisect good 872912352c5be930e9568e5f3b6d73107d9f278d # 08:55 22+ 0 Merge tag 'pm+acpi-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
git bisect bad a323ae93a74f669d890926187c68c711895e3454 # 09:00 0- 22 Merge tag 'sound-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
git bisect good 870fd0f5df4e131467612cc46db46fc3b69fd706 # 09:04 22+ 0 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
git bisect bad c5ce28df0e7c01a1de23c36ebdefcd803f2b6cbb # 09:09 0- 16 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
git bisect good 1d9c5d79e6e4385aea6f69c23ba543717434ed70 # 09:14 22+ 0 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching
git bisect good 29afc4e9a408f2304e09c6dd0dbcfbd2356d0faa # 09:18 22+ 0 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
git bisect bad fd3e646c87ab3f2ba98aa25394581af27cc78dc5 # 09:27 0- 22 net: act_bpf: fix size mismatch on filter preparation
git bisect bad e84448d52190413400663736067f826f28a04ad6 # 09:32 0- 22 xen-netfront: refactor skb slot counting
git bisect bad 829a3ada9cc7d4c30fa61f8033403fb6c8f8092a # 09:38 0- 1 geneve: Simplify locking.
git bisect good a4c9ea5e8fec680134d22aa99b54d1cd8c226ebd # 09:42 22+ 12 geneve: Add Geneve GRO support
git bisect good 255047b0dca31e6b8ce254481a0b65d559d2ebb8 # 09:46 20+ 0 Bluetooth: Add timing information to SMP test case runs
git bisect good 354f473ee2c5d01c1cf90f747f95218ee3e73e95 # 09:52 22+ 0 ath9k: fix typo
git bisect good d312da293f787e1b19c57acb58e8c1b171c4a04a # 09:59 22+ 0 ixgbe: convert to CYCLECOUNTER_MASK macro.
git bisect good b8e1943e9f754219bcfb40bac4a605b5348acb25 # 10:03 22+ 8 rhashtable: Factor out bucket_tail() function
git bisect bad f89bd6f87a53ce5a7d60662429591ebac2745c10 # 10:08 0- 22 rhashtable: Supports for nulls marker
git bisect good 113948d841e8d78039e5dbbb5248f5b73e99eafa # 10:12 22+ 13 spinlock: Add spin_lock_bh_nested()
git bisect bad 97defe1ecf868b8127f8e62395499d6a06e4c4b1 # 10:16 0- 22 rhashtable: Per bucket locks & deferred expansion/shrinking
# first bad commit: [97defe1ecf868b8127f8e62395499d6a06e4c4b1] rhashtable: Per bucket locks & deferred expansion/shrinking
git bisect good 113948d841e8d78039e5dbbb5248f5b73e99eafa # 10:19 66+ 27 spinlock: Add spin_lock_bh_nested()
# extra tests with DEBUG_INFO
git bisect bad 97defe1ecf868b8127f8e62395499d6a06e4c4b1 # 10:25 0- 66 rhashtable: Per bucket locks & deferred expansion/shrinking
# extra tests on HEAD of linux-devel/devel-spot-201507122014
git bisect good 3afd2c3f65a385c405a084d80431c84b103cb6df # 10:28 66+ 49 0day head guard for 'devel-spot-201507122014'
# extra tests on tree/branch linus/master
git bisect good f760b87f8f12eb262f14603e65042996fe03720e # 10:33 66+ 0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
# extra tests on tree/branch linus/master
git bisect good f760b87f8f12eb262f14603e65042996fe03720e # 10:33 66+ 0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
# extra tests on tree/branch next/master
git bisect good 2eb62d762a2112579f259903e62ba18d16c51f66 # 10:36 66+ 20 Add linux-next specific files for 20150713
This script may reproduce the error.
----------------------------------------------------------------------------
#!/bin/bash
kernel=$1
initrd=yocto-minimal-x86_64.cgz
wget --no-clobber https://github.com/fengguang/reproduce-kernel-bug/raw/master/initrd/$initrd
kvm=(
qemu-system-x86_64
-enable-kvm
-cpu Haswell,+smep,+smap
-kernel $kernel
-initrd $initrd
-m 256
-smp 1
-device e1000,netdev=net0
-netdev user,id=net0
-boot order=nc
-no-reboot
-watchdog i6300esb
-rtc base=localtime
-serial stdio
-display none
-monitor null
)
append=(
hung_task_panic=1
earlyprintk=ttyS0,115200
systemd.log_level=err
debug
apic=debug
sysrq_always_enabled
rcupdate.rcu_cpu_stall_timeout=100
panic=-1
softlockup_panic=1
nmi_watchdog=panic
oops=panic
load_ramdisk=2
prompt_ramdisk=0
console=ttyS0,115200
console=tty0
vga=normal
root=/dev/ram0
rw
drbd.minor_count=8
)
"${kvm[@]}" --append "${append[*]}"
----------------------------------------------------------------------------
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/lkp Intel Corporation
View attachment "dmesg-yocto-ivb41-106:20150714101641:x86_64-randconfig-a0-07122340:3.19.0-rc2-00323-g97defe1:1" of type "text/plain" (44568 bytes)
Powered by blists - more mailing lists