| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALCETrVN97hokdU-bpjBeDpbHNVnOkD4zc6t-JjnG4ySLg0zpA@mail.gmail.com>
Date: Sun, 7 Aug 2016 01:58:16 -0700
From: Andy Lutomirski <luto@...capital.net>
To: kernel test robot <xiaolong.ye@...el.com>,
Josh Poimboeuf <jpoimboe@...hat.com>,
Steven Rostedt <rostedt@...dmis.org>
Cc: Andy Lutomirski <luto@...nel.org>,
Nadav Amit <nadav.amit@...il.com>,
Brian Gerst <brgerst@...il.com>,
LKML <linux-kernel@...r.kernel.org>, LKP <lkp@...org>
Subject: Re: [lkp] [x86/mm/64] 4bc0303aff: BUG: stack guard page was hit at ffffc900001bbff8
Hi Steven and Josh-
This test recursively faulted in is_ftrace_trampoline. It's not
immediately obvious to me what went wrong -- is_ftrace_trampoline
doesn't seem to be dereferencing the provided address.
On Fri, Aug 5, 2016 at 7:07 AM, kernel test robot <xiaolong.ye@...el.com> wrote:
>
> FYI, we noticed the following commit:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git x86/vmap_stack
> commit 4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d ("x86/mm/64: Enable vmapped stacks")
>
> in testcase: boot
>
> on test machine: 1 threads qemu-system-x86_64 -enable-kvm -cpu Westmere with 512M memory
>
> caused below changes:
>
>
> +-------------------------------------------------------+------------+------------+
> | | ee12d3b8b1 | 4bc0303aff |
> +-------------------------------------------------------+------------+------------+
> | boot_successes | 388 | 398 |
> | boot_failures | 32 | 39 |
> | WARNING:at_kernel/trace/ftrace.c:#ftrace_bug | 32 | 39 |
> | general_protection_fault:#[##]SMP | 32 | 37 |
> | RIP:is_ftrace_trampoline | 32 | 37 |
> | Kernel_panic-not_syncing:Fatal_exception_in_interrupt | 18 | 8 |
> | backtrace:perf_ftrace_event_register | 32 | 39 |
> | backtrace:perf_trace_init | 32 | 39 |
> | backtrace:perf_tp_event_init | 32 | 39 |
> | backtrace:perf_try_init_event | 32 | 39 |
> | backtrace:SYSC_perf_event_open | 31 | 38 |
> | backtrace:SyS_perf_event_open | 32 | 39 |
> | Kernel_panic-not_syncing:Fatal_exception | 12 | 13 |
> | WARNING:at_include/linux/uaccess.h:#pagefault_enable | 4 | |
> | RIP:#d:[<#>][<#>]is_ftrace_trampoline | 1 | |
> | BUG:kernel_test_hang | 1 | 16 |
> | BUG:unable_to_handle_kernel | 1 | |
> | Oops | 1 | |
> | RIP:task_curr | 1 | |
> | BUG:stack_guard_page_was_hit_at#(stack_is#..#) | 0 | 17 |
> | RIP:fb_get_color_depth | 0 | 3 |
> | RIP:cfb_imageblit | 0 | 8 |
> | RIP:fb_get_buffer_offset | 0 | 4 |
> | RIP:get_attribute | 0 | 1 |
> | RIP:number | 0 | 1 |
> +-------------------------------------------------------+------------+------------+
>
> [ 68.243445] Call Trace:
> [ 68.244310] general protection fault: 0000 [#18] SMP
> [ 68.249171] BUG: stack guard page was hit at ffffc900001bbff8 (stack is ffffc900001bc000..ffffc900001bffff)
> [ 68.249174] kernel stack overflow (double-fault): 0000 [#19] SMP
> [ 68.249175] Modules linked in:
> [ 68.249178] CPU: 0 PID: 6 Comm: kworker/u2:0 Tainted: G W 4.7.0-06443-g4bc0303 #82
> [ 68.249179] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
> [ 68.249185] Workqueue: netns cleanup_net
> [ 68.249187] task: ffff8800314ec180 task.stack: ffffc900001bc000
> [ 68.249192] RIP: 0010:[<ffffffff817f31f0>] [<ffffffff817f31f0>] fb_get_buffer_offset+0x18/0x8c
> [ 68.249193] RSP: 0000:ffffc900001bc000 EFLAGS: 00010002
> [ 68.249194] RAX: 0000000000000001 RBX: ffff88002deab000 RCX: 0000000000000001
> [ 68.249195] RDX: 0000000000000001 RSI: ffff88002deab320 RDI: ffff88002deab000
> [ 68.249197] RBP: ffffc900001bc018 R08: 0000000000000000 R09: 0000000000000048
> [ 68.249198] R10: 0000000000000000 R11: ffffffff83174d50 R12: ffff88002cb68000
> [ 68.249199] R13: 00000000ffffffff R14: 0000000000000010 R15: ffff880031c0d800
> [ 68.249202] FS: 0000000000000000(0000) GS:ffff880033200000(0000) knlGS:0000000000000000
> [ 68.249203] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 68.249204] CR2: ffffc900001bbff8 CR3: 0000000004021000 CR4: 00000000000006f0
> [ 68.249208] DR0: 0000000008c45968 DR1: 0000000000000000 DR2: 0000000000000000
> [ 68.249210] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> [ 68.249210] Stack:
> [ 68.249211]
>
>
> FYI, raw QEMU command line is:
>
> qemu-system-x86_64 -enable-kvm -cpu Westmere -kernel /pkg/linux/x86_64-allyesdebian/gcc-6/4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d/vmlinuz-4.7.0-06443-g4bc0303 -append 'ip=::::vm-kbuild-yocto-ia32-29::dhcp root=/dev/ram0 user=lkp job=/lkp/scheduled/vm-kbuild-yocto-ia32-29/boot-1-yocto-minimal-i386.cgz-4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d-20160801-54711-lk1j2k-228.yaml ARCH=x86_64 kconfig=x86_64-allyesdebian branch=linux-devel/devel-catchup-201607300515 commit=4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d BOOT_IMAGE=/pkg/linux/x86_64-allyesdebian/gcc-6/4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d/vmlinuz-4.7.0-06443-g4bc0303 max_uptime=600 RESULT_ROOT=/result/boot/1/vm-kbuild-yocto-ia32/yocto-minimal-i386.cgz/x86_64-allyesdebian/gcc-6/4bc0303affaa75add8c5c2fbfd6d27d9b644fa0d/227 LKP_SERVER=inn debug apic=debug sysrq_always_enabled rcupdate.rcu_cpu_stall_timeout=100 panic=-1 softlockup_panic=1 nmi_watchdog=panic oops=panic load_ramdisk=2 prompt_ramdisk=0 systemd.log_level=err ignore_loglevel earlyprintk=ttyS0,115200 console=ttyS0,115200 console=tty0 vga=normal rw drbd.minor_count=8' -initrd /fs/sdh1/initrd-vm-kbuild-yocto-ia32-29 -m 832 -smp 1 -device e1000,netdev=net0 -netdev user,id=net0 -boot order=nc -no-reboot -watchdog i6300esb -watchdog-action debug -rtc base=localtime -drive file=/fs/sdh1/disk0-vm-kbuild-yocto-ia32-29,media=disk,if=virtio -pidfile /dev/shm/kboot/pid-vm-kbuild-yocto-ia32-29 -serial file:/dev/shm/kboot/serial-vm-kbuild-yocto-ia32-29 -daemonize -display none -monitor null
>
>
>
>
>
> Thanks,
> Xiaolong
--
Andy Lutomirski
AMA Capital Management, LLC
Download attachment "dmesg.xz" of type "application/x-xz" (41888 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (41888 bytes)
Powered by blists - more mailing lists