| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20160816013820.GD16965@shlinux2>
Date: Tue, 16 Aug 2016 09:38:20 +0800
From: Peter Chen <hzpeterchen@...il.com>
To: Ye Xiaolong <xiaolong.ye@...el.com>
Cc: Peter Chen <peter.chen@....com>,
Felipe Balbi <felipe.balbi@...ux.intel.com>,
LKML <linux-kernel@...r.kernel.org>,
"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
"linux-omap@...r.kernel.org" <linux-omap@...r.kernel.org>,
"lkp@...org" <lkp@...org>
Subject: Re: [lkp] [usb] ad05399d68: BUG: unable to handle kernel NULL
pointer dereference at 0000000000000012
On Mon, Aug 15, 2016 at 10:49:55PM +0800, Ye Xiaolong wrote:
> On 08/15, Peter Chen wrote:
> >
> >>
> >>
> >>FYI, we noticed the following commit:
> >>
> >>https://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb.git testing/next commit
> >>ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104 ("usb: udc: core: fix error handling")
> >>
> >
> >Hi Xiaolong,
> >
> >You reported it one month ago, and said it is a false report. see below.
> >Would you please double confirm it?
>
> Hi, peter
>
> Last time I reported stat "WARNING: CPU: 0 PID: 1 at
> lib/list_debug.c:36" and it showed both in this commit and its parent,
> this time, the observed change stat is "BUG: unable to handle kernel NULL
> pointer dereference at 0000000000000012" and it doesn't show in parent
> commit, however, the parent commit's dmesg would show kernel panic log
> as:
>
> [ 10.338487] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> [ 10.338487]
> [ 10.339911] CPU: 0 PID: 1 Comm: init Not tainted 4.8.0-rc1-00020-g0937a4d #1
> [ 10.341177] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
> [ 10.342798] 0000000000000000 ffff88001e53bc28 ffffffff8168cf8a ffff88001e534000
> [ 10.345177] ffffffff8256ef20 ffff88001e53bcb8 ffff88001e50ca50 ffff88001e53bca8
> [ 10.346739] ffffffff8114e062 ffff880000000010 ffff88001e53bcb8 ffff88001e53bc50
> [ 10.347970] Call Trace:
> [ 10.348690] [<ffffffff8168cf8a>] dump_stack+0x83/0xb9
> [ 10.351592] [<ffffffff8114e062>] panic+0xf3/0x2a9
> [ 10.352386] [<ffffffff81090e01>] do_exit+0x601/0xde0
> [ 10.352879] [<ffffffff8109a283>] ? __sigqueue_free+0x43/0x50
> [ 10.353511] [<ffffffff8109a5f7>] ? __dequeue_signal+0x1f7/0x210
> [ 10.354483] [<ffffffff810916e2>] do_group_exit+0xa2/0x100
> [ 10.355324] [<ffffffff8109e06e>] get_signal+0x68e/0x740
> [ 10.356155] [<ffffffff81009233>] do_signal+0x23/0x670
> [ 10.356983] [<ffffffff810e0000>] ? do_syslog+0x2c0/0x6a0
> [ 10.357832] [<ffffffff810305e3>] ? bad_area_nosemaphore+0x33/0x40
> [ 10.358825] [<ffffffff81030cf7>] ? __do_page_fault+0x407/0x4d0
> [ 10.359738] [<ffffffff810020c9>] exit_to_usermode_loop+0x69/0xc0
> [ 10.360680] [<ffffffff8100241d>] prepare_exit_to_usermode+0x3d/0x70
> [ 10.361725] [<ffffffff82025a27>] retint_user+0x8/0x10
> [ 10.362650] Kernel Offset: disabled
>
> The whole parent dmesg is attached.
>
Then, what's the conclusion? Is this one is detect one or not?
Peter
> Thanks,
> Xiaolong
>
> >
> >On Wed, Jul 13, 2016 at 01:55:26AM +0000, Peter Chen wrote:
> >>
> >>
> >>>-----Original Message-----
> >>>From: lkp-request@...ists.intel.com
> >>>[mailto:lkp-request@...ists.intel.com] On Behalf Of kernel test robot
> >>>Sent: Wednesday, July 13, 2016 9:28 AM
> >>>To: Peter Chen <peter.chen@....com>
> >>>Cc: 0day robot <fengguang.wu@...el.com>; LKML
> >>><linux-kernel@...r.kernel.org>; lkp@...org
> >>>Subject: [lkp] [usb] 9696ef14de: WARNING: CPU: 0 PID: 1 at
> >>>lib/list_debug.c:36
> >>>__list_add+0x104/0x188
> >>>
> >>>
> >>>FYI, we noticed the following commit:
> >>>
> >>>https://github.com/0day-ci/linux Peter-Chen/usb-udc-core-fix-error-
> >>>handling/20160711-100832
> >>>commit 9696ef14ded07fb0847f8e1cdda6d98a89ecd4f2 ("usb: udc: core: fix
> >>>error
> >>>handling")
> >>>
> >>
> >>Thanks, but I really can't find the relationship between my patch and dump.
> >>Can you reproduce it after running again or without my patch?
> >>
> >
> >Sorry, it's a false report, the error dump also showed in parent commit, please ignore the report and sorry for the noise.
> >
> >Thanks,
> >Xiaolong
> >
> >
> >
> >
> >Peter
> >
> >>in testcase: boot
> >>
> >>on test machine: 1 threads qemu-system-x86_64 -enable-kvm -cpu SandyBridge
> >>with 512M memory
> >>
> >>caused below changes:
> >>
> >>
> >>+-----------------------------------------------------------+------------+------------+
> >>| | 0937a4d787
> >>| | ad05399d68 |
> >>+-----------------------------------------------------------+------------+------------+
> >>| boot_successes | 0 | 0 |
> >>| boot_failures | 12 | 12 |
> >>| WARNING:at_lib/list_debug.c:#__list_del_entry | 2 | 12 |
> >>| BUG:kernel_test_hang | 2 | |
> >>| backtrace:kernel_restart | 2 | |
> >>| backtrace:SyS_reboot | 2 | |
> >>| BUG:kernel_oversize_in_test_stage | 4 | |
> >>| Kernel_panic-not_syncing:Attempted_to_kill_init!exitcode= | 6 | |
> >>| BUG:unable_to_handle_kernel | 0 | 11 |
> >>| Oops | 0 | 11 |
> >>| RIP:sysfs_kf_write | 0 | 11 |
> >>| Kernel_panic-not_syncing:Fatal_exception | 0 | 11 |
> >>| backtrace:serio_handle_event | 0 | 12 |
> >>| backtrace:vfs_write | 0 | 11 |
> >>| backtrace:SyS_write | 0 | 11 |
> >>+-----------------------------------------------------------+------------+------------+
> >>
> >>
> >>[ 12.161205] BUG: unable to handle kernel NULL pointer dereference at
> >>0000000000000012
> >>[ 12.162485] IP: [<ffffffff81245ecf>] sysfs_kf_write+0x4f/0x70
> >>[ 12.163414] PGD 1a380067 PUD 1a357067 PMD 0
> >>[ 12.164242] Oops: 0000 [#1] PREEMPT SMP
> >>[ 12.164952] CPU: 0 PID: 240 Comm: udevadm Tainted: G W 4.8.0-rc1-
> >>00021-gad05399 #1
> >>[ 12.166477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> >>Debian-1.8.2-1 04/01/2014
> >>[ 12.167885] task: ffff88001a3701c0 task.stack: ffff88001a374000
> >>[ 12.168789] RIP: 0010:[<ffffffff81245ecf>] [<ffffffff81245ecf>]
> >>sysfs_kf_write+0x4f/0x70
> >>[ 12.170082] RSP: 0018:ffff88001a377dc0 EFLAGS: 00010297
> >>[ 12.171001] RAX: ffff88001aad9260 RBX: 0000000000000000 RCX:
> >>0000000000000003
> >>[ 12.172252] RDX: ffff88001a253020 RSI: ffffffff82888fa0 RDI: ffff88001aada1f8
> >>[ 12.186536] RBP: ffff88001a377de8 R08: 0000000000000000 R09:
> >>0000000000000000
> >>[ 12.187769] R10: 0000000055aab65f R11: 0000000000000001 R12:
> >>0000000000000003
> >>[ 12.189058] R13: ffff88001a393000 R14: 000000000000000a R15:
> >>ffff88001a253020
> >>[ 12.190274] FS: 00007f1f13d8f700(0000) GS:ffff88001f400000(0000)
> >>knlGS:0000000000000000
> >>[ 12.191514] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>[ 12.192393] CR2: 0000000000000012 CR3: 000000001a341000 CR4:
> >>00000000000406b0
> >>[ 12.193518] Stack:
> >>[ 12.193884] ffff88001a253020 ffff88001a393000 0000000000000003
> >>ffffffff81245e80
> >>[ 12.195278] ffff88001a393018 ffff88001a377e28 ffffffff81244e44
> >>ffff88001a377f20
> >>[ 12.196679] ffff88001dc6fc40 ffffffff81244cf0 ffff88001a377f20
> >>0000000000000003
> >>[ 12.197896] Call Trace:
> >>[ 12.198289] [<ffffffff81245e80>] ? sysfs_file_ops+0x90/0x90
> >>[ 12.199162] [<ffffffff81244e44>] kernfs_fop_write+0x154/0x200
> >>[ 12.211238] [<ffffffff81244cf0>] ? kernfs_vma_page_mkwrite+0xb0/0xb0
> >>[ 12.212330] [<ffffffff811ae953>] __vfs_write+0x43/0x1b0
> >>[ 12.213150] [<ffffffff811b369a>] ? __sb_start_write+0xba/0x110
> >>[ 12.214175] [<ffffffff810d4612>] ? percpu_down_read+0x52/0x90
> >>[ 12.215219] [<ffffffff811b369a>] ? __sb_start_write+0xba/0x110
> >>[ 12.216256] [<ffffffff811aecd6>] vfs_write+0x106/0x1f0
> >>[ 12.217146] [<ffffffff811aeed3>] SyS_write+0x53/0xc0
> >>[ 12.217930] [<ffffffff820250b6>] entry_SYSCALL_64_fastpath+0x1e/0xad
> >>[ 12.218907] Code: ff ff 4d 85 e4 74 2d 49 89 c6 e8 0d 25 ee ff 49 8b 45 00 4c 89
> >>e1 4c 89 fa 48 8b b0 80 00 00 00 48 8b 40 28 48 8b b8 80 00 00 00 <41> ff 56 08 48
> >>89 c3 eb 00 e8 e3 24 ee ff 48 89 d8 5b 41 5c 41
> >>[ 12.223712] RIP [<ffffffff81245ecf>] sysfs_kf_write+0x4f/0x70
> >>[ 12.224633] RSP <ffff88001a377dc0>
> >>[ 12.225172] CR2: 0000000000000012
> >>[ 12.366338] ---[ end trace b696b5aff8dfca8d ]---
> >>[ 12.367092] Kernel panic - not syncing: Fatal exception
> >>[ 12.367920] Kernel Offset: disabled
> >>
> >>
> >>FYI, raw QEMU command line is:
> >>
> >> qemu-system-x86_64 -enable-kvm -cpu SandyBridge -kernel
> >>/pkg/linux/x86_64-randconfig-n0-08110915/gcc-
> >>6/ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104/vmlinuz-4.8.0-rc1-00021-
> >>gad05399 -append 'ip=::::vm-kbuild-yocto-x86_64-3::dhcp root=/dev/ram0 user=lkp
> >>job=/lkp/scheduled/vm-kbuild-yocto-x86_64-3/boot-1-yocto-minimal-x86_64.cgz-
> >>ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104-20160812-122343-ax2dev-0.yaml
> >>ARCH=x86_64 kconfig=x86_64-randconfig-n0-08110915 branch=linux-devel/devel-
> >>hourly-2016081104 commit=ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104
> >>BOOT_IMAGE=/pkg/linux/x86_64-randconfig-n0-08110915/gcc-
> >>6/ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104/vmlinuz-4.8.0-rc1-00021-
> >>gad05399 max_uptime=600 RESULT_ROOT=/result/boot/1/vm-kbuild-yocto-
> >>x86_64/yocto-minimal-x86_64.cgz/x86_64-randconfig-n0-08110915/gcc-
> >>6/ad05399d68b6ae1649cdcfc82ce3ffea1a7c5104/0 LKP_SERVER=inn debug
> >>apic=debug sysrq_always_enabled rcupdate.rcu_cpu_stall_timeout=100 panic=-1
> >>softlockup_panic=1 nmi_watchdog=panic oops=panic load_ramdisk=2
> >>prompt_ramdisk=0 systemd.log_level=err ignore_loglevel earlyprintk=ttyS0,115200
> >>console=ttyS0,115200 console=tty0 vga=normal rw drbd.minor_count=8' -initrd
> >>/fs/sdg1/initrd-vm-kbuild-yocto-x86_64-3 -m 512 -smp 1 -device e1000,netdev=net0
> >>-netdev user,id=net0 -boot order=nc -no-reboot -watchdog i6300esb -watchdog-
> >>action debug -rtc base=localtime -drive file=/fs/sdg1/disk0-vm-kbuild-yocto-x86_64-
> >>3,media=disk,if=virtio -pidfile /dev/shm/kboot/pid-vm-kbuild-yocto-x86_64-3 -serial
> >>file:/dev/shm/kboot/serial-vm-kbuild-yocto-x86_64-3 -daemonize -display none -
> >>monitor null
> >>
> >>
> >>
> >>
> >>
> >>Thanks,
> >>Xiaolong
--
Best Regards,
Peter Chen
Powered by blists - more mailing lists