linux-kernel - perf: fuzzer crashes immediately on AMD system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1608181025160.19862@macbook-air>
Date:	Thu, 18 Aug 2016 10:32:48 -0400 (EDT)
From:	Vince Weaver <vincent.weaver@...ne.edu>
To:	linux-kernel@...r.kernel.org
cc:	Borislav Petkov <bp@...e.de>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>,
	Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: perf: fuzzer crashes immediately on AMD system


Tried the perf_fuzzer on my A10 fam15h/model13h system with 4.8-rc2 and it
falls over more or less immediately.

This maps to variable_test_bit()
	called by ctx = find_get_context(pmu, task, event);
		in kernel/events/core.c:9467

It happens quickly enough I can probably track down the exact event that 
causes this, if needed.

[  101.970659] BUG: unable to handle kernel paging request at ffffffff8653d8a0
[  101.977676] IP: [<ffffffff810e4cb1>] find_get_context.isra.75+0x28/0x20f
[  101.984405] PGD 2807067 PUD 2808063 PMD 0 
[  101.988563] Oops: 0000 [#1] SMP
[  102.069521] CPU: 0 PID: 2205 Comm: perf_fuzzer Not tainted 4.8.0-rc2+ #27
[  102.076313] Hardware name: Hewlett-Packard HP Compaq Pro 6305 SFF/1850, BIOS K06 v02.57 08/16/2013
[  102.085268] task: ffff880223ae5000 task.stack: ffff880224ea8000
[  102.091188] RIP: 0010:[<ffffffff810e4cb1>]  [<ffffffff810e4cb1>] find_get_context.isra.75+0x28/0x20f
[  102.100339] RSP: 0018:ffff880224eabe20  EFLAGS: 00010246
[  102.105657] RAX: 000000002633e300 RBX: 0000000000000000 RCX: 000000002633e300
[  102.112795] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8180ea00
[  102.119929] RBP: ffffffff8180ea00 R08: 0000000000000004 R09: 0000000000000000
[  102.127063] R10: 0000000000000003 R11: 0000000000000246 R12: 000000002633e300
[  102.134196] R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff8180ea00
[  102.141327] FS:  00007f743b391700(0000) GS:ffff88022ec00000(0000) knlGS:0000000000000000
[  102.149416] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  102.155167] CR2: ffffffff8653d8a0 CR3: 00000002255b9000 CR4: 00000000000407f0
[  102.162309] Stack:
[  102.164323]  0000000000000000 00000000ffffffff ffff880223b9d800 ffff880224fdd000
[  102.171804]  ffff880223b9d800 0000000000000000 0000000000000000 0000000000000000
[  102.179284]  ffffffff8180ea00 ffffffff810e72be ffffffff00000002 ffff88022e0006c0
[  102.186765] Call Trace:
[  102.189216]  [<ffffffff810e72be>] ? SYSC_perf_event_open+0x525/0xa34
[  102.195579]  [<ffffffff8145251f>] ? entry_SYSCALL_64_fastpath+0x17/0x93
[  102.202203] Code: 41 5c c3 41 57 41 56 41 55 41 54 55 53 48 89 fd 48 89 f3 48 83 ec 18 48 85 f6 75 6c 83 3d 2f 2a 7f 00 00 41 89 cc 7f 1e 44 89 e0 <48> 0f a3 05 87 0f 7f 00 0f 92 c0 84 c0 75 26 48 c7 c0 ed ff ff 
[  102.222256] RIP  [<ffffffff810e4cb1>] find_get_context.isra.75+0x28/0x20f
[  102.229065]  RSP <ffff880224eabe20>
[  102.232556] CR2: ffffffff8653d8a0
[  102.235879] ---[ end trace fa649074c022bab1 ]---