linux-kernel - [net] bc23f68721: kernel_BUG_at_mm/slab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20170629160908.GA100649@inn.lkp.intel.com>
Date:   Fri, 30 Jun 2017 00:09:08 +0800
From:   kernel test robot <xiaolong.ye@...el.com>
To:     David Windsor <dave@...lcore.net>
Cc:     Kees Cook <keescook@...omium.org>,
        LKML <linux-kernel@...r.kernel.org>, lkp@...org
Subject: [net]  bc23f68721: kernel_BUG_at_mm/slab_common.c


FYI, we noticed the following commit:

commit: bc23f687213e9aaca0f81b7063751f1d3791917b ("net: define usercopy region in struct proto slab cache")
https://git.kernel.org/cgit/linux/kernel/git/kees/linux.git kspp/usercopy-whitelist/latest

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu Westmere -m 512M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | 4feb522782 | bc23f68721 |
+------------------------------------------+------------+------------+
| boot_successes                           | 4          | 2          |
| boot_failures                            | 0          | 6          |
| kernel_BUG_at_mm/slab_common.c           | 0          | 6          |
| invalid_opcode:#[##]                     | 0          | 6          |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 6          |
+------------------------------------------+------------+------------+



[   14.931018] kernel BUG at mm/slab_common.c:469!
[   14.943838] invalid opcode: 0000 [#1] SMP
[   14.948874] Modules linked in: sctp(+) dccp_ipv4 dccp
[   14.950762] CPU: 0 PID: 231 Comm: modprobe Not tainted 4.12.0-rc5-00027-gbc23f68 #1
[   14.957836] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
[   14.968452] task: ffff88001f558000 task.stack: ffffc90000338000
[   14.969974] RIP: 0010:kmem_cache_create_usercopy+0x200/0x220
[   14.971427] RSP: 0018:ffffc9000033bc40 EFLAGS: 00010213
[   14.974065] RAX: 0000000000000000 RBX: 0000000000002000 RCX: 0000000000000000
[   14.979281] RDX: ffff88001f558000 RSI: 00000000000000ee RDI: ffffffff81ca30c8
[   14.983863] RBP: ffffc9000033bc78 R08: 0000000000000494 R09: ffffffffffffff58
[   14.987490] R10: ffff88000f4e0600 R11: ffffc9000033bad8 R12: 0000000000000500
[   14.993031] R13: ffffffffa0064438 R14: 0000000000000494 R15: ffffffffffffff58
[   14.997101] FS:  0000000000000000(0000) GS:ffff880011a00000(0063) knlGS:00000000f77cb144
[   15.003469] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   15.009046] CR2: 00000000f7730000 CR3: 000000001f4b8000 CR4: 00000000000006f0
[   15.011146] Call Trace:
[   15.013506]  proto_register+0x4e/0x240
[   15.015890]  sctp_init+0x36b/0x4aa [sctp]
[   15.019611]  ? 0xffffffffa0074000
[   15.025333]  do_one_initcall+0x43/0x170
[   15.026622]  ? __might_sleep+0x4a/0x80
[   15.027951]  ? kmem_cache_alloc_trace+0x163/0x1b0
[   15.030445]  do_init_module+0x5f/0x1f8
[   15.035205]  load_module+0x1562/0x1c30
[   15.038455]  SYSC_init_module+0x16f/0x180
[   15.039994]  ? SYSC_init_module+0x16f/0x180
[   15.041489]  SyS_init_module+0xe/0x10
[   15.045990]  do_fast_syscall_32+0xa9/0x220
[   15.049584]  entry_SYSENTER_compat+0x4c/0x5b
[   15.051017] RIP: 0023:0xf7734dd9
[   15.055844] RSP: 002b:00000000ffd689dc EFLAGS: 00000282 ORIG_RAX: 0000000000000080
[   15.060336] RAX: ffffffffffffffda RBX: 00000000f76b7010 RCX: 0000000000079330
[   15.066726] RDX: 00000000080c1d40 RSI: 00000000080c1c70 RDI: 00000000080c1d50
[   15.072076] RBP: 00000000080c1d50 R08: 0000000000000000 R09: 0000000000000000
[   15.107800] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   15.109993] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   15.120904] Code: 45 d0 e8 c4 0a 7f 00 e8 8f 58 05 00 e8 da 3a 04 00 e8 05 8c eb ff 48 8b 45 d0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b <0f> 0b 48 8b 5d c8 41 bc f4 ff ff ff e9 4c ff ff ff 48 c7 c7 58 
[   15.126352] RIP: kmem_cache_create_usercopy+0x200/0x220 RSP: ffffc9000033bc40
[   15.128600] ---[ end trace 267192163249e4c2 ]---


To reproduce:

        git clone https://github.com/01org/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
Kernel Test Robot

View attachment "config-4.12.0-rc5-00027-gbc23f68" of type "text/plain" (159327 bytes)

View attachment "job-script" of type "text/plain" (3838 bytes)

Download attachment "dmesg.xz" of type "application/octet-stream" (11564 bytes)