linux-kernel - [lkp-robot] [net] 0b7266402f: kernel_BUG_at_mm/slab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20170703024138.GB7070@yexl-desktop>
Date:   Mon, 3 Jul 2017 10:41:38 +0800
From:   kernel test robot <xiaolong.ye@...el.com>
To:     David Windsor <dave@...lcore.net>
Cc:     Kees Cook <keescook@...omium.org>,
        LKML <linux-kernel@...r.kernel.org>, lkp@...org
Subject: [lkp-robot] [net]  0b7266402f: kernel_BUG_at_mm/slab_common.c


FYI, we noticed the following commit:

commit: 0b7266402fc6ebfa0af7488f34dc113696511fdd ("net: define usercopy region in struct proto slab cache")
https://git.kernel.org/cgit/linux/kernel/git/kees/linux.git kspp/usercopy-whitelist/20170619

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -smp 2 -m 420M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | dca6814884 | 0b7266402f |
+------------------------------------------+------------+------------+
| boot_successes                           | 16         | 0          |
| boot_failures                            | 0          | 16         |
| kernel_BUG_at_mm/slab_common.c           | 0          | 16         |
| invalid_opcode:#[##]                     | 0          | 16         |
| EIP:kmem_cache_create_usercopy           | 0          | 16         |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 16         |
+------------------------------------------+------------+------------+



[   10.025445] kernel BUG at mm/slab_common.c:469!
[   10.026006] invalid opcode: 0000 [#1]
[   10.026337] Modules linked in:
[   10.026613] CPU: 0 PID: 1 Comm: swapper Not tainted 4.12.0-rc5-00027-g0b72664 #1
[   10.027265] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
[   10.028150] task: c026e000 task.stack: c0270000
[   10.028549] EIP: kmem_cache_create_usercopy+0x2d8/0x320
[   10.028993] EFLAGS: 00210203 CPU: 0
[   10.029325] EAX: 00000000 EBX: c1db6300 ECX: 00000000 EDX: 00000001
[   10.029851] ESI: 00000498 EDI: 00000000 EBP: c0271ed8 ESP: c0271eb0
[   10.030381]  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
[   10.030834] CR0: 80050033 CR2: 00000000 CR3: 01ee8000 CR4: 000006f0
[   10.031381] Call Trace:
[   10.031598]  ? __mutex_unlock_slowpath+0xb6/0x3b0
[   10.031998]  proto_register+0x55/0x240
[   10.032326]  sctp_init+0x2f2/0x3bd
[   10.032620]  ? sctp_defaults_init+0x2e8/0x2e8
[   10.032992]  do_one_initcall+0x38/0x1a0
[   10.033349]  ? parse_args+0x1ac/0x2f0
[   10.033668]  ? kernel_init_freeable+0xe2/0x17a
[   10.034049]  kernel_init_freeable+0x102/0x17a
[   10.034438]  ? rest_init+0xb0/0xb0
[   10.034738]  kernel_init+0x10/0x100
[   10.035041]  ? schedule_tail_wrapper+0x9/0x10
[   10.035423]  ret_from_fork+0x19/0x30
[   10.035732] Code: ff ff ff 89 45 08 e9 1d ff ff ff 90 8d b4 26 00 00 00 00 c7 04 24 00 00 00 00 31 c9 ba 01 00 00 00 b8 c0 5b de c1 e8 78 a6 f9 ff <0f> 0b 8d b6 00 00 00 00 0f 0b c7 04 24 58 20 c3 c1 e8 1a 7e fd
[   10.037391] EIP: kmem_cache_create_usercopy+0x2d8/0x320 SS:ESP: 0068:c0271eb0
[   10.038029] ---[ end trace 5e68488e73a534a7 ]---


To reproduce:

        git clone https://github.com/01org/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
Xiaolong

View attachment "config-4.12.0-rc5-00027-g0b72664" of type "text/plain" (124733 bytes)

View attachment "job-script" of type "text/plain" (3941 bytes)

Download attachment "dmesg.xz" of type "application/octet-stream" (9912 bytes)