linux-kernel - Re: [lkp-robot] [blk] 47e0fb461f: BUG:unable_to_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFy6GJdq=N1uK7KmdV5XRSBjYv1Sdg=NbjOJsZr_+hadYQ@mail.gmail.com>
Date:   Sat, 30 Sep 2017 13:21:13 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     NeilBrown <neilb@...e.com>, Tejun Heo <tj@...nel.org>
Cc:     kernel test robot <xiaolong.ye@...el.com>,
        Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@....de>,
        Ming Lei <ming.lei@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>, LKP <lkp@...org>
Subject: Re: [lkp-robot] [blk] 47e0fb461f: BUG:unable_to_handle_kernel

On Thu, Sep 21, 2017 at 12:02 AM, NeilBrown <neilb@...e.com> wrote:
>
> I think it is crashing in
> static inline bool ata_is_host_link(const struct ata_link *link)
> {
>         return link == &link->ap->link || link == link->ap->slave_link;
> }

Yes. The code is

  1a: 8b 3a                mov    (%edx),%edi
  1c: 8d 8f 40 16 00 00    lea    0x1640(%edi),%ecx
  22: 39 ca                cmp    %ecx,%edx
  24: 74 49                je     0x6f
  26: b9 01 00 00 00        mov    $0x1,%ecx
  2b:* 39 97 80 24 00 00    cmp    %edx,0x2480(%edi) <-- trapping instruction
  31: 74 3c                je     0x6f

and that first "je" is the test for "link == &link->ap->link" (which
only takes the address relative to "link->ap" - thus the "lea"), and
that cmp that oopses is indeed loading that actual slave_link value.

So I agree. "link->ap" is NULL for some odd reason.

Hmm. Absolutely nothing has changed in libata-core.c recently,
certainly not that async_port_probe() thing.

So I suspect either it's just a timing difference, or it's some
unrelated memory corruption.

Xiaolong, I see that you have SLUB_DEBUG and SLUB_DEBUG_ON enabled,
but wonder if you can recreate this with DEBUG_PAGEALLOC and/or
DEBUG_OBJECTS enabled too?

Tejun, any ideas? The original report is at

   https://lkml.org/lkml/2017/9/20/939

in case you don't see it in your inbox from lkml.

                       Linus