| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20180224075326.jg7pynextbvfitzh@inn>
Date: Sat, 24 Feb 2018 15:53:26 +0800
From: kernel test robot <fengguang.wu@...el.com>
To: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
Cc: LKML <linux-kernel@...r.kernel.org>,
"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>, lkp@...org
Subject: [rcu] df95cc69cc: BUG:KASAN:null-ptr-deref_in__lock_acquire
FYI, we noticed the following commit (built with gcc-7):
commit: df95cc69cca894430640237d39453f5d96c40a7d ("rcu: Parallelize expedited grace-period initialization")
https://git.kernel.org/cgit/linux/kernel/git/paulmck/linux-rcu.git rcu/dev
in testcase: trinity
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -m 512M
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+------------------------------------------------------------------+------------+------------+
| | 3fea14045a | df95cc69cc |
+------------------------------------------------------------------+------------+------------+
| boot_successes | 4 | 0 |
| boot_failures | 4 | 17 |
| invoked_oom-killer:gfp_mask=0x | 4 | |
| Mem-Info | 4 | |
| Kernel_panic-not_syncing:Out_of_memory_and_no_killable_processes | 4 | |
| BUG:KASAN:null-ptr-deref_in__lock_acquire | 0 | 17 |
| BUG:unable_to_handle_kernel | 0 | 17 |
| Oops:#[##] | 0 | 17 |
| RIP:__lock_acquire | 0 | 17 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 17 |
+------------------------------------------------------------------+------------+------------+
[ 0.030859] BUG: KASAN: null-ptr-deref in __lock_acquire+0x171/0x13d0
[ 0.031636] Read of size 8 at addr 0000000000000018 by task swapper/0/0
[ 0.032000]
[ 0.032000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.16.0-rc1-00044-gdf95cc6 #1
[ 0.032000] Call Trace:
[ 0.032000] dump_stack+0x81/0xb3
[ 0.032000] kasan_report+0x22a/0x25a
[ 0.032000] __lock_acquire+0x171/0x13d0
[ 0.032000] ? lookup_chain_cache+0x42/0x6b
[ 0.032000] ? mark_lock+0x25b/0x26d
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? debug_check_no_locks_freed+0x19f/0x19f
[ 0.032000] ? debug_check_no_locks_freed+0x19f/0x19f
[ 0.032000] ? acpi_hw_read+0x1a0/0x202
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? lock_acquire+0x1c0/0x209
[ 0.032000] lock_acquire+0x1c0/0x209
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] _raw_spin_lock_irqsave+0x43/0x56
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] sync_rcu_exp_select_cpus+0x31b/0x44d
[ 0.032000] ? rcu_read_lock_sched_held+0x60/0x66
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] _synchronize_rcu_expedited+0x427/0x5ba
[ 0.032000] ? signal_pending+0x15/0x15
[ 0.032000] ? acpi_hw_write_pm1_control+0x52/0x52
[ 0.032000] ? acpi_hw_write_pm1_control+0x52/0x52
[ 0.032000] ? __change_page_attr_set_clr+0x420/0x420
[ 0.032000] ? printk+0x94/0xb0
[ 0.032000] ? show_regs_print_info+0xa/0xa
[ 0.032000] ? lock_downgrade+0x26a/0x26a
[ 0.032000] ? acpi_read_bit_register+0xb1/0xde
[ 0.032000] ? acpi_read+0xa/0xa
[ 0.032000] ? acpi_read+0xa/0xa
[ 0.032000] ? acpi_hw_get_mode+0x91/0xc2
[ 0.032000] ? _find_next_bit+0x3f/0xe4
[ 0.032000] ? __lock_is_held+0x2a/0x87
[ 0.032000] ? lock_is_held_type+0x78/0x86
[ 0.032000] rcu_test_sync_prims+0xa/0x23
[ 0.032000] rest_init+0xb/0xcf
[ 0.032000] start_kernel+0x59a/0x5be
[ 0.032000] ? mem_encrypt_init+0x6/0x6
[ 0.032000] ? memcpy_orig+0x54/0x110
[ 0.032000] ? x86_family+0x5/0x1d
[ 0.032000] ? load_ucode_bsp+0x3a/0xab
[ 0.032000] secondary_startup_64+0xa5/0xb0
[ 0.032000] ==================================================================
[ 0.032000] Disabling lock debugging due to kernel taint
[ 0.032000] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[ 0.032000] IP: __lock_acquire+0x171/0x13d0
[ 0.032000] PGD 0 P4D 0
[ 0.032000] Oops: 0000 [#1] PREEMPT SMP KASAN PTI
[ 0.032000] Modules linked in:
[ 0.032000] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 4.16.0-rc1-00044-gdf95cc6 #1
[ 0.032000] RIP: 0010:__lock_acquire+0x171/0x13d0
[ 0.032000] RSP: 0000:ffffffff89e079a0 EFLAGS: 00010056
[ 0.032000] RAX: 0000000000000096 RBX: 0000000000000000 RCX: ffffffff884c9e31
[ 0.032000] RDX: 0000000000000003 RSI: 0000000000000003 RDI: 0000000000000001
[ 0.032000] RBP: ffffffff89e07b50 R08: dffffc0000000000 R09: 0000000000000000
[ 0.032000] R10: 0000000000000000 R11: ffffffff8b5f673a R12: 0000000000000018
[ 0.032000] R13: 0000000000000000 R14: ffffffff89e1cc40 R15: 0000000000000001
[ 0.032000] FS: 0000000000000000(0000) GS:ffff880014000000(0000) knlGS:0000000000000000
[ 0.032000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.032000] CR2: 0000000000000018 CR3: 000000001a214000 CR4: 00000000000006b0
[ 0.032000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 0.032000] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 0.032000] Call Trace:
[ 0.032000] ? lookup_chain_cache+0x42/0x6b
[ 0.032000] ? mark_lock+0x25b/0x26d
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? debug_check_no_locks_freed+0x19f/0x19f
[ 0.032000] ? debug_check_no_locks_freed+0x19f/0x19f
[ 0.032000] ? acpi_hw_read+0x1a0/0x202
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? lock_acquire+0x1c0/0x209
[ 0.032000] lock_acquire+0x1c0/0x209
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] _raw_spin_lock_irqsave+0x43/0x56
[ 0.032000] ? rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] rcu_report_exp_cpu_mult+0x21/0x6d
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] sync_rcu_exp_select_cpus+0x31b/0x44d
[ 0.032000] ? rcu_read_lock_sched_held+0x60/0x66
[ 0.032000] ? sync_sched_exp_handler+0x111/0x111
[ 0.032000] _synchronize_rcu_expedited+0x427/0x5ba
[ 0.032000] ? signal_pending+0x15/0x15
[ 0.032000] ? acpi_hw_write_pm1_control+0x52/0x52
[ 0.032000] ? acpi_hw_write_pm1_control+0x52/0x52
[ 0.032000] ? __change_page_attr_set_clr+0x420/0x420
[ 0.032000] ? printk+0x94/0xb0
[ 0.032000] ? show_regs_print_info+0xa/0xa
[ 0.032000] ? lock_downgrade+0x26a/0x26a
[ 0.032000] ? acpi_read_bit_register+0xb1/0xde
[ 0.032000] ? acpi_read+0xa/0xa
[ 0.032000] ? acpi_read+0xa/0xa
[ 0.032000] ? acpi_hw_get_mode+0x91/0xc2
[ 0.032000] ? _find_next_bit+0x3f/0xe4
[ 0.032000] ? __lock_is_held+0x2a/0x87
[ 0.032000] ? lock_is_held_type+0x78/0x86
[ 0.032000] rcu_test_sync_prims+0xa/0x23
[ 0.032000] rest_init+0xb/0xcf
[ 0.032000] start_kernel+0x59a/0x5be
[ 0.032000] ? mem_encrypt_init+0x6/0x6
[ 0.032000] ? memcpy_orig+0x54/0x110
[ 0.032000] ? x86_family+0x5/0x1d
[ 0.032000] ? load_ucode_bsp+0x3a/0xab
[ 0.032000] secondary_startup_64+0xa5/0xb0
[ 0.032000] Code: 89 48 c7 c7 40 8c 65 89 e8 c4 d5 f9 ff 0f ff e9 3e 12 00 00 8b 1d fb df 9b 01 85 db 74 19 4c 89 e7 bb 00 00 00 00 e8 a6 e2 14 00 <49> 81 3c 24 80 3d a6 8a 41 0f 45 df 41 83 fd 01 77 17 45 89 ef
[ 0.032000] RIP: __lock_acquire+0x171/0x13d0 RSP: ffffffff89e079a0
[ 0.032000] CR2: 0000000000000018
[ 0.032000] ---[ end trace bc09c4bd82a58373 ]---
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
lkp
View attachment "config-4.16.0-rc1-00044-gdf95cc6" of type "text/plain" (122379 bytes)
View attachment "job-script" of type "text/plain" (3930 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (5860 bytes)
Powered by blists - more mailing lists