| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 30 Jul 2018 17:03:20 +0800
From: kernel test robot <rong.a.chen@...el.com>
To: yuzhoujian <yuzhoujian@...ichuxing.com>
Cc: Stephen Rothwell <sfr@...b.auug.org.au>,
Michal Hocko <mhocko@...e.com>,
David Rientjes <rientjes@...gle.com>,
"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
Andrea Arcangeli <aarcange@...hat.com>,
Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
Roman Gushchin <guro@...com>,
Yang Shi <yang.s@...baba-inc.com>,
Andrew Morton <akpm@...ux-foundation.org>,
LKML <linux-kernel@...r.kernel.org>, lkp@...org
Subject: [LKP] [mm, oom] c1e4c54f9c: BUG:KASAN:null-ptr-deref_in_d
FYI, we noticed the following commit (built with gcc-5):
commit: c1e4c54f9c750fc3ea4715f5363b92ea4d4efb29 ("mm, oom: reorganize the oom report in dump_header")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -smp 2 -m 512M
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+------------------------------------------------------------------+------------+------------+
| | fd1d082ee4 | c1e4c54f9c |
+------------------------------------------------------------------+------------+------------+
| boot_successes | 0 | 0 |
| boot_failures | 8 | 8 |
| invoked_oom-killer:gfp_mask=0x | 8 | 8 |
| Mem-Info | 8 | |
| Kernel_panic-not_syncing:Out_of_memory_and_no_killable_processes | 8 | |
| BUG:KASAN:null-ptr-deref_in_d | 0 | 8 |
| BUG:unable_to_handle_kernel | 0 | 8 |
| Oops:#[##] | 0 | 8 |
| RIP:dump_header | 0 | 8 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 8 |
+------------------------------------------------------------------+------------+------------+
[ 9.034310] BUG: KASAN: null-ptr-deref in dump_header+0x10c/0x448
[ 9.034310] Read of size 8 at addr 00000000000009b0 by task swapper/0/1
[ 9.034310]
[ 9.034310] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc5-00455-gc1e4c54 #1
[ 9.034310] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 9.034310] Call Trace:
[ 9.034310] dump_stack+0x8d/0xd3
[ 9.034310] kasan_report+0x222/0x252
[ 9.034310] dump_header+0x10c/0x448
[ 9.034310] out_of_memory+0x4c2/0x544
[ 9.034310] ? lock_acquire+0x9e/0xd9
[ 9.034310] ? oom_killer_disable+0x196/0x196
[ 9.034310] __alloc_pages_slowpath+0x9bb/0xaad
[ 9.034310] ? gfp_pfmemalloc_allowed+0xb/0xb
[ 9.034310] ? ___might_sleep+0xfa/0x29f
[ 9.034310] __alloc_pages_nodemask+0x1e3/0x211
[ 9.034310] ? __alloc_pages_slowpath+0xaad/0xaad
[ 9.034310] ? debug_show_all_locks+0x1b0/0x1b0
[ 9.034310] ? mark_held_locks+0x28/0x86
[ 9.034310] new_slab+0xf6/0x317
[ 9.034310] ? vfs_statx+0xab/0x111
[ 9.034310] ___slab_alloc+0x2ce/0x3c5
[ 9.034310] ? maybe_link+0x110/0x1b0
[ 9.034310] ? lock_release+0x1ee/0x2c4
[ 9.034310] ? lock_is_held_type+0x7e/0x8a
[ 9.034310] ? maybe_link+0x110/0x1b0
[ 9.034310] ? __slab_alloc+0x4b/0x7e
[ 9.034310] __slab_alloc+0x4b/0x7e
[ 9.034310] ? maybe_link+0x110/0x1b0
[ 9.034310] kmem_cache_alloc+0x59/0xf6
[ 9.034310] maybe_link+0x110/0x1b0
[ 9.034310] ? write_buffer+0x3e/0x3e
[ 9.034310] do_name+0xae/0x32b
[ 9.034310] write_buffer+0x2d/0x3e
[ 9.034310] flush_buffer+0x2e/0x96
[ 9.034310] ? md_run_setup+0x85/0x85
[ 9.034310] __gunzip+0x399/0x470
[ 9.034310] ? bunzip2+0x560/0x560
[ 9.034310] ? __gunzip+0x470/0x470
[ 9.034310] gunzip+0xe/0x11
[ 9.034310] ? md_run_setup+0x85/0x85
[ 9.034310] unpack_to_rootfs+0x1fe/0x393
[ 9.034310] ? md_run_setup+0x85/0x85
[ 9.034310] ? do_symlink+0xaf/0xaf
[ 9.034310] ? populate_rootfs+0x10/0x1b2
[ 9.034310] ? populate_rootfs+0x4b/0x1b2
[ 9.034310] ? parse_header+0x1c9/0x1c9
[ 9.034310] populate_rootfs+0x96/0x1b2
[ 9.034310] ? parse_header+0x1c9/0x1c9
[ 9.034310] do_one_initcall+0xc4/0x1ce
[ 9.034310] ? initcall_blacklisted+0x12f/0x12f
[ 9.034310] ? lock_downgrade+0x298/0x298
[ 9.034310] kernel_init_freeable+0x282/0x317
[ 9.034310] ? rest_init+0xc6/0xc6
[ 9.034310] kernel_init+0x7/0xfe
[ 9.034310] ? rest_init+0xc6/0xc6
[ 9.034310] ret_from_fork+0x24/0x30
[ 9.034310] ==================================================================
[ 9.034310] Disabling lock debugging due to kernel taint
[ 9.086644] BUG: unable to handle kernel NULL pointer dereference at 00000000000009b0
[ 9.087338] PGD 0 P4D 0
[ 9.087338] Oops: 0000 [#1] PREEMPT SMP KASAN PTI
[ 9.087338] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 4.18.0-rc5-00455-gc1e4c54 #1
[ 9.087338] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 9.087338] RIP: 0010:dump_header+0x10c/0x448
[ 9.087338] Code: 85 ed 0f 95 c2 4c 89 e9 48 c7 c7 60 67 09 82 e8 32 cf f7 ff e8 03 f5 fc ff e8 ea e8 ff ff 48 8d bd b0 09 00 00 e8 90 ff 04 00 <4c> 8b ad b0 09 00 00 e8 1d ae f8 ff 85 c0 74 31 80 3d 58 36 d4 01
[ 9.087338] RSP: 0000:ffff88000ad0f740 EFLAGS: 00010256
[ 9.087338] RAX: 0000000000000296 RBX: ffff88000ad0f950 RCX: ffffffff810d5bf5
[ 9.087338] RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffffff840d9480
[ 9.087338] RBP: 0000000000000000 R08: dffffc0000000000 R09: 0000000000000001
[ 9.087338] R10: fffffbfff055ee28 R11: fffffbfff055ee29 R12: ffff88000ad0f958
[ 9.087338] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 9.087338] FS: 0000000000000000(0000) GS:ffff88000b000000(0000) knlGS:0000000000000000
[ 9.087338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.087338] CR2: 00000000000009b0 CR3: 000000000285c000 CR4: 00000000000006b0
[ 9.087338] Call Trace:
[ 9.087338] out_of_memory+0x4c2/0x544
[ 9.087338] ? lock_acquire+0x9e/0xd9
[ 9.087338] ? oom_killer_disable+0x196/0x196
[ 9.087338] __alloc_pages_slowpath+0x9bb/0xaad
[ 9.087338] ? gfp_pfmemalloc_allowed+0xb/0xb
[ 9.087338] ? ___might_sleep+0xfa/0x29f
[ 9.087338] __alloc_pages_nodemask+0x1e3/0x211
[ 9.087338] ? __alloc_pages_slowpath+0xaad/0xaad
[ 9.087338] ? debug_show_all_locks+0x1b0/0x1b0
[ 9.087338] ? mark_held_locks+0x28/0x86
[ 9.087338] new_slab+0xf6/0x317
[ 9.087338] ? vfs_statx+0xab/0x111
[ 9.087338] ___slab_alloc+0x2ce/0x3c5
[ 9.087338] ? maybe_link+0x110/0x1b0
[ 9.087338] ? lock_release+0x1ee/0x2c4
[ 9.087338] ? lock_is_held_type+0x7e/0x8a
[ 9.087338] ? maybe_link+0x110/0x1b0
[ 9.087338] ? __slab_alloc+0x4b/0x7e
[ 9.087338] __slab_alloc+0x4b/0x7e
[ 9.087338] ? maybe_link+0x110/0x1b0
[ 9.087338] kmem_cache_alloc+0x59/0xf6
[ 9.087338] maybe_link+0x110/0x1b0
[ 9.087338] ? write_buffer+0x3e/0x3e
[ 9.087338] do_name+0xae/0x32b
[ 9.087338] write_buffer+0x2d/0x3e
[ 9.087338] flush_buffer+0x2e/0x96
[ 9.087338] ? md_run_setup+0x85/0x85
[ 9.087338] __gunzip+0x399/0x470
[ 9.087338] ? bunzip2+0x560/0x560
[ 9.087338] ? __gunzip+0x470/0x470
[ 9.087338] gunzip+0xe/0x11
[ 9.087338] ? md_run_setup+0x85/0x85
[ 9.087338] unpack_to_rootfs+0x1fe/0x393
[ 9.087338] ? md_run_setup+0x85/0x85
[ 9.087338] ? do_symlink+0xaf/0xaf
[ 9.087338] ? populate_rootfs+0x10/0x1b2
[ 9.087338] ? populate_rootfs+0x4b/0x1b2
[ 9.087338] ? parse_header+0x1c9/0x1c9
[ 9.087338] populate_rootfs+0x96/0x1b2
[ 9.087338] ? parse_header+0x1c9/0x1c9
[ 9.087338] do_one_initcall+0xc4/0x1ce
[ 9.087338] ? initcall_blacklisted+0x12f/0x12f
[ 9.087338] ? lock_downgrade+0x298/0x298
[ 9.087338] kernel_init_freeable+0x282/0x317
[ 9.087338] ? rest_init+0xc6/0xc6
[ 9.087338] kernel_init+0x7/0xfe
[ 9.087338] ? rest_init+0xc6/0xc6
[ 9.087338] ret_from_fork+0x24/0x30
[ 9.087338] Modules linked in:
[ 9.087338] CR2: 00000000000009b0
[ 9.087338] ---[ end trace 17f361a4b4e30da1 ]---
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
Rong, Chen
View attachment "config-4.18.0-rc5-00455-gc1e4c54" of type "text/plain" (120705 bytes)
View attachment "job-script" of type "text/plain" (4010 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (8976 bytes)
Powered by blists - more mailing lists