linux-kernel - [BUG -next 20181008] list corruption with "mm/slub: remove useless condition in deactivate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Oct 2018 08:35:00 +0200
From:   Heiko Carstens <heiko.carstens@...ibm.com>
To:     Pingfan Liu <kernelfans@...il.com>
Cc:     Christoph Lameter <cl@...ux.com>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-next@...r.kernel.org, linux-mm@...ck.org,
        linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [BUG -next 20181008] list corruption with "mm/slub: remove useless
 condition in deactivate_slab"

Hello,

with linux-next for 20181008 I can reliably crash my system with lot's of
debugging options enabled on s390. List debugging triggers the list
corruption below, which I could bisect down to this commit:

fde06e07750477f049f12d7d471ffa505338a3e7 is the first bad commit
commit fde06e07750477f049f12d7d471ffa505338a3e7
Author: Pingfan Liu <kernelfans@...il.com>
Date:   Thu Oct 4 07:43:01 2018 +1000

    mm/slub: remove useless condition in deactivate_slab

    The var l should be used to reflect the original list, on which the page
    should be.  But c->page is not on any list.  Furthermore, the current code
    does not update the value of l.  Hence remove the related logic

    Link: http://lkml.kernel.org/r/1537941430-16217-1-git-send-email-kernelfans@gmail.com
    Signed-off-by: Pingfan Liu <kernelfans@...il.com>
    Acked-by: Christoph Lameter <cl@...ux.com>
    Cc: Pekka Enberg <penberg@...nel.org>
    Cc: David Rientjes <rientjes@...gle.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@....com>
    Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
    Signed-off-by: Stephen Rothwell <sfr@...b.auug.org.au>

list_add double add: new=000003d1029ecc08, prev=000000008ff846d0,next=000003d1029ecc08.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
illegal operation: 0001 ilc:1 [#1] PREEMPT SMP
Modules linked in:
CPU: 3 PID: 106 Comm: (sd-executor) Not tainted 4.19.0-rc6-00291-gfde06e077504 #21
Hardware name: IBM 2964 NC9 702 (z/VM 6.4.0)
Krnl PSW : (____ptrval____) (____ptrval____) (__list_add_valid+0x98/0xa8)
           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
Krnl GPRS: 0000000074311fdf 0000000080000001 0000000000000058 0000000000e7b8b2
           0000000000000000 0000000075438c64 00000000a7b31928 001c007b00000000
           000000008fe99d00 00000000a7b31b40 000003d1029ecc08 00000000a7c03a80
           000003d1029ecc08 000000008ff84680 00000000007b5674 00000000a7c03960
Krnl Code: 00000000007b5668: c0200034734a        larl    %r2,e43cfc
           00000000007b566e: c0e5ffd0cf51        brasl   %r14,1cf510
          #00000000007b5674: a7f40001            brc     15,7b5676
          >00000000007b5678: a7290001            lghi    %r2,1
           00000000007b567c: ebcff0a00004        lmg     %r12,%r15,160(%r15)
           00000000007b5682: 07fe                bcr     15,%r14
           00000000007b5684: 0707                bcr     0,%r7
           00000000007b5686: 0707                bcr     0,%r7
Call Trace:
([<00000000007b5674>] __list_add_valid+0x94/0xa8)
 [<000000000037d30e>] deactivate_slab.isra.15+0x45e/0x810
 [<000000000037ede4>] ___slab_alloc+0x76c/0x7c0
 [<000000000037eeb0>] __slab_alloc.isra.16+0x78/0xa8
 [<00000000003808c8>] kmem_cache_alloc+0x160/0x458
 [<0000000000141a3a>] vm_area_dup+0x3a/0x60
 [<0000000000142f0a>] copy_process+0xd72/0x2100
 [<000000000014449a>] _do_fork+0xba/0x688
 [<0000000000144bb0>] sys_clone+0x48/0x50
 [<0000000000b8faf0>] system_call+0xd8/0x2d0
INFO: lockdep is turned off.
Last Breaking-Event-Address:
 [<00000000007b5674>] __list_add_valid+0x94/0xa8

Kernel panic - not syncing: Fatal exception: panic_on_oops