| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20181130085236.fxqwm3lktturfeoo@inn2.lkp.intel.com>
Date: Fri, 30 Nov 2018 16:52:36 +0800
From: kernel test robot <lkp@...el.com>
To: David Howells <dhowells@...hat.com>
Cc: Al Viro <viro@...iv.linux.org.uk>,
LKML <linux-kernel@...r.kernel.org>,
linux-fsdevel@...r.kernel.org, lkp@...org
Subject: [NFS] 227a5ea5cc: BUG:KASAN:null-ptr-deref_in_s
FYI, we noticed the following commit (built with gcc-7):
commit: 227a5ea5ccad1d2fed224de487b5062902e768af ("NFS: Add fs_context support.")
https://git.kernel.org/cgit/linux/kernel/git/viro/vfs.git Q18
in testcase: trinity
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu IvyBridge -smp 2 -m 2G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+------------------------------------------------+------------+------------+
| | b51dcaefdc | 227a5ea5cc |
+------------------------------------------------+------------+------------+
| boot_successes | 4 | 0 |
| boot_failures | 2 | 4 |
| IP-Config:Auto-configuration_of_network_failed | 2 | |
| BUG:KASAN:null-ptr-deref_in_s | 0 | 4 |
| BUG:unable_to_handle_kernel | 0 | 4 |
| Oops:#[##] | 0 | 4 |
| RIP:security_sb_set_mnt_opts | 0 | 4 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 4 |
+------------------------------------------------+------------+------------+
[ 66.318452] BUG: KASAN: null-ptr-deref in security_sb_set_mnt_opts+0x2a/0xeb
[ 66.319619] Read of size 4 at addr 0000000000000010 by task mount.nfs/476
[ 66.320733]
[ 66.321096] CPU: 0 PID: 476 Comm: mount.nfs Not tainted 4.20.0-rc1-00059-g227a5ea #1
[ 66.322433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 66.323855] Call Trace:
[ 66.324388] dump_stack+0x2f/0x3e
[ 66.325027] kasan_report+0x311/0x393
[ 66.325699] __asan_load4+0x2d/0xe2
[ 66.326355] security_sb_set_mnt_opts+0x2a/0xeb
[ 66.327158] nfs_set_sb_security+0xdc/0x197
[ 66.327916] ? nfs_reconfigure+0x549/0x549
[ 66.328649] nfs_get_tree_common+0x738/0x7c1
[ 66.329440] nfs_try_get_tree+0x45e/0x4ae
[ 66.330179] ? nfs_get_tree_common+0x7c1/0x7c1
[ 66.330977] ? nfs_fs_context_validate+0x598/0x7d6
[ 66.331811] ? generic_parse_monolithic+0x17c/0x1b6
[ 66.332675] ? ___might_sleep+0xa0/0x2ab
[ 66.333403] ? kasan_check_read+0x1b/0x23
[ 66.344026] ? preempt_count_add+0x114/0x127
[ 66.344852] ? preempt_count_sub+0x1f/0x15f
[ 66.345605] ? find_nfs_version+0x139/0x143
[ 66.346367] nfs_get_tree+0x258/0x2a8
[ 66.347060] ? vfs_get_tree+0x133/0x3a4
[ 66.347791] vfs_get_tree+0x139/0x3a4
[ 66.348470] do_mount+0x10b8/0x1220
[ 66.349143] ? copy_mount_string+0x4d/0x4d
[ 66.349889] ? kmem_cache_alloc_trace+0x239/0x24f
[ 66.350723] ? copy_mount_options+0x42/0x2d3
[ 66.351484] ? copy_mount_options+0x2c4/0x2d3
[ 66.352241] ksys_mount+0xce/0x11e
[ 66.352890] __x64_sys_mount+0x72/0x83
[ 66.353612] do_syscall_64+0xa8/0x1eb
[ 66.354283] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 66.355182] RIP: 0033:0x7f9a1e19a24a
[ 66.355867] Code: 48 8b 0d 51 fc 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e fc 2a 00 f7 d8 64 89 01 48
[ 66.358838] RSP: 002b:00007fffdd4e9928 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
[ 66.360112] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9a1e19a24a
[ 66.361321] RDX: 00005582b0a54f70 RSI: 00005582b0a54f50 RDI: 00005582b0a53210
[ 66.362507] RBP: 00007fffdd4e9b20 R08: 00005582b0a60320 R09: 0000000000000060
[ 66.363654] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9a1eade410
[ 66.364845] R13: 00007fffdd4e9b20 R14: 00007fffdd4e9a20 R15: 00005582b0a60300
[ 66.366043] ==================================================================
[ 66.367300] Disabling lock debugging due to kernel taint
[ 66.512352] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 66.513807] PGD 0 P4D 0
[ 66.514322] Oops: 0000 [#1] PREEMPT KASAN PTI
[ 66.515181] CPU: 0 PID: 476 Comm: mount.nfs Tainted: G B 4.20.0-rc1-00059-g227a5ea #1
[ 66.516770] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 66.518260] RIP: 0010:security_sb_set_mnt_opts+0x2a/0xeb
[ 66.519206] Code: 0f 1f 44 00 00 41 57 41 56 49 89 cf 41 55 41 54 49 89 f4 55 53 49 89 fd 49 89 d6 e8 6e b4 4e ff 49 8d 7c 24 10 e8 c4 bc 67 ff <41> 8b 6c 24 10 85 ed 75 0e e8 56 b4 4e ff 48 ff 05 7e a5 ca 05 eb
[ 66.522264] RSP: 0000:ffff88005318fa98 EFLAGS: 00010202
[ 66.523204] RAX: 0000000000000000 RBX: 1ffff1000a631f5a RCX: ffffffff811943ee
[ 66.524369] RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffffffff8757b800
[ 66.525587] RBP: ffff880051c82ee8 R08: fffffbfff094d03d R09: fffffbfff070c539
[ 66.526786] R10: fffffbfff0d3ba43 R11: fffffbfff094d03c R12: 0000000000000000
[ 66.527975] R13: ffff880051c82ee8 R14: 0000000000000000 R15: ffff88005318faf0
[ 66.529209] FS: 00007f9a1eade480(0000) GS:ffffffff848f2000(0000) knlGS:0000000000000000
[ 66.530619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 66.531620] CR2: 0000000000000010 CR3: 00000000533b2000 CR4: 00000000001406b0
[ 66.532814] Call Trace:
[ 66.533353] nfs_set_sb_security+0xdc/0x197
[ 66.534105] ? nfs_reconfigure+0x549/0x549
[ 66.534852] nfs_get_tree_common+0x738/0x7c1
[ 66.535657] nfs_try_get_tree+0x45e/0x4ae
[ 66.536397] ? nfs_get_tree_common+0x7c1/0x7c1
[ 66.537170] ? nfs_fs_context_validate+0x598/0x7d6
[ 66.538008] ? generic_parse_monolithic+0x17c/0x1b6
[ 66.538868] ? ___might_sleep+0xa0/0x2ab
[ 66.539578] ? kasan_check_read+0x1b/0x23
[ 66.540381] ? preempt_count_add+0x114/0x127
[ 66.541144] ? preempt_count_sub+0x1f/0x15f
[ 66.541907] ? find_nfs_version+0x139/0x143
[ 66.542687] nfs_get_tree+0x258/0x2a8
[ 66.543363] ? vfs_get_tree+0x133/0x3a4
[ 66.544065] vfs_get_tree+0x139/0x3a4
[ 66.544753] do_mount+0x10b8/0x1220
[ 66.545414] ? copy_mount_string+0x4d/0x4d
[ 66.546180] ? kmem_cache_alloc_trace+0x239/0x24f
[ 66.547037] ? copy_mount_options+0x42/0x2d3
[ 66.547834] ? copy_mount_options+0x2c4/0x2d3
[ 66.548625] ksys_mount+0xce/0x11e
[ 66.549314] __x64_sys_mount+0x72/0x83
[ 66.550033] do_syscall_64+0xa8/0x1eb
[ 66.550745] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 66.551641] RIP: 0033:0x7f9a1e19a24a
[ 66.552309] Code: 48 8b 0d 51 fc 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e fc 2a 00 f7 d8 64 89 01 48
[ 66.555317] RSP: 002b:00007fffdd4e9928 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
[ 66.556645] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9a1e19a24a
[ 66.557874] RDX: 00005582b0a54f70 RSI: 00005582b0a54f50 RDI: 00005582b0a53210
[ 66.559065] RBP: 00007fffdd4e9b20 R08: 00005582b0a60320 R09: 0000000000000060
[ 66.560223] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9a1eade410
[ 66.561382] R13: 00007fffdd4e9b20 R14: 00007fffdd4e9a20 R15: 00005582b0a60300
[ 66.562573] CR2: 0000000000000010
[ 66.696349] ---[ end trace b3babf6df207a75b ]---
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
lkp
View attachment "config-4.20.0-rc1-00059-g227a5ea" of type "text/plain" (122025 bytes)
View attachment "job-script" of type "text/plain" (4056 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (20152 bytes)
Powered by blists - more mailing lists