linux-kernel - [LKP] [binder] 3ad20fe393: BUG:unable_to_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190109085041.GK17624@shao2-debian>
Date:   Wed, 9 Jan 2019 16:50:41 +0800
From:   kernel test robot <rong.a.chen@...el.com>
To:     Christian Brauner <christian@...uner.io>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Martijn Coenen <maco@...roid.com>,
        Christian Brauner <christian.brauner@...ntu.com>,
        Todd Kjos <tkjos@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>, lkp@...org
Subject: [LKP] [binder] 3ad20fe393: BUG:unable_to_handle_kernel

FYI, we noticed the following commit (built with gcc-7):

commit: 3ad20fe393b31025bebfc2d76964561f65df48aa ("binder: implement binderfs")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 768M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | 80cd795630 | 3ad20fe393 |
+------------------------------------------+------------+------------+
| boot_successes                           | 17         | 1          |
| boot_failures                            | 8          | 31         |
| invoked_oom-killer:gfp_mask=0x           | 6          |            |
| Mem-Info                                 | 6          |            |
| BUG:kernel_in_stage                      | 2          | 4          |
| RIP:__put_user_8                         | 1          |            |
| BUG:unable_to_handle_kernel              | 0          | 27         |
| Oops:#[##]                               | 0          | 27         |
| RIP:binderfs_mount                       | 0          | 27         |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 27         |
+------------------------------------------+------------+------------+



[    8.360965] BUG: unable to handle kernel NULL pointer dereference at 00000000000006a0
[    8.362067] PGD 0 P4D 0 
[    8.362437] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
[    8.363131] CPU: 0 PID: 1 Comm: swapper Not tainted 4.20.0-rc6-00107-g3ad20fe #2
[    8.364177] RIP: 0010:binderfs_mount+0x42/0x480
[    8.364820] Code: 89 fc 49 c7 c7 ff ff ff ff 48 83 ec 20 e8 86 5d 86 ff 48 8b 04 25 40 10 e3 ab 48 8b 80 28 06 00 00 be 15 00 00 00 48 8b 58 10 <48> 8b bb a0 06 00 00 e8 e2 3c 7d ff 84 c0 75 19 e8 59 5d 86 ff 48
[    8.367104] RSP: 0000:ffffb6a78000bd98 EFLAGS: 00010293
[    8.367104] RAX: ffffffffabe48e40 RBX: 0000000000000000 RCX: ffffffffab2bfd6a
[    8.367104] RDX: 0000000000000000 RSI: 0000000000000015 RDI: ffffffffabf38d60
[    8.367104] RBP: ffffb6a78000bde8 R08: 0000000000000000 R09: 0000000000000000
[    8.367104] R10: 0000000000000000 R11: ffff90c7ec4f2980 R12: ffffffffabf38d60
[    8.367104] R13: 0000000000400000 R14: ffffffffabf38d60 R15: ffffffffffffffff
[    8.367104] FS:  0000000000000000(0000) GS:ffffffffabe2d000(0000) knlGS:0000000000000000
[    8.367104] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.367104] CR2: 00000000000006a0 CR3: 0000000027e19000 CR4: 00000000000406b0
[    8.367104] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    8.367104] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    8.367104] Call Trace:
[    8.367104]  ? __lockdep_init_map+0x4d/0x1b0
[    8.367104]  mount_fs+0x30/0xe0
[    8.367104]  vfs_kern_mount+0x63/0x160
[    8.367104]  ? set_debug_rodata+0x1e/0x1e
[    8.367104]  kern_mount_data+0x39/0x70
[    8.367104]  ? parse_cec_param+0x5b/0x5b
[    8.367104]  init_binderfs+0x6d/0xa5
[    8.367104]  ? parse_cec_param+0x5b/0x5b
[    8.367104]  do_one_initcall+0x6c/0x270
[    8.367104]  ? set_debug_rodata+0x1e/0x1e
[    8.367104]  kernel_init_freeable+0x295/0x34a
[    8.367104]  ? rest_init+0x150/0x150
[    8.367104]  kernel_init+0x14/0x180
[    8.367104]  ? _raw_spin_unlock_irq+0x34/0x50
[    8.367104]  ? rest_init+0x150/0x150
[    8.367104]  ret_from_fork+0x3a/0x50
[    8.367104] Modules linked in:
[    8.367104] CR2: 00000000000006a0
[    8.367104] _warn_unseeded_randomness: 10 callbacks suppressed
[    8.367104] random: get_random_bytes called from print_oops_end_marker+0x52/0x60 with crng_init=0
[    8.367104] ---[ end trace bb3965315c8c70c2 ]---


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
lkp

View attachment "config-4.20.0-rc6-00107-g3ad20fe" of type "text/plain" (119518 bytes)

View attachment "job-script" of type "text/plain" (4238 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (10696 bytes)