linux-kernel - [LKP] [ip_tunnel] c8b34e680a: BUG:unable_to_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20190215083038.GF5160@shao2-debian>
Date:   Fri, 15 Feb 2019 16:30:38 +0800
From:   kernel test robot <rong.a.chen@...el.com>
To:     wenxu <wenxu@...oud.cn>
Cc:     "David S. Miller" <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>, lkp@...org
Subject: [LKP] [ip_tunnel] c8b34e680a: BUG:unable_to_handle_kernel

FYI, we noticed the following commit (built with gcc-7):

commit: c8b34e680a090ab8dc42f8331020e31052b49a70 ("ip_tunnel: Add tnl_update_pmtu in ip_md_tunnel_xmit")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master

in testcase: kernel_selftests
with following parameters:

	group: kselftests-00

test-description: The kernel contains a set of "self tests" under the tools/testing/selftests/ directory. These are intended to be small unit tests to exercise individual code paths in the kernel.
test-url: https://www.kernel.org/doc/Documentation/kselftest.txt


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 4G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+-------------------------------------------------------------------------+------------+------------+
|                                                                         | f46fe4f8d7 | c8b34e680a |
+-------------------------------------------------------------------------+------------+------------+
| boot_successes                                                          | 38         | 1          |
| boot_failures                                                           | 16         | 30         |
| WARNING:at_kernel/rcu/rcutorture.c:#rcu_torture_stats_print[rcutorture] | 8          |            |
| RIP:rcu_torture_stats_print[rcutorture]                                 | 8          |            |
| End_of_test:FAILURE                                                     | 8          |            |
| End_of_test:RCU_HOTPLUG                                                 | 8          |            |
| BUG:unable_to_handle_kernel                                             | 0          | 30         |
| Oops:#[##]                                                              | 0          | 30         |
| Kernel_panic-not_syncing:Fatal_exception_in_interrupt                   | 0          | 30         |
+-------------------------------------------------------------------------+------------+------------+



[  272.005128] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[  272.007075] #PF error: [INSTR]
[  272.007910] PGD 0 P4D 0 
[  272.008656] Oops: 0010 [#1] SMP PTI
[  272.009575] CPU: 0 PID: 16822 Comm: ping Not tainted 5.0.0-rc3-00352-gc8b34e6 #1
[  272.011384] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[  272.013374] RIP: 0010:          (null)
[  272.014349] Code: Bad RIP value.
[  272.015222] RSP: 0018:ffffc9000104f9c8 EFLAGS: 00010286
[  272.016466] RAX: 0000000000000000 RBX: ffffe8ffffc071a8 RCX: 0000000000000000
[  272.018063] RDX: ffff888054e33000 RSI: ffff88807796f500 RDI: ffffe8ffffc07130
[  272.019657] RBP: ffff88807796f500 R08: ffff88806da4f0a0 R09: 0000000000000000
[  272.021252] R10: 0000000000000004 R11: ffff888054e33000 R12: 0000000000000054
[  272.022842] R13: ffff88805e714000 R14: ffff88806da4f0a0 R15: 0000000000000000
[  272.024443] FS:  00007f4c00431500(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
[  272.026378] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  272.027714] CR2: ffffffffffffffd6 CR3: 000000008276e000 CR4: 00000000000406f0
[  272.029315] Call Trace:
[  272.030051]  ? tnl_update_pmtu+0x21b/0x250 [ip_tunnel]
[  272.031277]  ? ip_md_tunnel_xmit+0x1b7/0xdc0 [ip_tunnel]
[  272.032542]  ? ipip_tunnel_xmit+0x90/0xc0 [ipip]
[  272.033678]  ? dev_hard_start_xmit+0x98/0x210
[  272.034758]  ? __dev_queue_xmit+0x6a9/0x8e0
[  272.035809]  ? udp4_ufo_fragment+0x170/0x170
[  272.036872]  ? ___neigh_create+0x4d9/0x680
[  272.037902]  ? ip_finish_output2+0x16f/0x430
[  272.038968]  ? pneigh_lookup+0x190/0x190
[  272.039965]  ? ip_finish_output2+0x16f/0x430
[  272.041027]  ? ip_output+0x69/0x100
[  272.041941]  ? ip_output+0x69/0x100
[  272.042859]  ? ip_fragment+0x80/0x80
[  272.044011]  ? ip_send_skb+0x15/0x40
[  272.044940]  ? raw_sendmsg+0xa13/0xcf0
[  272.045904]  ? free_unref_page_commit+0x9f/0x120
[  272.047032]  ? __get_locked_pte+0x167/0x1e0
[  272.048077]  ? sock_sendmsg+0x36/0x40
[  272.049025]  ? sock_sendmsg+0x36/0x40
[  272.049975]  ? __sys_sendto+0x10e/0x140
[  272.050957]  ? do_vfs_ioctl+0xa5/0x6e0
[  272.051920]  ? ksys_ioctl+0x70/0x80
[  272.052839]  ? __x64_sys_sendto+0x24/0x30
[  272.053858]  ? do_syscall_64+0x5b/0x180
[  272.054850]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  272.056094] Modules linked in: ipip tunnel4 iptable_filter xt_mark vxlan ip6_udp_tunnel udp_tunnel ip_gre ip_tunnel gre cls_bpf sch_ingress veth binfmt_misc crct10dif_pclmul crc32_pclmul crc32c_intel sr_mod cdrom ghash_clmulni_intel sg ata_generic pata_acpi ppdev aesni_intel crypto_simd cryptd glue_helper snd_pcm snd_timer snd soundcore pcspkr serio_raw ata_piix libata i2c_piix4 floppy parport_pc parport ip_tables [last unloaded: test_bpf]
[  272.064439] CR2: 0000000000000000
[  272.065329] ---[ end trace dd5201a0f784d36f ]---


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
Rong Chen

View attachment "config-5.0.0-rc3-00352-gc8b34e6" of type "text/plain" (169012 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (228216 bytes)