linux-kernel - [block] 47cdee29ef: BUG:kernel_NULL_pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 4 Jun 2019 10:09:56 +0800
From:   kernel test robot <rong.a.chen@...el.com>
To:     Ming Lei <ming.lei@...hat.com>
Cc:     Jens Axboe <axboe@...nel.dk>, Bart Van Assche <bvanassche@....org>,
        Christoph Hellwig <hch@....de>,
        LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>, lkp@...org
Subject: [block] 47cdee29ef: BUG:kernel_NULL_pointer_dereference,address

FYI, we noticed the following commit (built with gcc-7):

commit: 47cdee29ef9d94e485eb08f962c74943023a5271 ("block: move blk_exit_queue into __blk_release_queue")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 2G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+-------------------------------------------------+------------+------------+
|                                                 | 31cb1d64da | 47cdee29ef |
+-------------------------------------------------+------------+------------+
| boot_successes                                  | 3          | 0          |
| boot_failures                                   | 13         | 8          |
| BUG:kernel_reboot-without-warning_in_test_stage | 13         |            |
| BUG:kernel_NULL_pointer_dereference,address     | 0          | 8          |
| Oops:#[##]                                      | 0          | 8          |
| RIP:blk_mq_free_rqs                             | 0          | 8          |
| Kernel_panic-not_syncing:Fatal_exception        | 0          | 8          |
+-------------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <rong.a.chen@...el.com>


[    6.560544] BUG: kernel NULL pointer dereference, address: 0000000000000020
[    6.561658] #PF: supervisor read access in kernel mode
[    6.562495] #PF: error_code(0x0000) - not-present page
[    6.563277] PGD 0 P4D 0 
[    6.563277] Oops: 0000 [#1] PTI
[    6.563277] CPU: 0 PID: 147 Comm: kworker/0:2 Tainted: G                T 5.2.0-rc1-00387-g47cdee29 #1
[    6.563277] Workqueue: events __blk_release_queue
[    6.563277] RIP: 0010:blk_mq_free_rqs+0x2c/0xaf
[    6.563277] Code: 66 66 90 55 48 89 e5 41 57 41 56 41 55 41 54 49 89 fd 53 48 89 f3 41 89 d7 48 83 bb 90 00 00 00 00 74 0e 49 8b 45 38 45 31 e4 <48> 83 78 20 00 75 3b 4c 8d ab a0 00 00 00 eb 39 48 8b 83 98 00 00
[    6.563277] RSP: 0000:ffff888071f6bdb0 EFLAGS: 00010246
[    6.563277] RAX: 0000000000000000 RBX: ffff88807f1a76b8 RCX: 000000000011000b
[    6.563277] RDX: 0000000000000000 RSI: ffff88807f1a76b8 RDI: ffff88807f0012c8
[    6.563277] RBP: ffff888071f6bdd8 R08: ffff888071f6bf48 R09: 0000000000000000
[    6.563277] R10: ffff888071f6bdd8 R11: 0000000000000030 R12: 0000000000000000
[    6.563277] R13: ffff88807f0012c8 R14: ffff88807f0012c8 R15: 0000000000000000
[    6.563277] FS:  0000000000000000(0000) GS:ffffffff8263d000(0000) knlGS:0000000000000000
[    6.563277] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    6.563277] CR2: 0000000000000020 CR3: 000000000262a000 CR4: 00000000000406b0
[    6.563277] Call Trace:
[    6.563277]  blk_mq_sched_tags_teardown+0x46/0x6a
[    6.563277]  blk_mq_exit_sched+0x6f/0x81
[    6.563277]  elevator_exit+0x38/0x50
[    6.563277]  __blk_release_queue+0x6b/0xdc
[    6.563277]  process_one_work+0x174/0x26a
[    6.563277]  ? rescuer_thread+0x262/0x262
[    6.563277]  worker_thread+0x1a8/0x267
[    6.563277]  ? rescuer_thread+0x262/0x262
[    6.563277]  kthread+0xff/0x107
[    6.563277]  ? kthread_create_worker_on_cpu+0x5f/0x5f
[    6.563277]  ret_from_fork+0x24/0x30
[    6.563277] Modules linked in:
[    6.563277] CR2: 0000000000000020
[    6.563277] _warn_unseeded_randomness: 1 callbacks suppressed
[    6.563277] random: get_random_bytes called from init_oops_id+0x26/0x36 with crng_init=0
[    6.563277] ---[ end trace 1855f0c417feab1e ]---


To reproduce:

        # build kernel
	cd linux
	cp config-5.2.0-rc1-00387-g47cdee29 .config
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 prepare
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 modules_prepare
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 SHELL=/bin/bash
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 bzImage


        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
Rong Chen


View attachment "config-5.2.0-rc1-00387-g47cdee29" of type "text/plain" (141274 bytes)

View attachment "job-script" of type "text/plain" (4417 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (10512 bytes)