linux-kernel - [blk] 90d38c0e30: kernel_BUG_at

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Sat, 25 Apr 2020 19:43:08 +0800
From:   kernel test robot <rong.a.chen@...el.com>
To:     Luis Chamberlain <mcgrof@...nel.org>
Cc:     axboe@...nel.dk, viro@...iv.linux.org.uk, bvanassche@....org,
        gregkh@...uxfoundation.org, rostedt@...dmis.org, mingo@...hat.com,
        jack@...e.cz, ming.lei@...hat.com, nstange@...e.de,
        akpm@...ux-foundation.org, mhocko@...e.com, yukuai3@...wei.com,
        linux-block@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Luis Chamberlain <mcgrof@...nel.org>, lkp@...ts.01.org
Subject: [blk] 90d38c0e30: kernel_BUG_at_block/blk-debugfs.c

Greeting,

FYI, we noticed the following commit (built with gcc-7):

commit: 90d38c0e304b1d6464bf26587ab1ebb96252b5d7 ("[PATCH v2 06/10] blk-debugfs: upgrade warns to BUG_ON() if directory is already found")
url: https://github.com/0day-ci/linux/commits/Luis-Chamberlain/block-fix-blktrace-debugfs-use-after-free/20200421-181649
base: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git for-next

in testcase: blktests
with following parameters:

	disk: 1SSD
	test: block-group1



on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | 0f33ec75aa | 90d38c0e30 |
+------------------------------------------+------------+------------+
| boot_successes                           | 7          | 1          |
| boot_failures                            | 0          | 9          |
| kernel_BUG_at_block/blk-debugfs.c        | 0          | 9          |
| invalid_opcode:#[##]                     | 0          | 9          |
| RIP:blk_queue_debugfs_register           | 0          | 9          |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 9          |
+------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <rong.a.chen@...el.com>


[  138.292195] kernel BUG at block/blk-debugfs.c:23!
[  138.294157] invalid opcode: 0000 [#1] SMP PTI
[  138.295300] sd 6:0:0:0: Power-on or device reset occurred
[  138.295817] CPU: 0 PID: 371 Comm: kworker/u4:6 Not tainted 5.7.0-rc2-00022-g90d38c0e304b1 #1
[  138.295818] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  138.295825] Workqueue: events_unbound async_run_entry_fn
[  138.295832] RIP: 0010:blk_queue_debugfs_register+0x4c/0x50
[  138.300687] sd 6:0:0:0: [sdm] 16384 512-byte logical blocks: (8.39 MB/8.00 MiB)
[  138.302161] Code: 75 28 48 8b 83 98 00 00 00 48 8b 35 be c1 cf 01 48 8b 38 e8 e6 91 f4 ff 48 83 f8 01 48 89 83 c8 07 00 00 19 c0 83 e0 f4 5b c3 <0f> 0b 66 90 66 66 66 66 90 53 48 89 fb 48 8b bf c8 07 00 00 e8 eb
[  138.302162] RSP: 0018:ffffae7840457cc8 EFLAGS: 00010282
[  138.302164] RAX: ffff8bf1c58ef840 RBX: ffff8bf1caa0e938 RCX: 0000000000000000
[  138.302165] RDX: 0000000000200000 RSI: fffffffff3114d98 RDI: ffff8bf1c58ef898
[  138.302166] RBP: 0000000000000000 R08: ffff8bf1c58ef840 R09: ffff8bf1006c6473
[  138.302167] R10: 0000000000000003 R11: ffff8bf1c59d9d28 R12: ffff8bf1b8032060
[  138.302168] R13: ffff8bf1caa0e9b8 R14: ffff8bf1caa0ee98 R15: ffff8bf1b803200c
[  138.302171] FS:  0000000000000000(0000) GS:ffff8bf23fc00000(0000) knlGS:0000000000000000
[  138.306090] sd 6:0:0:0: [sdm] Write Protect is off
[  138.307880] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  138.307881] CR2: 0000563df5ff7048 CR3: 00000001b8ee0000 CR4: 00000000000406f0
[  138.307886] Call Trace:
[  138.308157]  blk_register_queue+0x103/0x230
[  138.312660] sd 6:0:0:0: [sdm] Mode Sense: 73 00 10 08
[  138.314787]  __device_add_disk+0x2ec/0x4c0
[  138.314801]  sd_probe+0x32c/0x460 [sd_mod]
[  138.314807]  really_probe+0xef/0x430
[  138.315012]  ? driver_allows_async_probing+0x50/0x50
[  138.315015]  driver_probe_device+0x110/0x120
[  138.315017]  ? driver_allows_async_probing+0x50/0x50
[  138.315019]  bus_for_each_drv+0x69/0xb0
[  138.315029]  __device_attach_async_helper+0xad/0x100
[  138.315033]  async_run_entry_fn+0x39/0x160
[  138.315247]  process_one_work+0x1b0/0x3e0
[  138.315406]  worker_thread+0x3c/0x3b0
[  138.315409]  ? process_one_work+0x3e0/0x3e0
[  138.315412]  kthread+0x12c/0x150
[  138.315420]  ? kthread_park+0x90/0x90
[  138.315424]  ret_from_fork+0x35/0x40
[  138.315427] Modules linked in: scsi_debug loop dm_multipath dm_mod intel_rapl_msr intel_rapl_common crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel bochs_drm drm_vram_helper drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt ppdev snd_pcm sd_mod ata_generic t10_pi pata_acpi sg aesni_intel snd_timer snd crypto_simd joydev soundcore ata_piix fb_sys_fops cryptd parport_pc glue_helper floppy pcspkr serio_raw virtio_scsi drm libata parport i2c_piix4 ip_tables
[  138.315497] ---[ end trace 51979eae72211e91 ]---


To reproduce:

        # build kernel
	cd linux
	cp config-5.7.0-rc2-00022-g90d38c0e304b1 .config
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
Rong Chen


View attachment "config-5.7.0-rc2-00022-g90d38c0e304b1" of type "text/plain" (206126 bytes)

View attachment "job-script" of type "text/plain" (5477 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (34404 bytes)