lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date:   Fri, 24 Jul 2020 22:29:01 +0800
From:   kernel test robot <rong.a.chen@...el.com>
To:     Daniel Colascione <dancol@...gle.com>
Cc:     James Morris <jmorris@...ei.org>,
        Casey Schaufler <casey@...aufler-ca.com>,
        Stephen Smalley <stephen.smalley.work@...il.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org
Subject: d08ac70b1e: WARNING:at_kernel/fork.c:#__mmdrop

Greeting,

FYI, we noticed the following commit (built with gcc-9):

commit: d08ac70b1e0dc71ac2315007bcc3efb283b2eae4 ("Wire UFFD up to SELinux")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master


in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------------------+------------+------------+
|                                                      | 2b72259a27 | d08ac70b1e |
+------------------------------------------------------+------------+------------+
| boot_successes                                       | 217        | 228        |
| boot_failures                                        | 7          | 37         |
| INFO:rcu_sched_self-detected_stall_on_CPU            | 4          | 6          |
| RIP:iov_iter_copy_from_user_atomic                   | 4          | 6          |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c22:#]     | 1          |            |
| Kernel_panic-not_syncing:softlockup:hung_tasks       | 1          | 5          |
| invoked_oom-killer:gfp_mask=0x                       | 1          | 2          |
| Mem-Info                                             | 1          | 2          |
| RIP:strncpy_from_user                                | 1          |            |
| RIP:__put_user_4                                     | 1          |            |
| RIP:copy_user_generic_string                         | 1          |            |
| BUG:kernel_hang_in_test_stage                        | 2          | 2          |
| WARNING:at_kernel/fork.c:#__mmdrop                   | 0          | 20         |
| RIP:__mmdrop                                         | 0          | 20         |
| BUG:Bad_rss-counter_state_mm:#type:MM_FILEPAGES_val  | 0          | 12         |
| BUG:Bad_rss-counter_state_mm:#type:MM_ANONPAGES_val  | 0          | 12         |
| BUG:Bad_rss-counter_state_mm:#type:MM_SHMEMPAGES_val | 0          | 12         |
| BUG:non-zero_pgtables_bytes_on_freeing_mm            | 0          | 13         |
| WARNING:at_lib/refcount.c:#refcount_warn_saturate    | 0          | 10         |
| RIP:refcount_warn_saturate                           | 0          | 10         |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c27:#]     | 0          | 1          |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c12:#]     | 0          | 1          |
| kernel_BUG_at_lib/list_debug.c                       | 0          | 10         |
| invalid_opcode:#[##]                                 | 0          | 10         |
| RIP:__list_del_entry_valid.cold                      | 0          | 10         |
| Kernel_panic-not_syncing:Fatal_exception             | 0          | 10         |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c8:#]      | 0          | 1          |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c0:#]      | 0          | 1          |
| BUG:unable_to_handle_page_fault_for_addr             | 0          | 1          |
| BUG:soft_lockup-CPU##stuck_for#s![trinity-c7:#]      | 0          | 1          |
+------------------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <rong.a.chen@...el.com>


[  158.290630] WARNING: CPU: 0 PID: 8457 at kernel/fork.c:694 __mmdrop+0xd1/0xe0
[  158.293992] Modules linked in: bridge stp llc af_key mpls_router ip_tunnel ieee802154_socket vsock_loopback vmw_vsock_virtio_transport_common ieee802154 vmw_vsock_vmci_transport vsock vmw_vmci hidp bnep rfcomm bluetooth ecdh_generic ecc rfkill can_bcm can_raw can crypto_user ib_core nfnetlink scsi_transport_iscsi atm sctp libcrc32c bochs_drm drm_vram_helper drm_ttm_helper intel_rapl_msr ttm intel_rapl_common crct10dif_pclmul drm_kms_helper sr_mod cdrom crc32_pclmul crc32c_intel syscopyarea ghash_clmulni_intel ata_generic sysfillrect sysimgblt ppdev fb_sys_fops ata_piix drm joydev libata parport_pc i2c_piix4 serio_raw parport
[  158.312180] CPU: 0 PID: 8457 Comm: trinity-c10 Not tainted 5.7.0-00003-gd08ac70b1e0dc7 #1
[  158.315328] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  158.318695] RIP: 0010:__mmdrop+0xd1/0xe0
[  158.321378] Code: ed 08 ec 01 5b 48 89 ee 5d 41 5c e9 89 c6 20 00 e8 24 23 0d 00 eb e6 0f 0b 0f 0b e9 7a ff ff ff 48 89 ef e8 41 1d 20 00 eb 8e <0f> 0b e9 57 ff ff ff 0f 1f 84 00 00 00 00 00 66 66 66 66 90 48 81
[  158.330235] RSP: 0018:ffffa34f49afbe18 EFLAGS: 00010246
[  158.333201] RAX: ffff94c6ad802680 RBX: 0000000000000000 RCX: 0000000000000000
[  158.336364] RDX: 0000000000000001 RSI: ffff94c6aa0b4000 RDI: ffff94c6b917ee80
[  158.339422] RBP: ffff94c6b917ee80 R08: ffff94c6aa0b4020 R09: ffffa34f49afbde0
[  158.342780] R10: ffff94c6aa548960 R11: 0000000000000000 R12: ffff94c6b9f36bb8
[  158.348513] R13: ffff94c6b917ee80 R14: 0000000000000000 R15: ffff94c6b917eef8
[  158.351652] FS:  0000000002372880(0000) GS:ffff94c6ffc00000(0000) knlGS:0000000000000000
[  158.354897] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  158.357787] CR2: 0000000000000000 CR3: 00000003fca6e000 CR4: 00000000000406f0
[  158.360866] DR0: 00007efcfdc0e000 DR1: 0000000000000000 DR2: 0000000000000000
[  158.367310] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[  158.370393] Call Trace:
[  158.372664]  userfaultfd_ctx_put+0x4d/0x70
[  158.375143]  userfaultfd_release+0x1c6/0x1f0
[  158.377630]  __fput+0xf5/0x260
[  158.379754]  task_work_run+0x69/0xb0
[  158.381994]  exit_to_usermode_loop+0xd0/0xe0
[  158.384535]  do_syscall_64+0x198/0x1b0
[  158.386732]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  158.388978] RIP: 0033:0x463519
[  158.391150] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 59 00 00 c3 66 2e 0f 1f 84 00 00 00 00
[  158.397097] RSP: 002b:00007ffff6effa08 EFLAGS: 00000246 ORIG_RAX: 0000000000000143
[  158.400121] RAX: ffffffffffffffe8 RBX: 0000000000000143 RCX: 0000000000463519
[  158.402827] RDX: 0000000015151515 RSI: fffffffffffffffa RDI: 0000000000000800
[  158.405446] RBP: 00007efcfe5a4000 R08: 0000000000000303 R09: 0000009200000841
[  158.408107] R10: fffffffffffffffa R11: 0000000000000246 R12: 0000000000000002
[  158.410691] R13: 00007efcfe5a4058 R14: 0000000002372850 R15: 00007efcfe5a4000
[  158.413286] ---[ end trace 74d9850724b94aba ]---


To reproduce:

        # build kernel
	cd linux
	cp config-5.7.0-00003-gd08ac70b1e0dc7 .config
	make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
Rong Chen


View attachment "config-5.7.0-00003-gd08ac70b1e0dc7" of type "text/plain" (156786 bytes)

View attachment "job-script" of type "text/plain" (4297 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (19880 bytes)

Powered by blists - more mailing lists