linux-kernel - 5.11-rc1 TTM list corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201231104020.GA4504@zn.tnic>
Date:   Thu, 31 Dec 2020 11:40:20 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Christian Koenig <christian.koenig@....com>,
        Huang Rui <ray.huang@....com>
Cc:     dri-devel@...ts.freedesktop.org,
        lkml <linux-kernel@...r.kernel.org>
Subject: 5.11-rc1 TTM list corruption

Hi folks,

got this when trying to suspend my workstation to disk, it was still
responsive so I could catch the splat:

[22020.334381] ------------[ cut here ]------------
[22020.339057] list_del corruption. next->prev should be ffffffff8b7a9a40, but was ffff8881020bced0
[22020.347764] WARNING: CPU: 12 PID: 13134 at lib/list_debug.c:54 __list_del_entry_valid+0x8a/0x90
[22020.356397] Modules linked in: fuse essiv authenc nft_counter nf_tables libcrc32c nfnetlink loop dm_crypt dm_mod amd64_edac edac_mce_amd kvm_amd snd_hda_codec_realtek snd_hda_codec_generic led_class kvm ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_pcm snd_timer irqbypass crct10dif_pclmul snd crc32_pclmul crc32c_intel ghash_clmulni_intel pcspkr k10temp soundcore gpio_amdpt gpio_generic acpi_cpufreq radeon aesni_intel glue_helper crypto_simd cryptd pinctrl_amd
[22020.400855] CPU: 12 PID: 13134 Comm: hib.sh Not tainted 5.11.0-rc1+ #2
[22020.400857] Hardware name: Micro-Star International Co., Ltd. MS-7B79/X470 GAMING PRO (MS-7B79), BIOS 1.70 01/23/2019
[22020.400858] RIP: 0010:__list_del_entry_valid+0x8a/0x90
[22020.400861] Code: 46 00 0f 0b 31 c0 c3 48 89 f2 48 89 fe 48 c7 c7 78 30 0f 82 e8 24 6c 46 00 0f 0b 31 c0 c3 48 c7 c7 b8 30 0f 82 e8 13 6c 46 00 <0f> 0b 31 c0 c3 cc 48 85 d2 89 f8 74 20 48 8d 0c 16 0f b6 16 48 ff
[22020.400863] RSP: 0018:ffffc90001fbbcf8 EFLAGS: 00010292
[22020.441503] RAX: 0000000000000054 RBX: ffffffff8b7a9a40 RCX: 0000000000000000
[22020.441505] RDX: ffff8887fef26600 RSI: ffff8887fef17450 RDI: ffff8887fef17450
[22020.441505] RBP: 0000000000003f82 R08: ffff8887fef17450 R09: ffffc90001fbbb38
[22020.441506] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
[22020.441507] R13: 0000000000000080 R14: 0000000000000480 R15: 000000000000019b
[22020.441508] FS:  00007f51c72f9740(0000) GS:ffff8887fef00000(0000) knlGS:0000000000000000
[22020.490045] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[22020.490046] CR2: 00005557afb81018 CR3: 000000012099e000 CR4: 00000000003506e0
[22020.490047] Call Trace:
[22020.490048]  ttm_pool_shrink+0x61/0xd0
[22020.508965]  ttm_pool_shrinker_scan+0xa/0x20
[22020.508966]  shrink_slab.part.0.constprop.0+0x1a1/0x330
[22020.508970]  drop_slab_node+0x37/0x50
[22020.522011]  drop_slab+0x33/0x60
[22020.522012]  drop_caches_sysctl_handler+0x70/0x80
[22020.522015]  proc_sys_call_handler+0x140/0x220
[22020.534286]  new_sync_write+0x10b/0x190
[22020.534289]  vfs_write+0x1b7/0x290
[22020.534291]  ksys_write+0x60/0xe0
[22020.544762]  do_syscall_64+0x33/0x40
[22020.544765]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[22020.553320] RIP: 0033:0x7f51c73eaff3
[22020.553322] Code: 8b 15 a1 ee 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
[22020.553324] RSP: 002b:00007ffd0a748ef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[22020.553325] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f51c73eaff3
[22020.553326] RDX: 0000000000000002 RSI: 000056039fd0ee70 RDI: 0000000000000001
[22020.553327] RBP: 000056039fd0ee70 R08: 000000000000000a R09: 0000000000000001
[22020.553327] R10: 000056039fd0e770 R11: 0000000000000246 R12: 0000000000000002
[22020.611218] R13: 00007f51c74bb6a0 R14: 0000000000000002 R15: 00007f51c74bb8a0
[22020.611220] ---[ end trace f7ea94a6ddb98f71 ]---

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette