| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 8 Mar 2021 23:26:20 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Minchan Kim <minchan@...nel.org>
Cc: 0day robot <lkp@...el.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
John Hubbard <jhubbard@...dia.com>,
LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org,
Andrew Morton <akpm@...ux-foundation.org>,
linux-mm <linux-mm@...ck.org>, surenb@...gle.com,
joaodias@...gle.com, willy@...radead.org,
Minchan Kim <minchan@...nel.org>
Subject: [mm] 9ddc8abf03: BUG:KASAN:null-ptr-deref_in_lockdep_init_map_type
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 9ddc8abf031750362cda61a9fb8a28be8871eaae ("[PATCH v4] mm: cma: support sysfs")
url: https://github.com/0day-ci/linux/commits/Minchan-Kim/mm-cma-support-sysfs/20210305-002050
base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git f69d02e37a85645aa90d18cacfff36dba370f797
in testcase: trinity
version: trinity-i386-4d2343bd-1_20200320
with following parameters:
group: group-01
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-------------------------------------------------------------------------+------------+------------+
| | f69d02e37a | 9ddc8abf03 |
+-------------------------------------------------------------------------+------------+------------+
| BUG:KASAN:null-ptr-deref_in_lockdep_init_map_type | 0 | 12 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 12 |
| Oops:#[##] | 0 | 12 |
| RIP:lockdep_init_map_type | 0 | 12 |
+-------------------------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 16.842917] BUG: KASAN: null-ptr-deref in lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.844311] Write of size 8 at addr 0000000000000030 by task swapper/0/1
[ 16.844311]
[ 16.844311] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-00023-g9ddc8abf0317 #1
[ 16.844311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 16.844311] Call Trace:
[ 16.844311] dump_stack (kbuild/src/consumer/lib/dump_stack.c:122)
[ 16.844311] ? lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.844311] kasan_report.cold (kbuild/src/consumer/mm/kasan/report.c:403 kbuild/src/consumer/mm/kasan/report.c:416)
[ 16.844311] ? lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.844311] lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.844311] __raw_spin_lock_init (kbuild/src/consumer/kernel/locking/spinlock_debug.c:26)
[ 16.844311] cma_sysfs_init (kbuild/src/consumer/mm/cma_sysfs.c:91)
[ 16.844311] ? cma_debugfs_init (kbuild/src/consumer/mm/cma_sysfs.c:74)
[ 16.844311] do_one_initcall (kbuild/src/consumer/init/main.c:1226)
[ 16.844311] ? perf_trace_initcall_level (kbuild/src/consumer/init/main.c:1217)
[ 16.844311] ? rcu_read_lock_sched_held (kbuild/src/consumer/kernel/rcu/update.c:125)
[ 16.844311] ? trace_event_raw_event_rcu_torture_read (kbuild/src/consumer/kernel/rcu/update.c:120)
[ 16.844311] ? write_comp_data (kbuild/src/consumer/kernel/kcov.c:218)
[ 16.844311] ? __sanitizer_cov_trace_pc (kbuild/src/consumer/kernel/kcov.c:197)
[ 16.844311] kernel_init_freeable (kbuild/src/consumer/init/main.c:1298 kbuild/src/consumer/init/main.c:1315 kbuild/src/consumer/init/main.c:1335 kbuild/src/consumer/init/main.c:1537)
[ 16.844311] ? console_on_rootfs (kbuild/src/consumer/init/main.c:1503)
[ 16.844311] ? tracer_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_irqsoff.c:57 kbuild/src/consumer/kernel/trace/trace_irqsoff.c:610)
[ 16.844311] ? mark_held_locks (kbuild/src/consumer/kernel/locking/lockdep.c:4067)
[ 16.844311] ? rest_init (kbuild/src/consumer/init/main.c:1421)
[ 16.844311] kernel_init (kbuild/src/consumer/init/main.c:1426)
[ 16.844311] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300)
[ 16.844311] ==================================================================
[ 16.844311] Disabling lock debugging due to kernel taint
[ 16.844425] BUG: kernel NULL pointer dereference, address: 0000000000000030
[ 16.845925] #PF: supervisor write access in kernel mode
[ 16.847149] #PF: error_code(0x0002) - not-present page
[ 16.848311] PGD 0 P4D 0
[ 16.848311] Oops: 0002 [#1] SMP KASAN PTI
[ 16.848311] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.12.0-rc1-00023-g9ddc8abf0317 #1
[ 16.848311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 16.848311] RIP: 0010:lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.848311] Code: 89 ce 41 55 41 54 49 89 d4 55 48 89 fd 48 83 c7 08 53 48 89 f3 48 83 ec 08 8b 44 24 40 44 89 04 24 89 44 24 04 e8 0e 2b 4b 00 <48> c7 45 08 00 00 00 00 48 8d 7d 10 e8 fd 2a 4b 00 48 c7 45 10 00
All code
========
0: 89 ce mov %ecx,%esi
2: 41 55 push %r13
4: 41 54 push %r12
6: 49 89 d4 mov %rdx,%r12
9: 55 push %rbp
a: 48 89 fd mov %rdi,%rbp
d: 48 83 c7 08 add $0x8,%rdi
11: 53 push %rbx
12: 48 89 f3 mov %rsi,%rbx
15: 48 83 ec 08 sub $0x8,%rsp
19: 8b 44 24 40 mov 0x40(%rsp),%eax
1d: 44 89 04 24 mov %r8d,(%rsp)
21: 89 44 24 04 mov %eax,0x4(%rsp)
25: e8 0e 2b 4b 00 callq 0x4b2b38
2a:* 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) <-- trapping instruction
31: 00
32: 48 8d 7d 10 lea 0x10(%rbp),%rdi
36: e8 fd 2a 4b 00 callq 0x4b2b38
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: 45 10 00 adc %r8b,(%r8)
Code starting with the faulting instruction
===========================================
0: 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp)
7: 00
8: 48 8d 7d 10 lea 0x10(%rbp),%rdi
c: e8 fd 2a 4b 00 callq 0x4b2b0e
11: 48 rex.W
12: c7 .byte 0xc7
13: 45 10 00 adc %r8b,(%r8)
[ 16.848311] RSP: 0000:ffffc9000006fc98 EFLAGS: 00010282
[ 16.848311] RAX: 0000000000000001 RBX: ffffffff9f3a9fc0 RCX: ffffffff9e875dcf
[ 16.848311] RDX: dffffc0000000000 RSI: ffff888101489000 RDI: ffffffffa43ce860
[ 16.848311] RBP: 0000000000000028 R08: 0000000000000000 R09: 0000000000000000
[ 16.848311] R10: ffffffffa7c5de03 R11: fffffbfff4f8bbc0 R12: ffffffffafea6da0
[ 16.848311] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000
[ 16.848311] FS: 0000000000000000(0000) GS:ffff8881c5c00000(0000) knlGS:0000000000000000
[ 16.848311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.848311] CR2: 0000000000000030 CR3: 000000022eeba000 CR4: 00000000000406f0
[ 16.848311] Call Trace:
[ 16.848311] __raw_spin_lock_init (kbuild/src/consumer/kernel/locking/spinlock_debug.c:26)
[ 16.848311] cma_sysfs_init (kbuild/src/consumer/mm/cma_sysfs.c:91)
[ 16.848311] ? cma_debugfs_init (kbuild/src/consumer/mm/cma_sysfs.c:74)
[ 16.848311] do_one_initcall (kbuild/src/consumer/init/main.c:1226)
[ 16.848311] ? perf_trace_initcall_level (kbuild/src/consumer/init/main.c:1217)
[ 16.848311] ? rcu_read_lock_sched_held (kbuild/src/consumer/kernel/rcu/update.c:125)
[ 16.848311] ? trace_event_raw_event_rcu_torture_read (kbuild/src/consumer/kernel/rcu/update.c:120)
[ 16.848311] ? write_comp_data (kbuild/src/consumer/kernel/kcov.c:218)
[ 16.848311] ? __sanitizer_cov_trace_pc (kbuild/src/consumer/kernel/kcov.c:197)
[ 16.848311] kernel_init_freeable (kbuild/src/consumer/init/main.c:1298 kbuild/src/consumer/init/main.c:1315 kbuild/src/consumer/init/main.c:1335 kbuild/src/consumer/init/main.c:1537)
[ 16.848311] ? console_on_rootfs (kbuild/src/consumer/init/main.c:1503)
[ 16.848311] ? tracer_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_irqsoff.c:57 kbuild/src/consumer/kernel/trace/trace_irqsoff.c:610)
[ 16.848311] ? mark_held_locks (kbuild/src/consumer/kernel/locking/lockdep.c:4067)
[ 16.848311] ? rest_init (kbuild/src/consumer/init/main.c:1421)
[ 16.848311] kernel_init (kbuild/src/consumer/init/main.c:1426)
[ 16.848311] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300)
[ 16.848311] Modules linked in:
[ 16.848311] CR2: 0000000000000030
[ 16.848311] ---[ end trace 29b158f4fb30e312 ]---
[ 16.848311] RIP: 0010:lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654)
[ 16.848311] Code: 89 ce 41 55 41 54 49 89 d4 55 48 89 fd 48 83 c7 08 53 48 89 f3 48 83 ec 08 8b 44 24 40 44 89 04 24 89 44 24 04 e8 0e 2b 4b 00 <48> c7 45 08 00 00 00 00 48 8d 7d 10 e8 fd 2a 4b 00 48 c7 45 10 00
All code
========
0: 89 ce mov %ecx,%esi
2: 41 55 push %r13
4: 41 54 push %r12
6: 49 89 d4 mov %rdx,%r12
9: 55 push %rbp
a: 48 89 fd mov %rdi,%rbp
d: 48 83 c7 08 add $0x8,%rdi
11: 53 push %rbx
12: 48 89 f3 mov %rsi,%rbx
15: 48 83 ec 08 sub $0x8,%rsp
19: 8b 44 24 40 mov 0x40(%rsp),%eax
1d: 44 89 04 24 mov %r8d,(%rsp)
21: 89 44 24 04 mov %eax,0x4(%rsp)
25: e8 0e 2b 4b 00 callq 0x4b2b38
2a:* 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) <-- trapping instruction
31: 00
32: 48 8d 7d 10 lea 0x10(%rbp),%rdi
36: e8 fd 2a 4b 00 callq 0x4b2b38
3b: 48 rex.W
3c: c7 .byte 0xc7
3d: 45 10 00 adc %r8b,(%r8)
Code starting with the faulting instruction
===========================================
0: 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp)
7: 00
8: 48 8d 7d 10 lea 0x10(%rbp),%rdi
c: e8 fd 2a 4b 00 callq 0x4b2b0e
11: 48 rex.W
12: c7 .byte 0xc7
13: 45 10 00 adc %r8b,(%r8)
To reproduce:
# build kernel
cd linux
cp config-5.12.0-rc1-00023-g9ddc8abf0317 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.12.0-rc1-00023-g9ddc8abf0317" of type "text/plain" (270262 bytes)
View attachment "job-script" of type "text/plain" (4144 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (9752 bytes)
Powered by blists - more mailing lists