| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20210622142923.GE9474@xsang-OptiPlex-9020>
Date: Tue, 22 Jun 2021 22:29:23 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Christoph Hellwig <hch@....de>
Cc: Jens Axboe <axboe@...nel.dk>,
Chaitanya Kulkarni <chaitanya.kulkarni@....com>,
LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org,
lkp@...el.com
Subject: [mtd_blkdevs] 6966bb921d:
BUG:KASAN:null-ptr-deref_in_blk_queue_flag_set
Greeting,
FYI, we noticed the following commit (built with clang-13):
commit: 6966bb921def0a4ef1e069f806c086efae6782ea ("mtd_blkdevs: use blk_mq_alloc_disk")
https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git for-5.14/block
in testcase: trinity
version: trinity-x86_64-03f10b67-1_20210616
with following parameters:
number: 99999
group: group-01
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-----------------------------------------------------------+------------+------------+
| | 51ed5bd55e | 6966bb921d |
+-----------------------------------------------------------+------------+------------+
| boot_successes | 21 | 0 |
| BUG:KASAN:null-ptr-deref_in_blk_queue_flag_set | 0 | 61 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 61 |
| RIP:blk_queue_flag_set | 0 | 61 |
+-----------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 30.271915] BUG: KASAN: null-ptr-deref in blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83)
[ 30.272645] Write of size 8 at addr 0000000000000068 by task swapper/0/1
[ 30.273447]
[ 30.273649] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc3-00061-g6966bb921def #1
[ 30.274670] Call Trace:
[ 30.274984] dump_stack (kbuild/src/consumer/include/linux/instrumented.h:86 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:45 kbuild/src/consumer/lib/dump_stack.c:123)
[ 30.275413] ? blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83)
[ 30.275929] kasan_report (kbuild/src/consumer/mm/kasan/report.c:423 kbuild/src/consumer/mm/kasan/report.c:436)
[ 30.275973] ? blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83)
[ 30.275973] kasan_check_range (kbuild/src/consumer/mm/kasan/generic.c:135 kbuild/src/consumer/mm/kasan/generic.c:186)
[ 30.275973] blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83)
[ 30.275973] blk_queue_write_cache (kbuild/src/consumer/block/blk-settings.c:795)
[ 30.275973] add_mtd_blktrans_dev (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:411)
[ 30.275973] mtdblock_add_mtd (kbuild/src/consumer/drivers/mtd/mtdblock.c:325)
[ 30.275973] blktrans_notify_add (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:508)
[ 30.275973] add_mtd_device (kbuild/src/consumer/drivers/mtd/mtdcore.c:688)
[ 30.275973] ? mtd_cls_resume (kbuild/src/consumer/drivers/mtd/mtdcore.c:520)
[ 30.275973] mtd_device_parse_register (kbuild/src/consumer/drivers/mtd/mtdcore.c:818)
[ 30.275973] mtdram_init_device (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:146)
[ 30.275973] init_mtdram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:172)
[ 30.275973] do_one_initcall (kbuild/src/consumer/init/main.c:1249)
[ 30.275973] ? init_phram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:153)
[ 30.275973] do_initcall_level (kbuild/src/consumer/init/main.c:1321)
[ 30.275973] ? kernel_init (kbuild/src/consumer/init/main.c:1449)
[ 30.275973] do_initcalls (kbuild/src/consumer/init/main.c:1335)
[ 30.275973] kernel_init_freeable (kbuild/src/consumer/init/main.c:1564)
[ 30.275973] ? rest_init (kbuild/src/consumer/init/main.c:1444)
[ 30.275973] kernel_init (kbuild/src/consumer/init/main.c:1449)
[ 30.275973] ? rest_init (kbuild/src/consumer/init/main.c:1444)
[ 30.275973] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300)
[ 30.275973] ==================================================================
[ 30.275973] Disabling lock debugging due to kernel taint
[ 30.288063] BUG: kernel NULL pointer dereference, address: 0000000000000068
[ 30.288891] #PF: supervisor write access in kernel mode
[ 30.289475] #PF: error_code(0x0002) - not-present page
[ 30.290056] PGD 0 P4D 0
[ 30.290367] Oops: 0002 [#1] PREEMPT SMP KASAN PTI
[ 30.290894] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.13.0-rc3-00061-g6966bb921def #1
[ 30.291980] RIP: 0010:blk_queue_flag_set (kbuild/src/consumer/arch/x86/include/asm/bitops.h:60 kbuild/src/consumer/include/asm-generic/bitops/instrumented-atomic.h:29 kbuild/src/consumer/block/blk-core.c:83)
[ 30.292537] Code: 00 00 00 00 66 0f 1f 44 00 00 55 53 48 89 f3 89 fd 89 f8 c1 e8 06 48 8d 3c c6 48 83 c7 68 be 08 00 00 00 e8 c2 13 02 ff 89 e8 <f0> 48 0f ab 43 68 5b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 66
All code
========
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
a: 55 push %rbp
b: 53 push %rbx
c: 48 89 f3 mov %rsi,%rbx
f: 89 fd mov %edi,%ebp
11: 89 f8 mov %edi,%eax
13: c1 e8 06 shr $0x6,%eax
16: 48 8d 3c c6 lea (%rsi,%rax,8),%rdi
1a: 48 83 c7 68 add $0x68,%rdi
1e: be 08 00 00 00 mov $0x8,%esi
23: e8 c2 13 02 ff callq 0xffffffffff0213ea
28: 89 e8 mov %ebp,%eax
2a:* f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) <-- trapping instruction
30: 5b pop %rbx
31: 5d pop %rbp
32: c3 retq
33: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
3a: 00 00 00 00
3e: 66 data16
3f: 66 data16
Code starting with the faulting instruction
===========================================
0: f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx)
6: 5b pop %rbx
7: 5d pop %rbp
8: c3 retq
9: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
10: 00 00 00 00
14: 66 data16
15: 66 data16
[ 30.294477] RSP: 0000:ffff8881001f7a38 EFLAGS: 00010246
[ 30.295091] RAX: 0000000000000011 RBX: 0000000000000000 RCX: ffffffff957262bf
[ 30.295903] RDX: aaaaaaaaaaaaaaaa RSI: 0000000000000004 RDI: ffffffff99a4cead
[ 30.296511] RBP: 0000000000000011 R08: dffffc0000000000 R09: fffffbfff38883de
[ 30.297177] R10: fffffbfff38883de R11: 1ffffffff38883dd R12: ffff88816e57e800
[ 30.297667] R13: 1ffff1102dcafd18 R14: 1ffffffff37bc9b6 R15: ffffffff9bde4db0
[ 30.297974] FS: 0000000000000000(0000) GS:ffff8883ae600000(0000) knlGS:0000000000000000
[ 30.297974] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 30.297974] CR2: 0000000000000068 CR3: 000000009e09c000 CR4: 00000000000406f0
[ 30.297974] Call Trace:
[ 30.297974] blk_queue_write_cache (kbuild/src/consumer/block/blk-settings.c:795)
[ 30.297974] add_mtd_blktrans_dev (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:411)
[ 30.297974] mtdblock_add_mtd (kbuild/src/consumer/drivers/mtd/mtdblock.c:325)
[ 30.297974] blktrans_notify_add (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:508)
[ 30.297974] add_mtd_device (kbuild/src/consumer/drivers/mtd/mtdcore.c:688)
[ 30.297974] ? mtd_cls_resume (kbuild/src/consumer/drivers/mtd/mtdcore.c:520)
[ 30.297974] mtd_device_parse_register (kbuild/src/consumer/drivers/mtd/mtdcore.c:818)
[ 30.297974] mtdram_init_device (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:146)
[ 30.297974] init_mtdram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:172)
[ 30.297974] do_one_initcall (kbuild/src/consumer/init/main.c:1249)
[ 30.297974] ? init_phram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:153)
[ 30.297974] do_initcall_level (kbuild/src/consumer/init/main.c:1321)
[ 30.297974] ? kernel_init (kbuild/src/consumer/init/main.c:1449)
[ 30.297974] do_initcalls (kbuild/src/consumer/init/main.c:1335)
[ 30.297974] kernel_init_freeable (kbuild/src/consumer/init/main.c:1564)
[ 30.297974] ? rest_init (kbuild/src/consumer/init/main.c:1444)
[ 30.297974] kernel_init (kbuild/src/consumer/init/main.c:1449)
[ 30.297974] ? rest_init (kbuild/src/consumer/init/main.c:1444)
[ 30.297974] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300)
[ 30.297974] Modules linked in:
[ 30.297974] CR2: 0000000000000068
[ 30.297974] ---[ end trace 44cc99e211d747b3 ]---
[ 30.297974] RIP: 0010:blk_queue_flag_set (kbuild/src/consumer/arch/x86/include/asm/bitops.h:60 kbuild/src/consumer/include/asm-generic/bitops/instrumented-atomic.h:29 kbuild/src/consumer/block/blk-core.c:83)
[ 30.297974] Code: 00 00 00 00 66 0f 1f 44 00 00 55 53 48 89 f3 89 fd 89 f8 c1 e8 06 48 8d 3c c6 48 83 c7 68 be 08 00 00 00 e8 c2 13 02 ff 89 e8 <f0> 48 0f ab 43 68 5b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 66
All code
========
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
a: 55 push %rbp
b: 53 push %rbx
c: 48 89 f3 mov %rsi,%rbx
f: 89 fd mov %edi,%ebp
11: 89 f8 mov %edi,%eax
13: c1 e8 06 shr $0x6,%eax
16: 48 8d 3c c6 lea (%rsi,%rax,8),%rdi
1a: 48 83 c7 68 add $0x68,%rdi
1e: be 08 00 00 00 mov $0x8,%esi
23: e8 c2 13 02 ff callq 0xffffffffff0213ea
28: 89 e8 mov %ebp,%eax
2a:* f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) <-- trapping instruction
30: 5b pop %rbx
31: 5d pop %rbp
32: c3 retq
33: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
3a: 00 00 00 00
3e: 66 data16
3f: 66 data16
Code starting with the faulting instruction
===========================================
0: f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx)
6: 5b pop %rbx
7: 5d pop %rbp
8: c3 retq
9: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
10: 00 00 00 00
14: 66 data16
15: 66 data16
To reproduce:
# build kernel
cd linux
cp config-5.13.0-rc3-00061-g6966bb921def .config
make HOSTCC=clang-13 CC=clang-13 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.13.0-rc3-00061-g6966bb921def" of type "text/plain" (160786 bytes)
View attachment "job-script" of type "text/plain" (4473 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (11708 bytes)
Powered by blists - more mailing lists