| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20210824140044.GA27667@xsang-OptiPlex-9020>
Date: Tue, 24 Aug 2021 22:00:44 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Ingo Molnar <mingo@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
lkp@...ts.01.org, lkp@...el.com
Subject: [locking/ww_mutex] c0afb0ffc0:
BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: c0afb0ffc06e6b4e492a3b711f1fb32074f9949c ("locking/ww_mutex: Gather mutex_waiter initialization")
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git locking/debug
in testcase: rcutorture
version:
with following parameters:
runtime: 300s
test: cpuhotplug
torture_type: rcu
test-description: rcutorture is rcutorture kernel module load/unload test.
test-url: https://www.kernel.org/doc/Documentation/RCU/torture.txt
on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | cf702eddcd | c0afb0ffc0 |
+---------------------------------------------+------------+------------+
| boot_successes | 12 | 0 |
| boot_failures | 0 | 18 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 18 |
| Oops:#[##] | 0 | 18 |
| EIP:__ww_mutex_die | 0 | 18 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 18 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 14.660320][ T115] BUG: kernel NULL pointer dereference, address: 00000508
[ 14.660868][ T115] #PF: supervisor read access in kernel mode
[ 14.660868][ T115] #PF: error_code(0x0000) - not-present page
[ 14.660868][ T115] *pde = 00000000
[ 14.660868][ T115] Oops: 0000 [#1] SMP
[ 14.660868][ T115] CPU: 0 PID: 115 Comm: kworker/u4:1 Not tainted 5.14.0-rc6-00055-gc0afb0ffc06e #1
[ 14.660868][ T115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 14.660868][ T115] Workqueue: test-ww_mutex stress_inorder_work
[ 14.660868][ T115] EIP: __ww_mutex_die (kernel/locking/mutex.c:368)
[ 14.660868][ T115] Code: b5 00 5d c3 8d 74 26 00 3e 8d 74 26 00 66 83 79 0e 00 74 3c 55 89 e5 53 53 83 05 e8 97 df b5 01 83 15 ec 97 df b5 00 8b 5a 0c <83> 7b 08 00 74 18 83 05 f0 97 df b5 01 83 15 f4 97 df b5 00 8b 5b
All code
========
0: b5 00 mov $0x0,%ch
2: 5d pop %rbp
3: c3 retq
4: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
8: 3e 8d 74 26 00 lea %ds:0x0(%rsi,%riz,1),%esi
d: 66 83 79 0e 00 cmpw $0x0,0xe(%rcx)
12: 74 3c je 0x50
14: 55 push %rbp
15: 89 e5 mov %esp,%ebp
17: 53 push %rbx
18: 53 push %rbx
19: 83 05 e8 97 df b5 01 addl $0x1,-0x4a206818(%rip) # 0xffffffffb5df9808
20: 83 15 ec 97 df b5 00 adcl $0x0,-0x4a206814(%rip) # 0xffffffffb5df9813
27: 8b 5a 0c mov 0xc(%rdx),%ebx
2a:* 83 7b 08 00 cmpl $0x0,0x8(%rbx) <-- trapping instruction
2e: 74 18 je 0x48
30: 83 05 f0 97 df b5 01 addl $0x1,-0x4a206810(%rip) # 0xffffffffb5df9827
37: 83 15 f4 97 df b5 00 adcl $0x0,-0x4a20680c(%rip) # 0xffffffffb5df9832
3e: 8b .byte 0x8b
3f: 5b pop %rbx
Code starting with the faulting instruction
===========================================
0: 83 7b 08 00 cmpl $0x0,0x8(%rbx)
4: 74 18 je 0x1e
6: 83 05 f0 97 df b5 01 addl $0x1,-0x4a206810(%rip) # 0xffffffffb5df97fd
d: 83 15 f4 97 df b5 00 adcl $0x0,-0x4a20680c(%rip) # 0xffffffffb5df9808
14: 8b .byte 0x8b
15: 5b pop %rbx
[ 14.660868][ T115] EAX: bb6469bc EBX: 00000500 ECX: b7fe5ed4 EDX: b7f49ed0
[ 14.660868][ T115] ESI: bb6469bc EDI: b7fe5ed4 EBP: b7fe5e40 ESP: b7fe5e38
[ 14.660868][ T115] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010246
[ 14.660868][ T115] CR0: 80050033 CR2: 00000508 CR3: 05d59000 CR4: 000406d0
[ 14.660868][ T115] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 14.660868][ T115] DR6: fffe0ff0 DR7: 00000400
[ 14.660868][ T115] Call Trace:
[ 14.660868][ T115] __ww_mutex_check_waiters (kernel/locking/mutex.c:449)
[ 14.660868][ T115] __ww_mutex_lock+0x179f/0x2000
[ 14.660868][ T115] ? stress_inorder_work (kernel/locking/test-ww_mutex.c:402)
[ 14.660868][ T115] ? __might_sleep (kernel/sched/core.c:9163 (discriminator 14))
[ 14.660868][ T115] ww_mutex_lock (kernel/locking/mutex.c:1180)
[ 14.660868][ T115] stress_inorder_work (kernel/locking/test-ww_mutex.c:402)
[ 14.660868][ T115] process_one_work (kernel/workqueue.c:2276)
[ 14.660868][ T115] ? process_one_work (include/linux/workqueue.h:212 kernel/workqueue.c:617 kernel/workqueue.c:644 kernel/workqueue.c:2247)
[ 14.660868][ T115] worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)
[ 14.660868][ T115] kthread (kernel/kthread.c:319)
[ 14.660868][ T115] ? rescuer_thread (kernel/workqueue.c:2365)
[ 14.660868][ T115] ? set_kthread_struct (kernel/kthread.c:272)
[ 14.660868][ T115] ret_from_fork (arch/x86/entry/entry_32.S:775)
[ 14.660868][ T115] Modules linked in:
[ 14.660868][ T115] CR2: 0000000000000508
[ 14.660868][ T115] ---[ end trace 8cc515b27a440bb1 ]---
[ 14.660868][ T115] EIP: __ww_mutex_die (kernel/locking/mutex.c:368)
[ 14.660868][ T115] Code: b5 00 5d c3 8d 74 26 00 3e 8d 74 26 00 66 83 79 0e 00 74 3c 55 89 e5 53 53 83 05 e8 97 df b5 01 83 15 ec 97 df b5 00 8b 5a 0c <83> 7b 08 00 74 18 83 05 f0 97 df b5 01 83 15 f4 97 df b5 00 8b 5b
All code
========
0: b5 00 mov $0x0,%ch
2: 5d pop %rbp
3: c3 retq
4: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
8: 3e 8d 74 26 00 lea %ds:0x0(%rsi,%riz,1),%esi
d: 66 83 79 0e 00 cmpw $0x0,0xe(%rcx)
12: 74 3c je 0x50
14: 55 push %rbp
15: 89 e5 mov %esp,%ebp
17: 53 push %rbx
18: 53 push %rbx
19: 83 05 e8 97 df b5 01 addl $0x1,-0x4a206818(%rip) # 0xffffffffb5df9808
20: 83 15 ec 97 df b5 00 adcl $0x0,-0x4a206814(%rip) # 0xffffffffb5df9813
27: 8b 5a 0c mov 0xc(%rdx),%ebx
2a:* 83 7b 08 00 cmpl $0x0,0x8(%rbx) <-- trapping instruction
2e: 74 18 je 0x48
30: 83 05 f0 97 df b5 01 addl $0x1,-0x4a206810(%rip) # 0xffffffffb5df9827
37: 83 15 f4 97 df b5 00 adcl $0x0,-0x4a20680c(%rip) # 0xffffffffb5df9832
3e: 8b .byte 0x8b
3f: 5b pop %rbx
Code starting with the faulting instruction
===========================================
0: 83 7b 08 00 cmpl $0x0,0x8(%rbx)
4: 74 18 je 0x1e
6: 83 05 f0 97 df b5 01 addl $0x1,-0x4a206810(%rip) # 0xffffffffb5df97fd
d: 83 15 f4 97 df b5 00 adcl $0x0,-0x4a20680c(%rip) # 0xffffffffb5df9808
14: 8b .byte 0x8b
15: 5b pop %rbx
To reproduce:
# build kernel
cd linux
cp config-5.14.0-rc6-00055-gc0afb0ffc06e .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.14.0-rc6-00055-gc0afb0ffc06e" of type "text/plain" (172143 bytes)
View attachment "job-script" of type "text/plain" (4528 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (9456 bytes)
Powered by blists - more mailing lists