| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 14 Oct 2021 14:25:15 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Alexey Gladkov <legion@...nel.org>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>,
kernel test robot <oliver.sang@...el.com>,
kernel test robot <lkp@...el.com>,
LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org
Subject: d7c9e99aee: WARNING:at_kernel/ucount.c:#dec_rlimit_ucounts
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: d7c9e99aee48e6bc0b427f3e3c658a6aba15001e ("Reimplement RLIMIT_MEMLOCK on top of ucounts")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
in testcase: trinity
version: trinity-i386-4d2343bd-1_20200320
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-------------------------------------------------------------+------------+------------+
| | d646969055 | d7c9e99aee |
+-------------------------------------------------------------+------------+------------+
| BUG:kernel_NULL_pointer_dereference,address | 0 | 55 |
| Oops:#[##] | 0 | 62 |
| EIP:dec_rlimit_ucounts | 0 | 64 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 62 |
| WARNING:at_kernel/ucount.c:#dec_rlimit_ucounts | 0 | 16 |
+-------------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 110.857468][ T857] WARNING: CPU: 0 PID: 857 at kernel/ucount.c:269 dec_rlimit_ucounts (kernel/ucount.c:269 (discriminator 1))
[ 110.858412][ T857] Modules linked in:
[ 110.858848][ T857] CPU: 0 PID: 857 Comm: trinity-c2 Tainted: G W 5.12.0-00007-gd7c9e99aee48 #1
[ 110.859937][ T857] EIP: dec_rlimit_ucounts (kernel/ucount.c:269 (discriminator 1))
[ 110.860493][ T857] Code: 3b 29 ca 78 25 39 d8 0f 44 f2 8b 53 08 8b 9a b4 01 00 00 85 db 75 e3 5a 85 f6 0f 94 c0 5b 5e 5f 5d c3 8d b4 26 00 00 00 00 90 <0f> 0b eb d7 8d 74 26 00 85 f6 0f 94 c0 c3 66 90 55 89 e5 57 56 89
All code
========
0: 3b 29 cmp (%rcx),%ebp
2: ca 78 25 lret $0x2578
5: 39 d8 cmp %ebx,%eax
7: 0f 44 f2 cmove %edx,%esi
a: 8b 53 08 mov 0x8(%rbx),%edx
d: 8b 9a b4 01 00 00 mov 0x1b4(%rdx),%ebx
13: 85 db test %ebx,%ebx
15: 75 e3 jne 0xfffffffffffffffa
17: 5a pop %rdx
18: 85 f6 test %esi,%esi
1a: 0f 94 c0 sete %al
1d: 5b pop %rbx
1e: 5e pop %rsi
1f: 5f pop %rdi
20: 5d pop %rbp
21: c3 retq
22: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
29: 90 nop
2a:* 0f 0b ud2 <-- trapping instruction
2c: eb d7 jmp 0x5
2e: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
32: 85 f6 test %esi,%esi
34: 0f 94 c0 sete %al
37: c3 retq
38: 66 90 xchg %ax,%ax
3a: 55 push %rbp
3b: 89 e5 mov %esp,%ebp
3d: 57 push %rdi
3e: 56 push %rsi
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: eb d7 jmp 0xffffffffffffffdb
4: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
8: 85 f6 test %esi,%esi
a: 0f 94 c0 sete %al
d: c3 retq
e: 66 90 xchg %ax,%ax
10: 55 push %rbp
11: 89 e5 mov %esp,%ebp
13: 57 push %rdi
14: 56 push %rsi
15: 89 .byte 0x89
[ 110.862416][ T857] EAX: f338c408 EBX: ef4b1bd0 ECX: 00000001 EDX: 9e08001b
[ 110.863153][ T857] ESI: 00000000 EDI: 00000048 EBP: f33f7e80 ESP: f33f7e70
[ 110.863887][ T857] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068 EFLAGS: 00010286
[ 110.864670][ T857] CR0: 80050033 CR2: 000000ff CR3: 333be000 CR4: 00040690
[ 110.865415][ T857] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 110.866160][ T857] DR6: fffe0ff0 DR7: 00000400
[ 110.866620][ T857] Call Trace:
[ 110.866945][ T857] user_shm_unlock (include/linux/spinlock.h:394 mm/mlock.c:852)
[ 110.867559][ T857] shmem_lock (mm/shmem.c:2249)
[ 110.867988][ T857] ksys_shmctl (ipc/shm.c:1122 ipc/shm.c:1187)
[ 110.868438][ T857] ? ksys_shmctl (arch/x86/include/asm/preempt.h:80 include/linux/rcupdate.h:68 include/linux/rcupdate.h:654 ipc/shm.c:1069 ipc/shm.c:1187)
[ 110.868920][ T857] ? __lock_acquire (kernel/locking/lockdep.c:4901)
[ 110.869436][ T857] ? kvm_sched_clock_read (arch/x86/include/asm/preempt.h:85 arch/x86/kernel/kvmclock.c:90 arch/x86/kernel/kvmclock.c:101)
[ 110.870020][ T857] ? sched_clock (arch/x86/include/asm/paravirt.h:22 arch/x86/kernel/tsc.c:252)
[ 110.870565][ T857] ? sched_clock_cpu (kernel/sched/clock.c:371)
[ 110.871238][ T857] ? find_held_lock (kernel/locking/lockdep.c:5004)
[ 110.871763][ T857] ? rcu_read_lock_sched_held (kernel/rcu/update.c:125)
[ 110.872352][ T857] ? syscall_trace_enter+0xff/0x1c0
[ 110.872927][ T857] __ia32_sys_shmctl (ipc/shm.c:1193)
[ 110.873427][ T857] __do_fast_syscall_32 (arch/x86/entry/common.c:77 arch/x86/entry/common.c:140)
[ 110.873963][ T857] do_fast_syscall_32 (arch/x86/entry/common.c:165)
[ 110.874492][ T857] do_SYSENTER_32 (arch/x86/entry/common.c:209)
[ 110.874950][ T857] entry_SYSENTER_32 (arch/x86/entry/entry_32.S:953)
[ 110.875466][ T857] EIP: 0xb7ee9549
[ 110.875867][ T857] Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
All code
========
0: 03 74 c0 01 add 0x1(%rax,%rax,8),%esi
4: 10 05 03 74 b8 01 adc %al,0x1b87403(%rip) # 0x1b8740d
a: 10 06 adc %al,(%rsi)
c: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
10: 10 07 adc %al,(%rdi)
12: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
16: 10 08 adc %cl,(%rax)
18: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1c: 00 00 add %al,(%rax)
1e: 00 00 add %al,(%rax)
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
2a:* 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d 76 00 lea 0x0(%rsi),%esi
35: 58 pop %rax
36: b8 77 00 00 00 mov $0x77,%eax
3b: cd 80 int $0x80
3d: 90 nop
3e: 8d .byte 0x8d
3f: 76 .byte 0x76
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 retq
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 8d 76 00 lea 0x0(%rsi),%esi
b: 58 pop %rax
c: b8 77 00 00 00 mov $0x77,%eax
11: cd 80 int $0x80
13: 90 nop
14: 8d .byte 0x8d
15: 76 .byte 0x76
To reproduce:
# build kernel
cd linux
cp config-5.12.0-00007-gd7c9e99aee48 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.12.0-00007-gd7c9e99aee48" of type "text/plain" (138255 bytes)
View attachment "job-script" of type "text/plain" (4296 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (20004 bytes)
Powered by blists - more mailing lists