| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 30 Nov 2021 21:40:37 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Stefan Roesch <shr@...com>
Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
lkp@...ts.01.org, io-uring@...r.kernel.org,
linux-fsdevel@...r.kernel.org, shr@...com
Subject: [fs] 23a831cdec: WARNING:at_include/linux/thread_info.h:#do_getxattr
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 23a831cdecdff03c5a70316f516be2f072e7356d ("[PATCH v1 3/5] fs: split off the vfs_getxattr from getxattr")
url: https://github.com/0day-ci/linux/commits/Stefan-Roesch/io_uring-add-xattr-support/20211130-061448
patch link: https://lore.kernel.org/io-uring/20211129221257.2536146-4-shr@fb.com
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-----------------------------------------------------+------------+------------+
| | f42638af1a | 23a831cdec |
+-----------------------------------------------------+------------+------------+
| boot_successes | 7 | 0 |
| boot_failures | 0 | 7 |
| WARNING:at_include/linux/thread_info.h:#do_getxattr | 0 | 7 |
| EIP:do_getxattr | 0 | 7 |
+-----------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 48.539269][ T175] WARNING: CPU: 0 PID: 175 at include/linux/thread_info.h:216 do_getxattr (include/linux/thread_info.h:216 include/linux/uaccess.h:199 fs/xattr.c:689)
[ 48.540381][ T175] Modules linked in:
[ 48.540785][ T175] CPU: 0 PID: 175 Comm: systemd-tmpfile Not tainted 5.16.0-rc3-00093-g23a831cdecdf #1
[ 48.541790][ T175] EIP: do_getxattr (include/linux/thread_info.h:216 include/linux/uaccess.h:199 fs/xattr.c:689)
[ 48.542321][ T175] Code: ff ff 0f 45 f8 eb a8 8d 76 00 8b 45 f0 ba fb 5d 0c c2 e8 8b 65 14 00 85 c0 74 c0 eb ca bf f4 ff ff ff eb 92 8d b6 00 00 00 00 <0f> 0b bf f2 ff ff ff e9 79 ff ff ff 8d b4 26 00 00 00 00 8d 74 26
All code
========
0: ff (bad)
1: ff 0f decl (%rdi)
3: 45 f8 rex.RB clc
5: eb a8 jmp 0xffffffffffffffaf
7: 8d 76 00 lea 0x0(%rsi),%esi
a: 8b 45 f0 mov -0x10(%rbp),%eax
d: ba fb 5d 0c c2 mov $0xc20c5dfb,%edx
12: e8 8b 65 14 00 callq 0x1465a2
17: 85 c0 test %eax,%eax
19: 74 c0 je 0xffffffffffffffdb
1b: eb ca jmp 0xffffffffffffffe7
1d: bf f4 ff ff ff mov $0xfffffff4,%edi
22: eb 92 jmp 0xffffffffffffffb6
24: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
2a:* 0f 0b ud2 <-- trapping instruction
2c: bf f2 ff ff ff mov $0xfffffff2,%edi
31: e9 79 ff ff ff jmpq 0xffffffffffffffaf
36: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
3d: 8d .byte 0x8d
3e: 74 26 je 0x66
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: bf f2 ff ff ff mov $0xfffffff2,%edi
7: e9 79 ff ff ff jmpq 0xffffffffffffff85
c: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
13: 8d .byte 0x8d
14: 74 26 je 0x3c
[ 48.544484][ T175] EAX: c2221740 EBX: 00000084 ECX: ffffffa1 EDX: eff39900
[ 48.545385][ T175] ESI: eff39900 EDI: ffffffa1 EBP: f5453d9c ESP: f5453d88
[ 48.546305][ T175] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010282
[ 48.547289][ T175] CR0: 80050033 CR2: b7e0e1b0 CR3: 2ff11000 CR4: 00040690
[ 48.548217][ T175] Call Trace:
[ 48.548641][ T175] getxattr (fs/xattr.c:715)
[ 48.549219][ T175] ? mntput (fs/namespace.c:1235)
[ 48.549808][ T175] ? terminate_walk (fs/namei.c:677)
[ 48.550404][ T175] ? path_lookupat+0x6f/0x110
[ 48.551075][ T175] ? filename_lookup (fs/namei.c:2489)
[ 48.551715][ T175] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67)
[ 48.552403][ T175] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67)
[ 48.553145][ T175] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4356)
[ 48.553702][ T175] ? kmem_cache_free (mm/slab.c:3742 (discriminator 1))
[ 48.554328][ T175] ? putname (fs/namei.c:271)
[ 48.554761][ T175] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:51 (discriminator 22))
[ 48.555364][ T175] ? putname (fs/namei.c:271)
[ 48.555823][ T175] ? putname (fs/namei.c:271)
[ 48.556339][ T175] path_getxattr (fs/xattr.c:728)
[ 48.556824][ T175] __ia32_sys_getxattr (fs/xattr.c:737)
[ 48.557425][ T175] __do_fast_syscall_32 (arch/x86/entry/common.c:112 arch/x86/entry/common.c:178)
[ 48.558024][ T175] ? sched_clock (arch/x86/kernel/tsc.c:254)
[ 48.558549][ T175] ? sched_clock_cpu (kernel/sched/clock.c:371)
[ 48.559316][ T175] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67)
[ 48.559975][ T175] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67)
[ 48.560682][ T175] ? __this_cpu_preempt_check (lib/smp_processor_id.c:67)
[ 48.561337][ T175] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4356)
[ 48.561964][ T175] ? irqentry_exit_to_user_mode (kernel/entry/common.c:316)
[ 48.562723][ T175] do_fast_syscall_32 (arch/x86/entry/common.c:203)
[ 48.563296][ T175] do_SYSENTER_32 (arch/x86/entry/common.c:247)
[ 48.563781][ T175] entry_SYSENTER_32 (arch/x86/entry/entry_32.S:872)
[ 48.564372][ T175] EIP: 0xb7f8f549
[ 48.564790][ T175] Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
All code
========
0: 03 74 c0 01 add 0x1(%rax,%rax,8),%esi
4: 10 05 03 74 b8 01 adc %al,0x1b87403(%rip) # 0x1b8740d
a: 10 06 adc %al,(%rsi)
c: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
10: 10 07 adc %al,(%rdi)
12: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
16: 10 08 adc %cl,(%rax)
18: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1c: 00 00 add %al,(%rax)
1e: 00 00 add %al,(%rax)
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
2a:* 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d 76 00 lea 0x0(%rsi),%esi
35: 58 pop %rax
36: b8 77 00 00 00 mov $0x77,%eax
3b: cd 80 int $0x80
3d: 90 nop
3e: 8d .byte 0x8d
3f: 76 .byte 0x76
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 retq
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 8d 76 00 lea 0x0(%rsi),%esi
b: 58 pop %rax
c: b8 77 00 00 00 mov $0x77,%eax
11: cd 80 int $0x80
13: 90 nop
14: 8d .byte 0x8d
15: 76 .byte 0x76
To reproduce:
# build kernel
cd linux
cp config-5.16.0-rc3-00093-g23a831cdecdf .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.16.0-rc3-00093-g23a831cdecdf" of type "text/plain" (135496 bytes)
View attachment "job-script" of type "text/plain" (4834 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (15136 bytes)
Powered by blists - more mailing lists