| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 24 Feb 2022 23:23:34 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Ansuel Smith <ansuelsmth@...il.com>
Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
lkp@...ts.01.org, Miquel Raynal <miquel.raynal@...tlin.com>,
Richard Weinberger <richard@....at>,
Vignesh Raghavendra <vigneshr@...com>,
Rob Herring <robh+dt@...nel.org>,
Ansuel Smith <ansuelsmth@...il.com>,
linux-mtd@...ts.infradead.org, devicetree@...r.kernel.org
Subject: [mtd] 8d892a300a: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 8d892a300af5d531ed5af5684706bab1146db33b ("[RFC RFT PATCH v2 2/2] mtd: core: introduce of support for dynamic partitions")
url: https://github.com/0day-ci/linux/commits/Ansuel-Smith/Add-nvmem-support-for-dynamic-partitions/20220221-014154
base: https://git.kernel.org/cgit/linux/kernel/git/mtd/linux.git mtd/next
patch link: https://lore.kernel.org/linux-mtd/20220220173905.14165-3-ansuelsmth@gmail.com
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 2.362523][ T1] BUG: kernel NULL pointer dereference, address: 000003a8
[ 2.362925][ T1] #PF: supervisor read access in kernel mode
[ 2.362925][ T1] #PF: error_code(0x0000) - not-present page
[ 2.362925][ T1] *pde = 00000000
[ 2.362925][ T1] Oops: 0000 [#1]
[ 2.362925][ T1] CPU: 0 PID: 1 Comm: swapper Not tainted 5.17.0-rc1-00042-g8d892a300af5 #1
[ 2.362925][ T1] EIP: mtd_check_of_node (include/linux/device.h:794 drivers/mtd/mtdcore.c:595)
[ 2.362925][ T1] Code: c6 53 83 ec 08 3d 08 ff ff ff 74 0d 83 b8 a8 03 00 00 00 0f 85 a0 00 00 00 8b 86 24 04 00 00 3d 08 ff ff ff 0f 84 8f 00 00 00 <8b> b8 a8 03 00 00 85 ff 0f 84 81 00 00 00 ba 2b cc 38 42 89 f8 e8
All code
========
0: c6 (bad)
1: 53 push %rbx
2: 83 ec 08 sub $0x8,%esp
5: 3d 08 ff ff ff cmp $0xffffff08,%eax
a: 74 0d je 0x19
c: 83 b8 a8 03 00 00 00 cmpl $0x0,0x3a8(%rax)
13: 0f 85 a0 00 00 00 jne 0xb9
19: 8b 86 24 04 00 00 mov 0x424(%rsi),%eax
1f: 3d 08 ff ff ff cmp $0xffffff08,%eax
24: 0f 84 8f 00 00 00 je 0xb9
2a:* 8b b8 a8 03 00 00 mov 0x3a8(%rax),%edi <-- trapping instruction
30: 85 ff test %edi,%edi
32: 0f 84 81 00 00 00 je 0xb9
38: ba 2b cc 38 42 mov $0x4238cc2b,%edx
3d: 89 f8 mov %edi,%eax
3f: e8 .byte 0xe8
Code starting with the faulting instruction
===========================================
0: 8b b8 a8 03 00 00 mov 0x3a8(%rax),%edi
6: 85 ff test %edi,%edi
8: 0f 84 81 00 00 00 je 0x8f
e: ba 2b cc 38 42 mov $0x4238cc2b,%edx
13: 89 f8 mov %edi,%eax
15: e8 .byte 0xe8
[ 2.362925][ T1] EAX: 00000000 EBX: 44e20800 ECX: 00000000 EDX: 00000000
[ 2.362925][ T1] ESI: 44e20800 EDI: 00000001 EBP: 403a5e44 ESP: 403a5e30
[ 2.362925][ T1] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010213
[ 2.362925][ T1] CR0: 80050033 CR2: 000003a8 CR3: 02d0c000 CR4: 000406d0
[ 2.362925][ T1] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 2.362925][ T1] DR6: fffe0ff0 DR7: 00000400
[ 2.362925][ T1] Call Trace:
[ 2.362925][ T1] ? add_mtd_device (include/linux/device.h:793 include/linux/mtd/mtd.h:469 drivers/mtd/mtdcore.c:731)
[ 2.362925][ T1] ? lockdep_init_map_type (kernel/locking/lockdep.c:4810)
[ 2.362925][ T1] ? debug_mutex_init (kernel/locking/mutex-debug.c:89)
[ 2.362925][ T1] ? __mutex_init (kernel/locking/mutex.c:53)
[ 2.362925][ T1] ? mtd_device_parse_register (drivers/mtd/mtdcore.c:1027)
[ 2.362925][ T1] ? mtdram_init_device (drivers/mtd/devices/mtdram.c:146)
[ 2.362925][ T1] ? init_mtdram (drivers/mtd/devices/mtdram.c:171)
[ 2.362925][ T1] ? init_pmc551 (drivers/mtd/devices/mtdram.c:153)
[ 2.362925][ T1] ? do_one_initcall (init/main.c:1300)
[ 2.362925][ T1] ? parse_args (kernel/params.c:131 kernel/params.c:188)
[ 2.362925][ T1] ? do_basic_setup (init/main.c:1372 init/main.c:1389 init/main.c:1408)
[ 2.362925][ T1] ? kernel_init_freeable (init/main.c:1615)
[ 2.362925][ T1] ? rest_init (init/main.c:1494)
[ 2.362925][ T1] ? kernel_init (init/main.c:1504)
[ 2.362925][ T1] ? ret_from_fork (arch/x86/entry/entry_32.S:772)
[ 2.362925][ T1] Modules linked in:
[ 2.362925][ T1] CR2: 00000000000003a8
[ 2.362925][ T1] ---[ end trace 0000000000000000 ]---
[ 2.362925][ T1] EIP: mtd_check_of_node (include/linux/device.h:794 drivers/mtd/mtdcore.c:595)
[ 2.362925][ T1] Code: c6 53 83 ec 08 3d 08 ff ff ff 74 0d 83 b8 a8 03 00 00 00 0f 85 a0 00 00 00 8b 86 24 04 00 00 3d 08 ff ff ff 0f 84 8f 00 00 00 <8b> b8 a8 03 00 00 85 ff 0f 84 81 00 00 00 ba 2b cc 38 42 89 f8 e8
All code
========
0: c6 (bad)
1: 53 push %rbx
2: 83 ec 08 sub $0x8,%esp
5: 3d 08 ff ff ff cmp $0xffffff08,%eax
a: 74 0d je 0x19
c: 83 b8 a8 03 00 00 00 cmpl $0x0,0x3a8(%rax)
13: 0f 85 a0 00 00 00 jne 0xb9
19: 8b 86 24 04 00 00 mov 0x424(%rsi),%eax
1f: 3d 08 ff ff ff cmp $0xffffff08,%eax
24: 0f 84 8f 00 00 00 je 0xb9
2a:* 8b b8 a8 03 00 00 mov 0x3a8(%rax),%edi <-- trapping instruction
30: 85 ff test %edi,%edi
32: 0f 84 81 00 00 00 je 0xb9
38: ba 2b cc 38 42 mov $0x4238cc2b,%edx
3d: 89 f8 mov %edi,%eax
3f: e8 .byte 0xe8
Code starting with the faulting instruction
===========================================
0: 8b b8 a8 03 00 00 mov 0x3a8(%rax),%edi
6: 85 ff test %edi,%edi
8: 0f 84 81 00 00 00 je 0x8f
e: ba 2b cc 38 42 mov $0x4238cc2b,%edx
13: 89 f8 mov %edi,%eax
15: e8 .byte 0xe8
To reproduce:
# build kernel
cd linux
cp config-5.17.0-rc1-00042-g8d892a300af5 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.17.0-rc1-00042-g8d892a300af5" of type "text/plain" (154031 bytes)
View attachment "job-script" of type "text/plain" (4773 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (11312 bytes)
Powered by blists - more mailing lists