| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 28 Feb 2022 11:48:29 +0800
From: kernel test robot <oliver.sang@...el.com>
To: "Liam R. Howlett" <Liam.Howlett@...cle.com>
Cc: "Liam R. Howlett" <Liam.Howlett@...cle.com>,
Matthew Wilcox <willy@...radead.org>,
LKML <linux-kernel@...r.kernel.org>,
Linux Memory Management List <linux-mm@...ck.org>,
lkp@...ts.01.org, lkp@...el.com
Subject: [mm/mlock] 489b8e8c9a: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 489b8e8c9ac06aa59ba1a364802c19addbb04e49 ("mm/mlock: Use vma iterator and instead of vma linked list")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
in testcase: trinity
version: trinity-i386-4d2343bd-1_20200320
with following parameters:
runtime: 300s
group: group-01
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 42.001218][ T3974] BUG: kernel NULL pointer dereference, address: 00000000
[ 42.006507][ T3974] #PF: supervisor read access in kernel mode
[ 42.010965][ T3974] #PF: error_code(0x0000) - not-present page
[ 42.016000][ T3974] *pdpt = 0000000034ebc001 *pde = 0000000000000000
[ 42.020836][ T3974] Oops: 0000 [#1] SMP PTI
[ 42.024572][ T3974] CPU: 1 PID: 3974 Comm: trinity-c5 Tainted: G E 5.17.0-rc4-00060-g489b8e8c9ac0 #1
[ 42.030056][ T3974] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 42.035333][ T3974] EIP: mas_ascend (lib/maple_tree.c:339 lib/maple_tree.c:1081)
[ 42.039331][ T3974] Code: 7d f0 0f b6 4d f0 83 e1 01 80 f9 01 19 c9 83 e1 f8 83 c1 18 09 c8 89 c3 30 db b9 03 00 00 00 d3 ea 83 c8 04 88 56 1d 89 46 0c <8b> 1b 89 d8 83 e0 01 88 45 eb 0f 85 f1 00 00 00 89 da c6 45 f0 00
All code
========
0: 7d f0 jge 0xfffffffffffffff2
2: 0f b6 4d f0 movzbl -0x10(%rbp),%ecx
6: 83 e1 01 and $0x1,%ecx
9: 80 f9 01 cmp $0x1,%cl
c: 19 c9 sbb %ecx,%ecx
e: 83 e1 f8 and $0xfffffff8,%ecx
11: 83 c1 18 add $0x18,%ecx
14: 09 c8 or %ecx,%eax
16: 89 c3 mov %eax,%ebx
18: 30 db xor %bl,%bl
1a: b9 03 00 00 00 mov $0x3,%ecx
1f: d3 ea shr %cl,%edx
21: 83 c8 04 or $0x4,%eax
24: 88 56 1d mov %dl,0x1d(%rsi)
27: 89 46 0c mov %eax,0xc(%rsi)
2a:* 8b 1b mov (%rbx),%ebx <-- trapping instruction
2c: 89 d8 mov %ebx,%eax
2e: 83 e0 01 and $0x1,%eax
31: 88 45 eb mov %al,-0x15(%rbp)
34: 0f 85 f1 00 00 00 jne 0x12b
3a: 89 da mov %ebx,%edx
3c: c6 45 f0 00 movb $0x0,-0x10(%rbp)
Code starting with the faulting instruction
===========================================
0: 8b 1b mov (%rbx),%ebx
2: 89 d8 mov %ebx,%eax
4: 83 e0 01 and $0x1,%eax
7: 88 45 eb mov %al,-0x15(%rbp)
a: 0f 85 f1 00 00 00 jne 0x101
10: 89 da mov %ebx,%edx
12: c6 45 f0 00 movb $0x0,-0x10(%rbp)
[ 42.050537][ T3974] EAX: 00000004 EBX: 00000000 ECX: 00000002 EDX: 00000000
[ 42.055562][ T3974] ESI: f4e7bf48 EDI: f557cb44 EBP: f4e7bebc ESP: f4e7be90
[ 42.060657][ T3974] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202
[ 42.065813][ T3974] CR0: 80050033 CR2: 00000000 CR3: 34624000 CR4: 000006f0
[ 42.071013][ T3974] Call Trace:
[ 42.075378][ T3974] ? __cond_resched (kernel/sched/core.c:8192)
[ 42.080080][ T3974] ? munlock_vma_pages_range (mm/mlock.c:427)
[ 42.085038][ T3974] mas_next_node (lib/maple_tree.c:4462)
[ 42.089827][ T3974] mas_find (lib/maple_tree.c:4726 lib/maple_tree.c:5906)
[ 42.094269][ T3974] apply_mlockall_flags (mm/mlock.c:764)
[ 42.098791][ T3974] __do_sys_munlockall (mm/mlock.c:813)
[ 42.103039][ T3974] __do_fast_syscall_32 (arch/x86/entry/common.c:112 arch/x86/entry/common.c:178)
[ 42.107533][ T3974] do_fast_syscall_32 (arch/x86/entry/common.c:203)
[ 42.111680][ T3974] do_SYSENTER_32 (arch/x86/entry/common.c:247)
[ 42.115815][ T3974] entry_SYSENTER_32 (arch/x86/entry/entry_32.S:869)
[ 42.119950][ T3974] EIP: 0xb7ee1589
[ 42.123768][ T3974] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
All code
========
...
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
2a:* 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d 76 00 lea 0x0(%rsi),%esi
35: 58 pop %rax
36: b8 77 00 00 00 mov $0x77,%eax
3b: cd 80 int $0x80
3d: 90 nop
3e: 8d .byte 0x8d
3f: 76 .byte 0x76
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 retq
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 8d 76 00 lea 0x0(%rsi),%esi
b: 58 pop %rax
c: b8 77 00 00 00 mov $0x77,%eax
11: cd 80 int $0x80
13: 90 nop
14: 8d .byte 0x8d
15: 76 .byte 0x76
[ 42.134309][ T3974] EAX: ffffffda EBX: 00527000 ECX: 00002000 EDX: 00000000
[ 42.139323][ T3974] ESI: 00000000 EDI: 00001000 EBP: 02a66140 ESP: bfeed5ac
[ 42.144232][ T3974] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000292
[ 42.149147][ T3974] Modules linked in: vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vmw_vsock_vmci_transport(E) vsock(E) vmw_vmci(E) mpls_router(E) ip_tunnel(E) af_key(E) af_alg(E) fcrypt(E) pcbc(E) rxrpc(E) crypto_user(E) scsi_transport_iscsi(E) xfrm_user(E) xfrm_algo(E) llc2(E) llc(E) sctp(E) ip6_udp_tunnel(E) udp_tunnel(E) libcrc32c(E) crc32c_generic(E) intel_rapl_msr(E) bochs(E) ata_generic(E) drm_vram_helper(E) drm_ttm_helper(E) intel_rapl_common(E) crc32c_intel(E) ppdev(E) rapl(E) ttm(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) fb_sys_fops(E) ata_piix(E) cec(E) evdev(E) psmouse(E) serio_raw(E) drm(E) libata(E) i2c_piix4(E) parport_pc(E) floppy(E) parport(E) qemu_fw_cfg(E) button(E) autofs4(E)
[ 42.179534][ T3974] CR2: 0000000000000000
[ 42.183599][ T3974] ---[ end trace 0000000000000000 ]---
[ 42.187926][ T3974] EIP: mas_ascend (lib/maple_tree.c:339 lib/maple_tree.c:1081)
[ 42.191922][ T3974] Code: 7d f0 0f b6 4d f0 83 e1 01 80 f9 01 19 c9 83 e1 f8 83 c1 18 09 c8 89 c3 30 db b9 03 00 00 00 d3 ea 83 c8 04 88 56 1d 89 46 0c <8b> 1b 89 d8 83 e0 01 88 45 eb 0f 85 f1 00 00 00 89 da c6 45 f0 00
All code
========
0: 7d f0 jge 0xfffffffffffffff2
2: 0f b6 4d f0 movzbl -0x10(%rbp),%ecx
6: 83 e1 01 and $0x1,%ecx
9: 80 f9 01 cmp $0x1,%cl
c: 19 c9 sbb %ecx,%ecx
e: 83 e1 f8 and $0xfffffff8,%ecx
11: 83 c1 18 add $0x18,%ecx
14: 09 c8 or %ecx,%eax
16: 89 c3 mov %eax,%ebx
18: 30 db xor %bl,%bl
1a: b9 03 00 00 00 mov $0x3,%ecx
1f: d3 ea shr %cl,%edx
21: 83 c8 04 or $0x4,%eax
24: 88 56 1d mov %dl,0x1d(%rsi)
27: 89 46 0c mov %eax,0xc(%rsi)
2a:* 8b 1b mov (%rbx),%ebx <-- trapping instruction
2c: 89 d8 mov %ebx,%eax
2e: 83 e0 01 and $0x1,%eax
31: 88 45 eb mov %al,-0x15(%rbp)
34: 0f 85 f1 00 00 00 jne 0x12b
3a: 89 da mov %ebx,%edx
3c: c6 45 f0 00 movb $0x0,-0x10(%rbp)
Code starting with the faulting instruction
===========================================
0: 8b 1b mov (%rbx),%ebx
2: 89 d8 mov %ebx,%eax
4: 83 e0 01 and $0x1,%eax
7: 88 45 eb mov %al,-0x15(%rbp)
a: 0f 85 f1 00 00 00 jne 0x101
10: 89 da mov %ebx,%edx
12: c6 45 f0 00 movb $0x0,-0x10(%rbp)
To reproduce:
# build kernel
cd linux
cp config-5.17.0-rc4-00060-g489b8e8c9ac0 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.17.0-rc4-00060-g489b8e8c9ac0" of type "text/plain" (140827 bytes)
View attachment "job-script" of type "text/plain" (4322 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (14672 bytes)
Powered by blists - more mailing lists