| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220313142736.GD14898@xsang-OptiPlex-9020>
Date: Sun, 13 Mar 2022 22:27:36 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Chris Goldsworthy <quic_cgoldswo@...cinc.com>
Cc: lkp@...ts.01.org, lkp@...el.com,
LKML <linux-kernel@...r.kernel.org>
Subject: [ANDROID] c3c2bb34ac: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: c3c2bb34ac8f3cf3ec040110380ae0a5fd2ffcd0 ("ANDROID: arm64/mm: Add command line option to make ZONE_DMA32 empty")
https://github.com/ammarfaizi2/linux-block google/android/kernel/common/android12-5.10-2022-01
in testcase: trinity
version: trinity-x86_64-3f8670b2-1_20220309
with following parameters:
runtime: 300s
group: group-01
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu Icelake-Server -smp 4 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | f8f6c7332b | c3c2bb34ac |
+---------------------------------------------+------------+------------+
| boot_successes | 6 | 0 |
| boot_failures | 0 | 6 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 6 |
| Oops:#[##] | 0 | 6 |
| RIP:__dma_direct_alloc_pages | 0 | 6 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 6 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 3.607162][ T1] BUG: kernel NULL pointer dereference, address: 00000000000006f8
[ 3.608340][ T1] #PF: supervisor read access in kernel mode
[ 3.609209][ T1] #PF: error_code(0x0000) - not-present page
[ 3.610131][ T1] PGD 0 P4D 0
[ 3.610239][ T1] Oops: 0000 [#1] SMP PTI
[ 3.610239][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.66-05371-gc3c2bb34ac8f #1
[ 3.610239][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 3.610239][ T1] RIP: 0010:__dma_direct_alloc_pages (kernel/dma/direct.c:66 kernel/dma/direct.c:89)
[ 3.610239][ T1] Code: 40 74 36 b8 01 00 00 00 48 d3 e0 48 ff c8 49 39 c6 76 26 b8 ff ff ff ff 31 d2 49 39 c6 77 1a 49 63 c7 48 8b 04 c5 60 54 92 82 <48> 83 b8 f8 06 00 00 01 19 d2 f7 d2 83 e2 04 09 d3 4c 89 ee 4c 89
All code
========
0: 40 74 36 rex je 0x39
3: b8 01 00 00 00 mov $0x1,%eax
8: 48 d3 e0 shl %cl,%rax
b: 48 ff c8 dec %rax
e: 49 39 c6 cmp %rax,%r14
11: 76 26 jbe 0x39
13: b8 ff ff ff ff mov $0xffffffff,%eax
18: 31 d2 xor %edx,%edx
1a: 49 39 c6 cmp %rax,%r14
1d: 77 1a ja 0x39
1f: 49 63 c7 movslq %r15d,%rax
22: 48 8b 04 c5 60 54 92 mov -0x7d6daba0(,%rax,8),%rax
29: 82
2a:* 48 83 b8 f8 06 00 00 cmpq $0x1,0x6f8(%rax) <-- trapping instruction
31: 01
32: 19 d2 sbb %edx,%edx
34: f7 d2 not %edx
36: 83 e2 04 and $0x4,%edx
39: 09 d3 or %edx,%ebx
3b: 4c 89 ee mov %r13,%rsi
3e: 4c rex.WR
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 48 83 b8 f8 06 00 00 cmpq $0x1,0x6f8(%rax)
7: 01
8: 19 d2 sbb %edx,%edx
a: f7 d2 not %edx
c: 83 e2 04 and $0x4,%edx
f: 09 d3 or %edx,%ebx
11: 4c 89 ee mov %r13,%rsi
14: 4c rex.WR
15: 89 .byte 0x89
[ 3.610239][ T1] RSP: 0000:ffffc90000013af8 EFLAGS: 00010246
[ 3.610239][ T1] RAX: 0000000000000000 RBX: 0000000000000cc0 RCX: 0000000000000018
[ 3.610239][ T1] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
[ 3.610239][ T1] RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000cc0
[ 3.610239][ T1] R10: 0000000000000009 R11: 0000000000000009 R12: ffff88810d6a60b8
[ 3.610239][ T1] R13: 0000000000001000 R14: 00000000ffffffff R15: 00000000ffffffff
[ 3.610239][ T1] FS: 0000000000000000(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000
[ 3.610239][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.610239][ T1] CR2: 00000000000006f8 CR3: 0000000002412001 CR4: 0000000000370ef0
[ 3.610239][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.610239][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.610239][ T1] Call Trace:
[ 3.610239][ T1] dma_direct_alloc (kernel/dma/direct.c:176)
[ 3.610239][ T1] dmam_alloc_attrs (kernel/dma/mapping.c:92)
[ 3.610239][ T1] ata_bmdma_port_start (drivers/ata/libata-sff.c:3076 drivers/ata/libata-sff.c:3073)
[ 3.610239][ T1] ata_host_start (drivers/ata/libata-core.c:5589 drivers/ata/libata-core.c:5553)
[ 3.610239][ T1] ? ata_sff_interrupt (drivers/ata/libata-sff.c:2850)
[ 3.610239][ T1] ata_pci_sff_activate_host (drivers/ata/libata-sff.c:2372)
[ 3.610239][ T1] piix_init_one (drivers/ata/ata_piix.c:1709 drivers/ata/ata_piix.c:1708)
[ 3.610239][ T1] ? idr_alloc_cyclic (lib/idr.c:126 (discriminator 4))
[ 3.610239][ T1] local_pci_probe (drivers/pci/pci-driver.c:309)
[ 3.610239][ T1] pci_device_probe (drivers/pci/pci-driver.c:367 drivers/pci/pci-driver.c:390 drivers/pci/pci-driver.c:433)
[ 3.610239][ T1] ? sysfs_do_create_link_sd+0x79/0xa6
[ 3.610239][ T1] really_probe (drivers/base/dd.c:560)
[ 3.610239][ T1] driver_probe_device (drivers/base/dd.c:749)
[ 3.610239][ T1] device_driver_attach (drivers/base/dd.c:1026)
[ 3.610239][ T1] __driver_attach (drivers/base/dd.c:1103)
[ 3.610239][ T1] ? device_driver_attach (drivers/base/dd.c:1056)
[ 3.610239][ T1] bus_for_each_dev (drivers/base/bus.c:304)
[ 3.610239][ T1] bus_add_driver (drivers/base/bus.c:623)
[ 3.610239][ T1] driver_register (drivers/base/driver.c:171)
[ 3.610239][ T1] ? ahci_driver_init (drivers/ata/ata_piix.c:1767)
[ 3.610239][ T1] piix_init (drivers/ata/ata_piix.c:1772)
[ 3.610239][ T1] do_one_initcall (init/main.c:1208)
[ 3.610239][ T1] kernel_init_freeable (init/main.c:1280 init/main.c:1297 init/main.c:1317 init/main.c:1519)
[ 3.610239][ T1] ? rest_init (init/main.c:1403)
[ 3.610239][ T1] kernel_init (init/main.c:1408)
[ 3.610239][ T1] ret_from_fork (arch/x86/entry/entry_64.S:302)
[ 3.610239][ T1] Modules linked in:
[ 3.610239][ T1] CR2: 00000000000006f8
[ 3.610239][ T1] ---[ end trace 1feee52a42fba8df ]---
[ 3.610239][ T1] RIP: 0010:__dma_direct_alloc_pages (kernel/dma/direct.c:66 kernel/dma/direct.c:89)
[ 3.610239][ T1] Code: 40 74 36 b8 01 00 00 00 48 d3 e0 48 ff c8 49 39 c6 76 26 b8 ff ff ff ff 31 d2 49 39 c6 77 1a 49 63 c7 48 8b 04 c5 60 54 92 82 <48> 83 b8 f8 06 00 00 01 19 d2 f7 d2 83 e2 04 09 d3 4c 89 ee 4c 89
All code
========
0: 40 74 36 rex je 0x39
3: b8 01 00 00 00 mov $0x1,%eax
8: 48 d3 e0 shl %cl,%rax
b: 48 ff c8 dec %rax
e: 49 39 c6 cmp %rax,%r14
11: 76 26 jbe 0x39
13: b8 ff ff ff ff mov $0xffffffff,%eax
18: 31 d2 xor %edx,%edx
1a: 49 39 c6 cmp %rax,%r14
1d: 77 1a ja 0x39
1f: 49 63 c7 movslq %r15d,%rax
22: 48 8b 04 c5 60 54 92 mov -0x7d6daba0(,%rax,8),%rax
29: 82
2a:* 48 83 b8 f8 06 00 00 cmpq $0x1,0x6f8(%rax) <-- trapping instruction
31: 01
32: 19 d2 sbb %edx,%edx
34: f7 d2 not %edx
36: 83 e2 04 and $0x4,%edx
39: 09 d3 or %edx,%ebx
3b: 4c 89 ee mov %r13,%rsi
3e: 4c rex.WR
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 48 83 b8 f8 06 00 00 cmpq $0x1,0x6f8(%rax)
7: 01
8: 19 d2 sbb %edx,%edx
a: f7 d2 not %edx
c: 83 e2 04 and $0x4,%edx
f: 09 d3 or %edx,%ebx
11: 4c 89 ee mov %r13,%rsi
14: 4c rex.WR
15: 89 .byte 0x89
To reproduce:
# build kernel
cd linux
cp config-5.10.66-05371-gc3c2bb34ac8f .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0-DAY CI Kernel Test Service
https://lists.01.org/hyperkitty/list/lkp@lists.01.org
Thanks,
Oliver Sang
View attachment "config-5.10.66-05371-gc3c2bb34ac8f" of type "text/plain" (119249 bytes)
View attachment "job-script" of type "text/plain" (4579 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (9984 bytes)
Powered by blists - more mailing lists