| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220320131151.GA6208@xsang-OptiPlex-9020>
Date: Sun, 20 Mar 2022 21:11:51 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Kumar Kartikeya Dwivedi <memxor@...il.com>
Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
lkp@...ts.01.org, bpf@...r.kernel.org,
Alexei Starovoitov <ast@...nel.org>,
Andrii Nakryiko <andrii@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Toke Høiland-Jørgensen <toke@...hat.com>,
Jesper Dangaard Brouer <brouer@...hat.com>
Subject: [bpf] 9a707eb02e: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 9a707eb02e50d3c736837128261bcba9c96a400d ("[PATCH bpf-next v2 09/15] bpf: Always raise reference in btf_get_module_btf")
url: https://github.com/0day-ci/linux/commits/Kumar-Kartikeya-Dwivedi/Introduce-typed-pointer-support-in-BPF-maps/20220317-200307
base: https://git.kernel.org/cgit/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/bpf/20220317115957.3193097-10-memxor@gmail.com
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu Icelake-Server -smp 4 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | 96cb297d08 | 9a707eb02e |
+---------------------------------------------+------------+------------+
| boot_successes | 36 | 0 |
| boot_failures | 0 | 36 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 36 |
| Oops:#[##] | 0 | 36 |
| RIP:register_btf_kfunc_id_set | 0 | 36 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 36 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 4.499143][ T1] BUG: kernel NULL pointer dereference, address: 0000000000000054
[ 4.500062][ T1] #PF: supervisor write access in kernel mode
[ 4.500062][ T1] #PF: error_code(0x0002) - not-present page
[ 4.500062][ T1] PGD 0 P4D 0
[ 4.500062][ T1] Oops: 0002 [#1] SMP PTI
[ 4.500062][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.17.0-rc6-02001-g9a707eb02e50 #1
[ 4.500062][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 4.500062][ T1] RIP: 0010:register_btf_kfunc_id_set (arch/x86/include/asm/atomic.h:184 include/linux/atomic/atomic-instrumented.h:117 include/linux/refcount.h:193 include/linux/refcount.h:250 include/linux/refcount.h:267 kernel/bpf/btf.c:1636 kernel/bpf/btf.c:6783 kernel/bpf/btf.c:7007)
[ 4.500062][ T1] Code: 5c 41 5d 41 5e 41 5f c3 89 fb 49 89 f4 e8 08 27 fe ff 48 89 c5 48 3d 00 f0 ff ff 0f 87 40 02 00 00 48 8d 78 54 b8 01 00 00 00 <f0> 0f c1 45 54 85 c0 0f 84 55 02 00 00 0f 88 40 02 00 00 83 c0 01
All code
========
0: 5c pop %rsp
1: 41 5d pop %r13
3: 41 5e pop %r14
5: 41 5f pop %r15
7: c3 retq
8: 89 fb mov %edi,%ebx
a: 49 89 f4 mov %rsi,%r12
d: e8 08 27 fe ff callq 0xfffffffffffe271a
12: 48 89 c5 mov %rax,%rbp
15: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
1b: 0f 87 40 02 00 00 ja 0x261
21: 48 8d 78 54 lea 0x54(%rax),%rdi
25: b8 01 00 00 00 mov $0x1,%eax
2a:* f0 0f c1 45 54 lock xadd %eax,0x54(%rbp) <-- trapping instruction
2f: 85 c0 test %eax,%eax
31: 0f 84 55 02 00 00 je 0x28c
37: 0f 88 40 02 00 00 js 0x27d
3d: 83 c0 01 add $0x1,%eax
Code starting with the faulting instruction
===========================================
0: f0 0f c1 45 54 lock xadd %eax,0x54(%rbp)
5: 85 c0 test %eax,%eax
7: 0f 84 55 02 00 00 je 0x262
d: 0f 88 40 02 00 00 js 0x253
13: 83 c0 01 add $0x1,%eax
[ 4.500062][ T1] RSP: 0000:ffffa6e9c0013dd8 EFLAGS: 00010207
[ 4.500062][ T1] RAX: 0000000000000001 RBX: 000000000000001b RCX: 000000000000019a
[ 4.500062][ T1] RDX: 00000000000000ce RSI: ffffffffb79054c0 RDI: 0000000000000054
[ 4.500062][ T1] RBP: 0000000000000000 R08: ffffa6e9c0013dd8 R09: ffffa6e9c0013dd8
[ 4.500062][ T1] R10: 0000000000030400 R11: 0000000000000000 R12: ffffffffb79054c0
[ 4.500062][ T1] R13: ffff989c4004f800 R14: 0000000000000000 R15: 0000000000000000
[ 4.500062][ T1] FS: 0000000000000000(0000) GS:ffff989f6fc80000(0000) knlGS:0000000000000000
[ 4.500062][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.500062][ T1] CR2: 0000000000000054 CR3: 0000000198a0a001 CR4: 0000000000060ee0
[ 4.500062][ T1] Call Trace:
[ 4.500062][ T1] <TASK>
[ 4.500062][ T1] ? ip_auto_config (net/ipv4/tcp_cubic.c:507)
[ 4.500062][ T1] cubictcp_register (net/ipv4/tcp_cubic.c:541)
[ 4.500062][ T1] do_one_initcall (init/main.c:1302)
[ 4.500062][ T1] kernel_init_freeable (init/main.c:1374 init/main.c:1391 init/main.c:1410 init/main.c:1615)
[ 4.500062][ T1] ? rest_init (init/main.c:1496)
[ 4.500062][ T1] kernel_init (init/main.c:1506)
[ 4.500062][ T1] ret_from_fork (arch/x86/entry/entry_64.S:301)
[ 4.500062][ T1] </TASK>
[ 4.500062][ T1] Modules linked in:
[ 4.500062][ T1] CR2: 0000000000000054
[ 4.500062][ T1] ---[ end trace 0000000000000000 ]---
[ 4.500062][ T1] RIP: 0010:register_btf_kfunc_id_set (arch/x86/include/asm/atomic.h:184 include/linux/atomic/atomic-instrumented.h:117 include/linux/refcount.h:193 include/linux/refcount.h:250 include/linux/refcount.h:267 kernel/bpf/btf.c:1636 kernel/bpf/btf.c:6783 kernel/bpf/btf.c:7007)
[ 4.500062][ T1] Code: 5c 41 5d 41 5e 41 5f c3 89 fb 49 89 f4 e8 08 27 fe ff 48 89 c5 48 3d 00 f0 ff ff 0f 87 40 02 00 00 48 8d 78 54 b8 01 00 00 00 <f0> 0f c1 45 54 85 c0 0f 84 55 02 00 00 0f 88 40 02 00 00 83 c0 01
All code
========
0: 5c pop %rsp
1: 41 5d pop %r13
3: 41 5e pop %r14
5: 41 5f pop %r15
7: c3 retq
8: 89 fb mov %edi,%ebx
a: 49 89 f4 mov %rsi,%r12
d: e8 08 27 fe ff callq 0xfffffffffffe271a
12: 48 89 c5 mov %rax,%rbp
15: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
1b: 0f 87 40 02 00 00 ja 0x261
21: 48 8d 78 54 lea 0x54(%rax),%rdi
25: b8 01 00 00 00 mov $0x1,%eax
2a:* f0 0f c1 45 54 lock xadd %eax,0x54(%rbp) <-- trapping instruction
2f: 85 c0 test %eax,%eax
31: 0f 84 55 02 00 00 je 0x28c
37: 0f 88 40 02 00 00 js 0x27d
3d: 83 c0 01 add $0x1,%eax
Code starting with the faulting instruction
===========================================
0: f0 0f c1 45 54 lock xadd %eax,0x54(%rbp)
5: 85 c0 test %eax,%eax
7: 0f 84 55 02 00 00 je 0x262
d: 0f 88 40 02 00 00 js 0x253
13: 83 c0 01 add $0x1,%eax
To reproduce:
# build kernel
cd linux
cp config-5.17.0-rc6-02001-g9a707eb02e50 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.17.0-rc6-02001-g9a707eb02e50" of type "text/plain" (162364 bytes)
View attachment "job-script" of type "text/plain" (4959 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (10428 bytes)
Powered by blists - more mailing lists