| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 27 Mar 2022 23:18:57 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Logan Gunthorpe <logang@...tatee.com>
Cc: lkp@...ts.01.org, lkp@...el.com,
LKML <linux-kernel@...r.kernel.org>
Subject: [md/raid5] 90ac8e68f3: kernel_BUG_at_drivers/md/raid#.c
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 90ac8e68f3b434acc9aad21a1e27c3c9565d6a3c ("md/raid5: Pivot raid5_make_request()")
https://github.com/sbates130272/linux-p2pmem.git raid5_lock_cont_v1
in testcase: mdadm-selftests
version: mdadm-selftests-x86_64-5f41845-1_20220325
with following parameters:
disk: 1HDD
test_prefix: 07revert
ucode: 0x28
on test machine: 8 threads 1 sockets Intel(R) Core(TM) i7-4790T CPU @ 2.70GHz with 16G memory
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 92.139721][ T1121] kernel BUG at drivers/md/raid5.c:780!
[ 92.145157][ T1121] invalid opcode: 0000 [#1] SMP KASAN PTI
[ 92.150783][ T1121] CPU: 7 PID: 1121 Comm: mkfs.ext3 Not tainted 5.17.0-00007-g90ac8e68f3b4 #1
[ 92.159441][ T1121] Hardware name: Gigabyte Technology Co., Ltd. Z97X-UD5H/Z97X-UD5H, BIOS F9 04/21/2015
[ 92.168957][ T1121] RIP: 0010:stripe_can_batch (drivers/md/raid5.c:780 drivers/md/raid5.c:814 drivers/md/raid5.c:806) raid456
[ 92.175345][ T1121] Code: 5b 28 48 8d 7b 40 48 89 f9 48 c1 e9 03 0f b6 14 11 84 d2 74 05 80 fa 03 7e 7f 2b 43 40 41 39 c5 41 0f 94 c4 0f 8e 77 fe ff ff <0f> 0b 4c 89 ef e8 d8 47 f8 bf e9 5d fe ff ff 4c 89 ff e8 cb 47 f8
All code
========
0: 5b pop %rbx
1: 28 48 8d sub %cl,-0x73(%rax)
4: 7b 40 jnp 0x46
6: 48 89 f9 mov %rdi,%rcx
9: 48 c1 e9 03 shr $0x3,%rcx
d: 0f b6 14 11 movzbl (%rcx,%rdx,1),%edx
11: 84 d2 test %dl,%dl
13: 74 05 je 0x1a
15: 80 fa 03 cmp $0x3,%dl
18: 7e 7f jle 0x99
1a: 2b 43 40 sub 0x40(%rbx),%eax
1d: 41 39 c5 cmp %eax,%r13d
20: 41 0f 94 c4 sete %r12b
24: 0f 8e 77 fe ff ff jle 0xfffffffffffffea1
2a:* 0f 0b ud2 <-- trapping instruction
2c: 4c 89 ef mov %r13,%rdi
2f: e8 d8 47 f8 bf callq 0xffffffffbff8480c
34: e9 5d fe ff ff jmpq 0xfffffffffffffe96
39: 4c 89 ff mov %r15,%rdi
3c: e8 .byte 0xe8
3d: cb lret
3e: 47 f8 rex.RXB clc
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 4c 89 ef mov %r13,%rdi
5: e8 d8 47 f8 bf callq 0xffffffffbff847e2
a: e9 5d fe ff ff jmpq 0xfffffffffffffe6c
f: 4c 89 ff mov %r15,%rdi
12: e8 .byte 0xe8
13: cb lret
14: 47 f8 rex.RXB clc
[ 92.194829][ T1121] RSP: 0018:ffffc90001f1f400 EFLAGS: 00010202
[ 92.200780][ T1121] RAX: 0000000000000002 RBX: ffff88841591a000 RCX: 1ffff11082b23408
[ 92.208633][ T1121] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88841591a040
[ 92.216477][ T1121] RBP: ffff888412fd94c8 R08: 0000000000000001 R09: ffffed10825fb29e
[ 92.224345][ T1121] R10: ffff888412fd94ef R11: ffffed10825fb29d R12: 0000000000000000
[ 92.232198][ T1121] R13: 0000000000000003 R14: ffff888412de4000 R15: ffff88841591a028
[ 92.240041][ T1121] FS: 00007f39b247d780(0000) GS:ffff88836ab80000(0000) knlGS:0000000000000000
[ 92.248862][ T1121] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 92.255327][ T1121] CR2: 00007f39b244a000 CR3: 000000013771a001 CR4: 00000000001706e0
[ 92.263164][ T1121] Call Trace:
[ 92.266317][ T1121] <TASK>
[ 92.269126][ T1121] raid5_make_request (drivers/md/raid5.c:5984) raid456
[ 92.274992][ T1121] ? insert_work (include/linux/list.h:72 include/linux/list.h:102 kernel/workqueue.c:1372)
[ 92.279473][ T1121] ? raid5_get_active_stripe (drivers/md/raid5.c:5825) raid456
[ 92.286026][ T1121] ? do_writepages (mm/page-writeback.c:2367)
[ 92.290643][ T1121] ? filemap_fdatawrite_wbc (mm/filemap.c:385 mm/filemap.c:374)
[ 92.296052][ T1121] ? file_write_and_wait_range (mm/filemap.c:417 mm/filemap.c:775)
[ 92.301745][ T1121] ? do_fsync (include/linux/file.h:45 fs/sync.c:213)
[ 92.305784][ T1121] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 92.310230][ T1121] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:113)
[ 92.316169][ T1121] ? finish_wait (kernel/sched/wait.c:415)
[ 92.320648][ T1121] ? get_partial_node+0xcf/0x240
[ 92.326073][ T1121] ? update_load_avg (kernel/sched/fair.c:3594 kernel/sched/fair.c:3849)
[ 92.330962][ T1121] ? update_cfs_group (arch/x86/include/asm/atomic64_64.h:22 include/linux/atomic/atomic-long.h:29 include/linux/atomic/atomic-instrumented.h:1266 kernel/sched/fair.c:3166 kernel/sched/fair.c:3215)
[ 92.335867][ T1121] md_handle_request (drivers/md/md.c:441)
[ 92.340695][ T1121] ? recovery_start_show (drivers/md/md.c:416)
[ 92.345845][ T1121] ? kasan_unpoison (mm/kasan/shadow.c:108 mm/kasan/shadow.c:142)
[ 92.350383][ T1121] ? recalibrate_cpu_khz (arch/x86/include/asm/msr.h:224 arch/x86/kernel/tsc.c:1095)
[ 92.355415][ T1121] ? ktime_get (kernel/time/timekeeping.c:290 kernel/time/timekeeping.c:386 kernel/time/timekeeping.c:829 kernel/time/timekeeping.c:817)
[ 92.359613][ T1121] ? __blk_queue_split (block/blk-merge.c:387)
[ 92.364606][ T1121] ? submit_bio_checks (include/linux/blk_types.h:225 include/linux/blk-cgroup.h:531 block/blk-core.c:767)
[ 92.369676][ T1121] md_submit_bio (drivers/md/md.c:453)
[ 92.374140][ T1121] ? md_handle_request (drivers/md/md.c:453)
[ 92.379132][ T1121] ? mempool_destroy (mm/mempool.c:375)
[ 92.383785][ T1121] __submit_bio (block/blk-core.c:791 block/blk-core.c:806)
[ 92.388179][ T1121] submit_bio_noacct (include/linux/bio.h:619 block/blk-core.c:855 block/blk-core.c:907 block/blk-core.c:894)
[ 92.393007][ T1121] ? __bio_add_page (arch/x86/include/asm/bitops.h:207 include/asm-generic/bitops/instrumented-non-atomic.h:135 include/linux/page-flags.h:426 block/bio.c:1010 block/bio.c:995)
[ 92.397748][ T1121] ? __submit_bio (block/blk-core.c:895)
[ 92.402306][ T1121] ? wb_position_ratio (mm/page-writeback.c:906)
[ 92.407306][ T1121] submit_bh_wbc (fs/buffer.c:3057)
[ 92.411788][ T1121] __block_write_full_page (fs/buffer.c:1814)
[ 92.417136][ T1121] ? end_buffer_write_sync (fs/buffer.c:343)
[ 92.422309][ T1121] __writepage (mm/page-writeback.c:2320)
[ 92.426530][ T1121] ? inode_to_bdi (mm/backing-dev.c:995 mm/backing-dev.c:985)
[ 92.431001][ T1121] write_cache_pages (mm/page-writeback.c:2256)
[ 92.435810][ T1121] ? folio_mark_dirty (mm/page-writeback.c:2318)
[ 92.440699][ T1121] ? tag_pages_for_writeback (mm/page-writeback.c:2180)
[ 92.446219][ T1121] ? generic_perform_write (mm/filemap.c:3800)
[ 92.451569][ T1121] ? blk_start_plug_nr_ios (block/blk-core.c:1276)
[ 92.456897][ T1121] generic_writepages (mm/page-writeback.c:2347 mm/page-writeback.c:2335)
[ 92.461699][ T1121] ? write_cache_pages (mm/page-writeback.c:2337)
[ 92.466701][ T1121] ? blkdev_bio_end_io (block/fops.c:529)
[ 92.471700][ T1121] ? fsnotify_handle_inode_event+0x440/0x440
[ 92.478183][ T1121] do_writepages (mm/page-writeback.c:2367)
[ 92.482664][ T1121] ? page_writeback_cpu_online (mm/page-writeback.c:2354)
[ 92.488176][ T1121] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:202 include/linux/atomic/atomic-instrumented.h:543 include/asm-generic/qspinlock.h:82 include/linux/spinlock.h:185 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154)
[ 92.492803][ T1121] ? inode_to_bdi (mm/backing-dev.c:995 mm/backing-dev.c:985)
[ 92.497266][ T1121] ? wbc_attach_and_unlock_inode (arch/x86/include/asm/jump_label.h:27 include/linux/backing-dev.h:182 fs/fs-writeback.c:693)
[ 92.503048][ T1121] filemap_fdatawrite_wbc (mm/filemap.c:385 mm/filemap.c:374)
[ 92.508309][ T1121] file_write_and_wait_range (mm/filemap.c:417 mm/filemap.c:775)
[ 92.513828][ T1121] ? file_fdatawait_range (mm/filemap.c:770)
[ 92.518900][ T1121] blkdev_fsync (block/fops.c:467)
[ 92.523094][ T1121] do_fsync (include/linux/file.h:45 fs/sync.c:213)
[ 92.526959][ T1121] __x64_sys_fsync (fs/sync.c:218)
[ 92.531450][ T1121] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 92.535748][ T1121] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:113)
[ 92.541527][ T1121] RIP: 0033:0x7f39b2592214
[ 92.545835][ T1121] Code: 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8d 05 e9 f4 0c 00 8b 00 85 c0 75 13 b8 4a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 3c c3 0f 1f 00 53 89 fb 48 83 ec 10 e8 24 55
All code
========
0: 89 01 mov %eax,(%rcx)
2: 48 83 c8 ff or $0xffffffffffffffff,%rax
6: c3 retq
7: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
e: 00 00 00
11: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
16: 48 8d 05 e9 f4 0c 00 lea 0xcf4e9(%rip),%rax # 0xcf506
1d: 8b 00 mov (%rax),%eax
1f: 85 c0 test %eax,%eax
21: 75 13 jne 0x36
23: b8 4a 00 00 00 mov $0x4a,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 3c ja 0x6e
32: c3 retq
33: 0f 1f 00 nopl (%rax)
36: 53 push %rbx
37: 89 fb mov %edi,%ebx
39: 48 83 ec 10 sub $0x10,%rsp
3d: e8 .byte 0xe8
3e: 24 55 and $0x55,%al
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 3c ja 0x44
8: c3 retq
9: 0f 1f 00 nopl (%rax)
c: 53 push %rbx
d: 89 fb mov %edi,%ebx
f: 48 83 ec 10 sub $0x10,%rsp
13: e8 .byte 0xe8
14: 24 55 and $0x55,%al
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
sudo bin/lkp install job.yaml # job file is attached in this email
bin/lkp split-job --compatible job.yaml # generate the yaml file for lkp run
sudo bin/lkp run generated-yaml-file
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.17.0-00007-g90ac8e68f3b4" of type "text/plain" (165688 bytes)
View attachment "job-script" of type "text/plain" (5602 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (21696 bytes)
View attachment "mdadm-selftests" of type "text/plain" (70589 bytes)
View attachment "job.yaml" of type "text/plain" (4522 bytes)
Powered by blists - more mailing lists