| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 11 Apr 2022 17:52:11 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Christian König <christian.koenig@....com>
Cc: Daniel Vetter <daniel.vetter@...ll.ch>,
LKML <linux-kernel@...r.kernel.org>,
Linux Memory Management List <linux-mm@...ck.org>,
lkp@...ts.01.org, lkp@...el.com
Subject: [dma] 047a1b877e: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-11):
commit: 047a1b877ed48098bed71fcfb1d4891e1b54441d ("dma-buf & drm/amdgpu: remove dma_resv workaround")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | 73511edf8b | 047a1b877e |
+---------------------------------------------+------------+------------+
| boot_successes | 32 | 0 |
| boot_failures | 0 | 30 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 30 |
| Oops:#[##] | 0 | 30 |
| RIP:dma_resv_add_fence | 0 | 30 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 30 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 6.815968][ T184] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 6.815976][ T184] #PF: supervisor read access in kernel mode
[ 6.815978][ T184] #PF: error_code(0x0000) - not-present page
[ 6.815980][ T184] PGD 0 P4D 0
[ 6.815984][ T184] Oops: 0000 [#1] SMP PTI
[ 6.815987][ T184] CPU: 0 PID: 184 Comm: udevd Not tainted 5.18.0-rc1-00237-g047a1b877ed4 #1
[ 6.815991][ T184] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 6.815992][ T184] RIP: 0010:dma_resv_add_fence (include/linux/dma-fence.h:601 include/linux/dma-fence.h:625 drivers/dma-buf/dma-resv.c:290)
[ 6.816002][ T184] Code: 48 83 ec 10 48 85 f6 74 21 48 8d 7e 38 b8 01 00 00 00 f0 0f c1 46 38 85 c0 0f 84 36 01 00 00 8d 50 01 09 c2 0f 88 42 01 00 00 <48> 8b 45 08 48 3d a0 35 ab af 0f 84 01 01 00 00 48 3d 00 36 ab af
All code
========
0: 48 83 ec 10 sub $0x10,%rsp
4: 48 85 f6 test %rsi,%rsi
7: 74 21 je 0x2a
9: 48 8d 7e 38 lea 0x38(%rsi),%rdi
d: b8 01 00 00 00 mov $0x1,%eax
12: f0 0f c1 46 38 lock xadd %eax,0x38(%rsi)
17: 85 c0 test %eax,%eax
19: 0f 84 36 01 00 00 je 0x155
1f: 8d 50 01 lea 0x1(%rax),%edx
22: 09 c2 or %eax,%edx
24: 0f 88 42 01 00 00 js 0x16c
2a:* 48 8b 45 08 mov 0x8(%rbp),%rax <-- trapping instruction
2e: 48 3d a0 35 ab af cmp $0xffffffffafab35a0,%rax
34: 0f 84 01 01 00 00 je 0x13b
3a: 48 3d 00 36 ab af cmp $0xffffffffafab3600,%rax
Code starting with the faulting instruction
===========================================
0: 48 8b 45 08 mov 0x8(%rbp),%rax
4: 48 3d a0 35 ab af cmp $0xffffffffafab35a0,%rax
a: 0f 84 01 01 00 00 je 0x111
10: 48 3d 00 36 ab af cmp $0xffffffffafab3600,%rax
[ 6.816005][ T184] RSP: 0018:ffffa5b9c0593650 EFLAGS: 00010246
[ 6.816007][ T184] RAX: ffffffffc046e340 RBX: ffff8e586fdda400 RCX: ffff8e586fdda500
[ 6.816009][ T184] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8e586fdda500
[ 6.816011][ T184] RBP: 0000000000000000 R08: ffff8e55510cd000 R09: ffffa5b9c26ff000
[ 6.816012][ T184] R10: 00005a473ac00000 R11: 000ffffffffff000 R12: 0000000000000000
[ 6.816014][ T184] R13: 0000000000000001 R14: ffff8e586fddbe00 R15: ffff8e555080a028
[ 6.816016][ T184] FS: 00007fc5deef4300(0000) GS:ffff8e586fc00000(0000) knlGS:0000000000000000
[ 6.816024][ T184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.816026][ T184] CR2: 0000000000000008 CR3: 0000000110b56000 CR4: 00000000000006f0
[ 6.816028][ T184] Call Trace:
[ 6.816045][ T184] <TASK>
[ 6.816051][ T184] ttm_bo_move_accel_cleanup (drivers/gpu/drm/ttm/ttm_bo_util.c:566) ttm
[ 6.816072][ T184] ttm_bo_move_memcpy (include/drm/ttm/ttm_bo_driver.h:261 drivers/gpu/drm/ttm/ttm_bo_util.c:177) ttm
[ 6.816081][ T184] ttm_bo_handle_move_mem (drivers/gpu/drm/ttm/ttm_bo.c:159) ttm
[ 6.816089][ T184] ttm_bo_validate (drivers/gpu/drm/ttm/ttm_bo.c:885 drivers/gpu/drm/ttm/ttm_bo.c:916) ttm
[ 6.816096][ T184] ? __cond_resched (kernel/sched/core.c:8172)
[ 6.816103][ T184] drm_gem_vram_pin_locked (drivers/gpu/drm/drm_gem_vram_helper.c:293) drm_vram_helper
[ 6.816110][ T184] drm_gem_vram_pin (drivers/gpu/drm/drm_gem_vram_helper.c:332) drm_vram_helper
[ 6.816115][ T184] drm_gem_vram_plane_helper_prepare_fb (drivers/gpu/drm/drm_gem_vram_helper.c:680) drm_vram_helper
[ 6.816120][ T184] drm_atomic_helper_prepare_planes (drivers/gpu/drm/drm_atomic_helper.c:2428 drivers/gpu/drm/drm_atomic_helper.c:2404) drm_kms_helper
[ 6.816152][ T184] drm_atomic_helper_commit (drivers/gpu/drm/drm_atomic_helper.c:1856 drivers/gpu/drm/drm_atomic_helper.c:1833) drm_kms_helper
[ 6.816168][ T184] drm_atomic_commit (drivers/gpu/drm/drm_atomic.c:1441) drm
[ 6.816249][ T184] ? drm_plane_get_damage_clips.cold (drivers/gpu/drm/drm_aperture.c:338) drm
[ 6.816284][ T184] drm_client_modeset_commit_atomic (drivers/gpu/drm/drm_client_modeset.c:1044) drm
[ 6.816325][ T184] drm_client_modeset_commit_locked (drivers/gpu/drm/drm_client_modeset.c:1147) drm
[ 6.816364][ T184] drm_client_modeset_commit (drivers/gpu/drm/drm_client_modeset.c:1175) drm
[ 6.816401][ T184] drm_fb_helper_set_par (drivers/gpu/drm/drm_fb_helper.c:256 drivers/gpu/drm/drm_fb_helper.c:231 drivers/gpu/drm/drm_fb_helper.c:1434) drm_kms_helper
[ 6.816421][ T184] fbcon_init (drivers/video/fbdev/core/fbcon.c:1127)
[ 6.816430][ T184] visual_init (drivers/tty/vt/vt.c:1075)
[ 6.816434][ T184] do_bind_con_driver+0x1d0/0x300
[ 6.816440][ T184] do_take_over_console (drivers/tty/vt/vt.c:4274)
[ 6.816443][ T184] do_fbcon_takeover (drivers/video/fbdev/core/fbcon.c:555)
[ 6.816446][ T184] do_register_framebuffer (include/linux/fb.h:645 drivers/video/fbdev/core/fbmem.c:1675)
[ 6.816451][ T184] register_framebuffer (drivers/video/fbdev/core/fbmem.c:1893)
[ 6.816454][ T184] __drm_fb_helper_initial_config_and_unlock (drivers/gpu/drm/drm_fb_helper.c:1899) drm_kms_helper
[ 6.816471][ T184] drm_fbdev_client_hotplug (drivers/gpu/drm/drm_fb_helper.c:1965 drivers/gpu/drm/drm_fb_helper.c:1957 drivers/gpu/drm/drm_fb_helper.c:2477) drm_kms_helper
[ 6.816487][ T184] drm_fbdev_generic_setup (drivers/gpu/drm/drm_fb_helper.c:2564) drm_kms_helper
[ 6.816504][ T184] bochs_pci_probe (drivers/gpu/drm/tiny/bochs.c:667 drivers/gpu/drm/tiny/bochs.c:632) bochs
[ 6.816516][ T184] local_pci_probe (drivers/pci/pci-driver.c:323)
[ 6.816522][ T184] pci_call_probe (drivers/pci/pci-driver.c:391)
[ 6.816526][ T184] ? kernfs_create_link (fs/kernfs/symlink.c:48)
[ 6.816534][ T184] pci_device_probe (drivers/pci/pci-driver.c:460)
[ 6.816538][ T184] really_probe (drivers/base/dd.c:541 drivers/base/dd.c:620)
[ 6.816546][ T184] __driver_probe_device (drivers/base/dd.c:751)
[ 6.816549][ T184] driver_probe_device (drivers/base/dd.c:781)
[ 6.816552][ T184] __driver_attach (drivers/base/dd.c:1141)
[ 6.816555][ T184] ? __device_attach_driver (drivers/base/dd.c:1093)
[ 6.816558][ T184] ? __device_attach_driver (drivers/base/dd.c:1093)
[ 6.816562][ T184] bus_for_each_dev (drivers/base/bus.c:301)
[ 6.816566][ T184] bus_add_driver (drivers/base/bus.c:619)
[ 6.816569][ T184] driver_register (drivers/base/driver.c:171)
[ 6.816574][ T184] ? 0xffffffffc0352000
[ 6.816576][ T184] do_one_initcall (init/main.c:1298)
[ 6.816583][ T184] ? do_init_module (kernel/module.c:3722)
[ 6.816587][ T184] ? kmem_cache_alloc_trace (mm/slub.c:3219 mm/slub.c:3225 mm/slub.c:3256)
[ 6.816596][ T184] do_init_module (kernel/module.c:3731)
[ 6.816599][ T184] __do_sys_finit_module (kernel/module.c:4222)
[ 6.816604][ T184] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 6.816614][ T184] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:115)
[ 6.816620][ T184] RIP: 0033:0x7fc5df009b99
[ 6.816625][ T184] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c7 12 0c 00 f7 d8 64 89 01 48
All code
========
0: 00 c3 add %al,%bl
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 8b 0d c7 12 0c 00 mov 0xc12c7(%rip),%rcx # 0xc1301
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 retq
9: 48 8b 0d c7 12 0c 00 mov 0xc12c7(%rip),%rcx # 0xc12d7
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
To reproduce:
# build kernel
cd linux
cp config-5.18.0-rc1-00237-g047a1b877ed4 .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.18.0-rc1-00237-g047a1b877ed4" of type "text/plain" (164032 bytes)
View attachment "job-script" of type "text/plain" (4606 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (13976 bytes)
Powered by blists - more mailing lists