| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220608153324.GC31193@xsang-OptiPlex-9020>
Date: Wed, 8 Jun 2022 23:33:24 +0800
From: kernel test robot <oliver.sang@...el.com>
To: "Matthew Wilcox (Oracle)" <willy@...radead.org>
Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
linux-mm@...ck.org, lkp@...ts.01.org,
linux-fsdevel@...r.kernel.org,
"Matthew Wilcox (Oracle)" <willy@...radead.org>,
linux-ext4@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net,
linux-nilfs@...r.kernel.org
Subject: [vmscan] bc9eb0d5ef:
BUG:KASAN:stack-out-of-bounds_in_check_move_unevictable_pages
Greeting,
FYI, we noticed the following commit (built with gcc-11):
commit: bc9eb0d5ef0a437e399f0fe3b7430b9da5ef9f95 ("[PATCH 08/10] vmscan: Add check_move_unevictable_folios()")
url: https://github.com/intel-lab-lkp/linux/commits/Matthew-Wilcox-Oracle/Convert-to-filemap_get_folios/20220606-034220
base: https://git.kernel.org/cgit/linux/kernel/git/tytso/ext4.git dev
patch link: https://lore.kernel.org/linux-fsdevel/20220605193854.2371230-9-willy@infradead.org
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------------------------+------------+------------+
| | 9f1a7a0465 | bc9eb0d5ef |
+---------------------------------------------------------------+------------+------------+
| boot_successes | 24 | 0 |
| boot_failures | 0 | 26 |
| BUG:KASAN:stack-out-of-bounds_in_check_move_unevictable_pages | 0 | 26 |
| canonical_address#:#[##] | 0 | 26 |
| RIP:check_move_unevictable_folios | 0 | 26 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 26 |
+---------------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 40.053150][ T1] ==================================================================
[ 40.054793][ T1] BUG: KASAN: stack-out-of-bounds in check_move_unevictable_pages+0x34c/0x40f
[ 40.056610][ T1] Write of size 8 at addr ffff88810083fd88 by task swapper/0/1
[ 40.056720][ T1]
[ 40.056720][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.18.0-rc5-00033-gbc9eb0d5ef0a #1
[ 40.056720][ T1] Call Trace:
[ 40.056720][ T1] <TASK>
[ 40.056720][ T1] dump_stack_lvl+0x45/0x59
[ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f
[ 40.056720][ T1] print_address_description.cold+0xcc/0x404
[ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f
[ 40.056720][ T1] print_report.cold+0x36/0x20b
[ 40.056720][ T1] kasan_report+0xbe/0x199
[ 40.056720][ T1] ? check_move_unevictable_pages+0x34c/0x40f
[ 40.056720][ T1] check_move_unevictable_pages+0x34c/0x40f
[ 40.056720][ T1] ? check_move_unevictable_folios+0xba6/0xba6
[ 40.056720][ T1] ? lock_is_held_type+0x9c/0x111
[ 40.056720][ T1] ? lru_lazyfree_fn+0x245/0x245
[ 40.056720][ T1] ? lock_release+0xdf/0x1fb
[ 40.056720][ T1] ? mlock_page_drain_local+0x1a9/0x31b
[ 40.056720][ T1] ? lock_is_held_type+0x96/0x111
[ 40.056720][ T1] drm_gem_put_pages+0x206/0x363
[ 40.056720][ T1] ? drm_gem_vm_open+0x75/0x75
[ 40.056720][ T1] ? slab_free_freelist_hook+0xba/0x167
[ 40.056720][ T1] ? drm_gem_shmem_vunmap+0x121/0x1a2
[ 40.056720][ T1] drm_gem_shmem_put_pages_locked+0xf8/0x1f2
[ 40.056720][ T1] drm_gem_shmem_vunmap+0x13a/0x1a2
[ 40.056720][ T1] drm_gem_vunmap+0xcb/0x1d0
[ 40.056720][ T1] drm_fbdev_cleanup+0x251/0x33d
[ 40.056720][ T1] drm_fbdev_client_hotplug+0x3fa/0x50e
[ 40.056720][ T1] drm_fbdev_generic_setup+0x16b/0x3f0
[ 40.056720][ T1] vkms_create+0x401/0x470
[ 40.056720][ T1] ? drm_sched_pick_best.cold+0x32/0x32
[ 40.056720][ T1] ? drm_sched_fence_slab_init+0x31/0x31
[ 40.056720][ T1] ? __kasan_kmalloc+0x81/0x95
[ 40.056720][ T1] ? vgem_init+0x1cb/0x1cb
[ 40.056720][ T1] do_one_initcall+0xbc/0x3db
[ 40.056720][ T1] ? trace_event_raw_event_initcall_level+0x19c/0x19c
[ 40.056720][ T1] ? parameq+0xcc/0xcc
[ 40.056720][ T1] do_initcalls+0x1ce/0x202
[ 40.056720][ T1] kernel_init_freeable+0x21f/0x250
[ 40.056720][ T1] ? rest_init+0x202/0x202
[ 40.056720][ T1] kernel_init+0x19/0x12b
[ 40.056720][ T1] ret_from_fork+0x22/0x30
[ 40.056720][ T1] </TASK>
[ 40.056720][ T1]
[ 40.056720][ T1] The buggy address belongs to stack of task swapper/0/1
[ 40.056720][ T1] and is located at offset 120 in frame:
[ 40.056720][ T1] vkms_create+0x0/0x470
[ 40.056720][ T1]
[ 40.056720][ T1] This frame has 1 object:
[ 40.056720][ T1] [32, 120) 'pdevinfo'
[ 40.056720][ T1]
[ 40.056720][ T1] The buggy address belongs to the physical page:
[ 40.056720][ T1] page:(____ptrval____) refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10083f
[ 40.056720][ T1] flags: 0x8000000000000000(zone=2)
[ 40.056720][ T1] raw: 8000000000000000 ffffea0004020fc8 ffffea0004020fc8 0000000000000000
[ 40.056720][ T1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 40.056720][ T1] page dumped because: kasan: bad access detected
[ 40.056720][ T1] page_owner tracks the page as allocated
[ 40.056720][ T1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 22266683981, free_ts 0
[ 40.056720][ T1] register_early_stack+0x65/0xa4
[ 40.056720][ T1] init_page_owner+0x2a/0xa7
[ 40.056720][ T1] kernel_init_freeable+0x1d7/0x250
[ 40.056720][ T1] kernel_init+0x19/0x12b
[ 40.056720][ T1] page_owner free stack trace missing
[ 40.056720][ T1]
[ 40.056720][ T1] Memory state around the buggy address:
[ 40.056720][ T1] ffff88810083fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 40.056720][ T1] ffff88810083fd00: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00
[ 40.056720][ T1] >ffff88810083fd80: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
[ 40.056720][ T1] ^
[ 40.056720][ T1] ffff88810083fe00: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3 f3
[ 40.056720][ T1] ffff88810083fe80: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 40.056720][ T1] ==================================================================
[ 40.146127][ T1] Disabling lock debugging due to kernel taint
[ 40.147606][ T1] general protection fault, probably for non-canonical address 0xdffffc0000000048: 0000 [#1] SMP KASAN PTI
[ 40.150060][ T1] KASAN: null-ptr-deref in range [0x0000000000000240-0x0000000000000247]
[ 40.150060][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.18.0-rc5-00033-gbc9eb0d5ef0a #1
[ 40.150060][ T1] RIP: 0010:check_move_unevictable_folios+0x140/0xba6
[ 40.150060][ T1] Code: 48 c1 e8 03 80 3c 28 00 0f 85 b1 07 00 00 48 63 c3 4d 8b 7c c5 08 be 08 00 00 00 4c 89 ff e8 e2 e6 12 00 4c 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 a8 07 00 00 49 8b 07 a9 00 00 01 00 74 05 0f 1f
[ 40.150060][ T1] RSP: 0000:ffff88810083f930 EFLAGS: 00010207
[ 40.150060][ T1] RAX: 0000000000000048 RBX: 0000000000000000 RCX: ffffffff8154d44e
[ 40.150060][ T1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000246
[ 40.150060][ T1] RBP: dffffc0000000000 R08: 000000000000024e R09: 0000000000000000
[ 40.150060][ T1] R10: ffffffff8154d44e R11: fffffbfff0e09dc8 R12: ffff88810083f9e0
[ 40.150060][ T1] R13: ffff88810083f9d8 R14: 000000000000007e R15: 0000000000000246
[ 40.150060][ T1] FS: 0000000000000000(0000) GS:ffff8883aec00000(0000) knlGS:0000000000000000
[ 40.150060][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 40.150060][ T1] CR2: ffff88843ffff000 CR3: 0000000005466000 CR4: 00000000000406f0
[ 40.150060][ T1] Call Trace:
[ 40.150060][ T1] <TASK>
[ 40.150060][ T1] ? kasan_report.cold+0x10/0x1a
[ 40.150060][ T1] check_move_unevictable_pages+0x156/0x40f
[ 40.150060][ T1] ? check_move_unevictable_folios+0xba6/0xba6
[ 40.150060][ T1] ? lock_is_held_type+0xa5/0x111
[ 40.150060][ T1] ? lru_lazyfree_fn+0x245/0x245
[ 40.150060][ T1] ? lock_release+0xdf/0x1fb
[ 40.150060][ T1] ? mlock_page_drain_local+0x1a9/0x31b
[ 40.150060][ T1] ? lock_is_held_type+0x96/0x111
[ 40.150060][ T1] drm_gem_put_pages+0x206/0x363
[ 40.150060][ T1] ? drm_gem_vm_open+0x75/0x75
[ 40.150060][ T1] ? slab_free_freelist_hook+0xba/0x167
[ 40.150060][ T1] ? drm_gem_shmem_vunmap+0x121/0x1a2
[ 40.150060][ T1] drm_gem_shmem_put_pages_locked+0xf8/0x1f2
[ 40.150060][ T1] drm_gem_shmem_vunmap+0x13a/0x1a2
[ 40.150060][ T1] drm_gem_vunmap+0xcb/0x1d0
[ 40.150060][ T1] drm_fbdev_cleanup+0x251/0x33d
[ 40.150060][ T1] drm_fbdev_client_hotplug+0x3fa/0x50e
[ 40.150060][ T1] drm_fbdev_generic_setup+0x16b/0x3f0
[ 40.150060][ T1] vkms_create+0x401/0x470
[ 40.150060][ T1] ? drm_sched_pick_best.cold+0x32/0x32
[ 40.150060][ T1] ? drm_sched_fence_slab_init+0x31/0x31
[ 40.150060][ T1] ? vgem_init+0x1cb/0x1cb
[ 40.150060][ T1] do_one_initcall+0xbc/0x3db
[ 40.150060][ T1] ? trace_event_raw_event_initcall_level+0x19c/0x19c
[ 40.150060][ T1] ? parameq+0xcc/0xcc
[ 40.150060][ T1] do_initcalls+0x1ce/0x202
[ 40.150060][ T1] kernel_init_freeable+0x21f/0x250
[ 40.150060][ T1] ? rest_init+0x202/0x202
[ 40.150060][ T1] kernel_init+0x19/0x12b
[ 40.150060][ T1] ret_from_fork+0x22/0x30
[ 40.150060][ T1] </TASK>
To reproduce:
# build kernel
cd linux
cp config-5.18.0-rc5-00033-gbc9eb0d5ef0a .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.18.0-rc5-00033-gbc9eb0d5ef0a" of type "text/plain" (141683 bytes)
View attachment "job-script" of type "text/plain" (4936 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (11676 bytes)
Powered by blists - more mailing lists