| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 31 Jul 2022 15:56:46 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Thomas Gleixner <tglx@...utronix.de>
CC: Ammar Faizi <ammarfaizi2@...weeb.org>,
<linux-kernel@...r.kernel.org>, <lkp@...ts.01.org>, <lkp@...el.com>
Subject: [x86/putuser] b08a336b0a:
BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-11):
commit: b08a336b0a6bea785bfbb1d1783d041f40b19fce ("x86/putuser: Provide room for padding")
https://github.com/ammarfaizi2/linux-block tglx/devel/depthtracking
in testcase: trinity
version: trinity-x86_64-3f8670b2-1_20220518
with following parameters:
runtime: 300s
group: group-04
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 123.351431][ T3750] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 123.352571][ T3751] Zero length message leads to an empty skb
[ 123.353455][ T3750] #PF: supervisor write access in kernel mode
[ 123.353459][ T3750] #PF: error_code(0x0002) - not-present page
[ 123.353462][ T3750] PGD 8000000150234067 P4D 8000000150234067 PUD 0
[ 123.360538][ T3750] Oops: 0002 [#1] SMP KASAN PTI
[ 123.362218][ T3750] CPU: 0 PID: 3750 Comm: trinity-c5 Not tainted 5.19.0-rc8-00035-gb08a336b0a6b #1
[ 123.364091][ T3750] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
[ 123.366085][ T3750] RIP: 0010:__put_user_4 (arch/x86/lib/putuser.S:95)
[ 123.367871][ T3750] Code: 84 00 00 00 00 00 66 90 0f 1f 00 66 89 01 31 c9 0f 1f 00 c3 cc cc cc cc 48 bb fd ef ff ff ff 7f 00 00 48 39 d9 73 54 0f 1f 00 <89> 01 31 c9 0f 1f 00 c3 cc cc cc cc 66 90 0f 1f 00 89 01 31 c9 0f
All code
========
0: 84 00 test %al,(%rax)
2: 00 00 add %al,(%rax)
4: 00 00 add %al,(%rax)
6: 66 90 xchg %ax,%ax
8: 0f 1f 00 nopl (%rax)
b: 66 89 01 mov %ax,(%rcx)
e: 31 c9 xor %ecx,%ecx
10: 0f 1f 00 nopl (%rax)
13: c3 retq
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: 48 bb fd ef ff ff ff movabs $0x7fffffffeffd,%rbx
1f: 7f 00 00
22: 48 39 d9 cmp %rbx,%rcx
25: 73 54 jae 0x7b
27: 0f 1f 00 nopl (%rax)
2a:* 89 01 mov %eax,(%rcx) <-- trapping instruction
2c: 31 c9 xor %ecx,%ecx
2e: 0f 1f 00 nopl (%rax)
31: c3 retq
32: cc int3
33: cc int3
34: cc int3
35: cc int3
36: 66 90 xchg %ax,%ax
38: 0f 1f 00 nopl (%rax)
3b: 89 01 mov %eax,(%rcx)
3d: 31 c9 xor %ecx,%ecx
3f: 0f .byte 0xf
Code starting with the faulting instruction
===========================================
0: 89 01 mov %eax,(%rcx)
2: 31 c9 xor %ecx,%ecx
4: 0f 1f 00 nopl (%rax)
7: c3 retq
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: 66 90 xchg %ax,%ax
e: 0f 1f 00 nopl (%rax)
11: 89 01 mov %eax,(%rcx)
13: 31 c9 xor %ecx,%ecx
15: 0f .byte 0xf
[ 123.371830][ T3750] RSP: 0018:ffffc9000075fed0 EFLAGS: 00010297
[ 123.373659][ T3750] RAX: 000000000000fffe RBX: 00007fffffffeffd RCX: 0000000000000000
[ 123.375577][ T3750] RDX: 1ffff110245476b9 RSI: 000000000000002f RDI: ffff888122a3b5c8
[ 123.377482][ T3750] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffaf95cccf
[ 123.379392][ T3750] R10: fffffbfff5f2b999 R11: 0000000000000001 R12: 0000000000000000
[ 123.381293][ T3750] R13: ffffffffae0ffa80 R14: ffff88839d64dea0 R15: 000000000000fffe
[ 123.383189][ T3750] FS: 00007fce9002e600(0000) GS:ffff88839d600000(0000) knlGS:0000000000000000
[ 123.385145][ T3750] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 123.387016][ T3750] CR2: 0000000000000000 CR3: 000000013ec78000 CR4: 00000000000406f0
[ 123.388925][ T3750] DR0: 00007fce8e1d9000 DR1: 0000000000000000 DR2: 0000000000000000
[ 123.390829][ T3750] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[ 123.392708][ T3750] Call Trace:
[ 123.394352][ T3750] <TASK>
[ 123.395946][ T3750] groups_to_user (kernel/groups.c:47)
[ 123.397679][ T3750] __x64_sys_getgroups (kernel/groups.c:169 kernel/groups.c:148 kernel/groups.c:148)
[ 123.399376][ T3750] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 123.401046][ T3750] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[ 123.403400][ T3750] RIP: 0033:0x7fce8ff609b9
[ 123.406079][ T3750] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48
All code
========
0: 00 c3 add %al,%bl
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 8b 0d a7 54 0c 00 mov 0xc54a7(%rip),%rcx # 0xc54e1
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 retq
9: 48 8b 0d a7 54 0c 00 mov 0xc54a7(%rip),%rcx # 0xc54b7
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
[ 123.411497][ T3750] RSP: 002b:00007fff05a38318 EFLAGS: 00000246 ORIG_RAX: 0000000000000073
[ 123.413449][ T3750] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fce8ff609b9
[ 123.415444][ T3750] RDX: ffffffffffff00f3 RSI: 0000000000000000 RDI: 0000000009000400
[ 123.417316][ T3750] RBP: 00007fce8e8e7000 R08: 0000000000000093 R09: 0000000000008000
[ 123.419266][ T3750] R10: 000000000a0a0a0a R11: 0000000000000246 R12: 0000000000000073
[ 123.421130][ T3750] R13: 00007fce9002e580 R14: 00007fce8e8e7058 R15: 00007fce8e8e7000
[ 123.423035][ T3750] </TASK>
[ 123.424634][ T3750] Modules linked in: can_bcm can_raw can crypto_user nfnetlink scsi_transport_iscsi atm sctp ip6_udp_tunnel udp_tunnel libcrc32c sr_mod cdrom sg intel_rapl_msr bochs drm_vram_helper ppdev intel_rapl_common drm_ttm_helper crct10dif_pclmul crc32_pclmul ttm crc32c_intel ghash_clmulni_intel ata_generic rapl joydev ata_piix drm_kms_helper serio_raw syscopyarea libata sysfillrect sysimgblt ipmi_devintf ipmi_msghandler parport_pc i2c_piix4 fb_sys_fops parport drm fuse ip_tables
[ 123.433229][ T3750] CR2: 0000000000000000
To reproduce:
# build kernel
cd linux
cp config-5.19.0-rc8-00035-gb08a336b0a6b .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.19.0-rc8-00035-gb08a336b0a6b" of type "text/plain" (164693 bytes)
View attachment "job-script" of type "text/plain" (4764 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (15672 bytes)
Powered by blists - more mailing lists