| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CA+G9fYsGFoC5TciCuijZXLx48TZnoTSkq=iUgb+vFdi9EYTucw@mail.gmail.com>
Date: Wed, 2 Nov 2022 18:42:52 +0530
From: Naresh Kamboju <naresh.kamboju@...aro.org>
To: linux-perf-users@...r.kernel.org,
open list <linux-kernel@...r.kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
regressions@...ts.linux.dev, lkft-triage@...ts.linaro.org,
Marco Elver <elver@...gle.com>,
"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: qemu-i386: perf: BUG: kernel NULL pointer dereference, address: 00000148
Following kernel BUG: noticed on qemu-i386 while running perf test suite
on stable-rc 6.0.7-rc1 the image was built with gcc-11.
The System did not recover after the crash.
Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
syscalls:sys_enter_openat event fields: Ok
17: Setup struct perf_event_attr :
--- start ---
test child forked, pid 433
Using CPUID AuthenticAMD-23-1-2
/usr/libexec/perf-core/tests/attr.py:142: DeprecationWarning: The
SafeConfigParser class has been renamed to ConfigParser in Python 3.2.
This alias will be removed in Python 3.12. Use ConfigParser directly
instead.
parser = configparser.SafeConfigParser()
running '/usr/libexec/perf-core/tests/attr/test-record-no-samples'
/usr/libexec/perf-core/tests/attr.py:201: DeprecationWarning: The
SafeConfigParser class has been renamed to ConfigParser in Python 3.2.
This alias will be removed in Python 3.12. Use ConfigParser directly
instead.
parser_event = configparser.SafeConfigParser()
/usr/libexec/perf-core/tests/attr.py:215: DeprecationWarning: The
SafeConfigParser class has been renamed to ConfigParser in Python 3.2.
This alias will be removed in Python 3.12. Use ConfigParser directly
instead.
parser_base = configparser.SafeConfigParser()
running '/usr/libexec/perf-core/tests/attr/test-record-graph-fp-aarch64'
test limitation 'aarch64'
skipped [i686] '/usr/libexec/perf-core/tests/attr/test-record-graph-fp-aarch64'
running '/usr/libexec/perf-core/tests/attr/test-record-branch-filter-any_ret'
unsupp '/usr/libexec/perf-core/tests/attr/test-record-branch-filter-any_ret'
running '/usr/libexec/perf-core/tests/attr/test-record-branch-filter-ind_call'
unsupp '/usr/libexec/perf-core/tests/attr/test-record-branch-filter-ind_call'
running '/usr/libexec/perf-core/tests/attr/test-record-spe-physical-address'
test limitation 'aarch64'
skipped [i686] '/usr/libexec/perf-core/tests/attr/test-record-spe-physical-address'
running '/usr/libexec/perf-core/tests/attr/test-record-C0'
[ 115.046512] perf: interrupt took too long (11109 > 11096), lowering
kernel.perf_event_max_sample_rate to 18000
running '/usr/libexec/perf-core/tests/attr/test-record-group'
[ 116.006600] BUG: kernel NULL pointer dereference, address: 00000148
[ 116.008309] #PF: supervisor read access in kernel mode
[ 116.009527] #PF: error_code(0x0000) - not-present page
[ 116.010809] *pde = 00000000
[ 116.011454] Oops: 0000 [#1] PREEMPT SMP
[ 116.012144] CPU: 2 PID: 449 Comm: perf-exec Not tainted 6.0.7-rc1 #1
[ 116.013256] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.12.0-1 04/01/2014
[ 116.014710] EIP: x86_pmu_enable_event+0x4a/0x190
[ 116.015617] Code: 64 a1 10 2c 8d c6 85 c0 75 16 8b 5d f4 8b 75 f8
8b 7d fc 89 ec 5d c3 8d b4 26 00 00 00 00 66 90 b8 43 bb 49 c6 e8 56
13 fb 00 <8b> b3 48 01 00 00 b8 dc 39 8d c6 64 03 05 b0 28 8d c6 8b 38
85 f6
[ 116.018642] EAX: 00000002 EBX: 00000000 ECX: c0010200 EDX: c649bb43
[ 116.019709] ESI: f51c6b00 EDI: f51c6c00 EBP: c34e1da4 ESP: c34e1d88
[ 116.020744] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00210002
[ 116.021847] CR0: 80050033 CR2: 00000148 CR3: 03e07000 CR4: 003506d0
[ 116.022930] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 116.023674] DR6: ffff4ff0 DR7: 00000400
[ 116.024078] Call Trace:
[ 116.024348] amd_pmu_enable_all+0x3d/0x50
[ 116.024776] x86_pmu_enable+0x17c/0x370
[ 116.025179] ctx_resched+0xad/0xf0
[ 116.025542] perf_event_exec+0x338/0x400
[ 116.025956] begin_new_exec+0x548/0xac0
[ 116.026358] load_elf_binary+0x2ad/0x1360
[ 116.027063] ? __kernel_read+0x12c/0x220
[ 116.027520] ? _raw_read_unlock+0x1d/0x40
[ 116.027957] ? load_misc_binary+0x1eb/0x290
[ 116.028404] ? trace_preempt_on+0x29/0xe0
[ 116.028827] ? load_misc_binary+0x1eb/0x290
[ 116.029287] ? preempt_count_sub+0xc1/0x110
[ 116.029722] ? bprm_execve+0x256/0x650
[ 116.030122] ? preempt_count_sub+0xc1/0x110
[ 116.030600] bprm_execve+0x260/0x650
[ 116.031006] do_execveat_common+0x13f/0x1b0
[ 116.031482] __ia32_sys_execve+0x35/0x40
[ 116.031897] __do_fast_syscall_32+0x4c/0xc0
[ 116.032358] do_fast_syscall_32+0x32/0x70
[ 116.032777] do_SYSENTER_32+0x15/0x20
[ 116.033190] entry_SYSENTER_32+0x98/0xf1
[ 116.033601] EIP: 0xb7eda549
[ 116.033903] Code: Unable to access opcode bytes at RIP 0xb7eda51f.
[ 116.034576] EAX: ffffffda EBX: bfa6d940 ECX: bfa730f8 EDX: 08ea9dc0
[ 116.035278] ESI: bfa73d61 EDI: bfa6d949 EBP: bfa6da38 ESP: bfa6d918
[ 116.035927] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 007b EFLAGS: 00200296
[ 116.036624] Modules linked in:
[ 116.036961] CR2: 0000000000000148
[ 116.037315] ---[ end trace 0000000000000000 ]---
[ 116.037753] EIP: x86_pmu_enable_event+0x4a/0x190
[ 116.038190] Code: 64 a1 10 2c 8d c6 85 c0 75 16 8b 5d f4 8b 75 f8
8b 7d fc 89 ec 5d c3 8d b4 26 00 00 00 00 66 90 b8 43 bb 49 c6 e8 56
13 fb 00 <8b> b3 48 01 00 00 b8 dc 39 8d c6 64 03 05 b0 28 8d c6 8b 38
85 f6
[ 116.039918] EAX: 00000002 EBX: 00000000 ECX: c0010200 EDX: c649bb43
[ 116.040509] ESI: f51c6b00 EDI: f51c6c00 EBP: c34e1da4 ESP: c34e1d88
[ 116.041092] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00210002
[ 116.041720] CR0: 80050033 CR2: b7eda51f CR3: 03e07000 CR4: 003506d0
[ 116.042301] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 116.042895] DR6: ffff4ff0 DR7: 00000400
[ 116.043254] note: perf-exec[449] exited with preempt_count 2
[ 136.996781] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[ 136.998413] rcu: 2-...0: (1 ticks this GP) idle=ed7c/1/0x40000000
softirq=4094/4094 fqs=4847
[ 137.000598] (detected by 1, t=21002 jiffies, g=7361, q=198 ncpus=4)
[ 137.002418] Sending NMI from CPU 1 to CPUs 2:
[ 137.003676] NMI backtrace for cpu 2
[ 137.003689] CPU: 2 PID: 449 Comm: perf-exec Tainted: G D
6.0.7-rc1 #1
[ 137.003694] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.12.0-1 04/01/2014
[ 137.003697] EIP: queued_spin_lock_slowpath+0x3a/0x2d0
[ 137.003710] Code: 3e 8d 74 26 00 ba 01 00 00 00 8d b6 00 00 00 00
8b 03 85 c0 75 12 f0 0f b1 13 85 c0 75 f2 58 5b 5e 5f 5d c3 8d 74 26
00 f3 90 <eb> e4 8d 74 26 00 81 fa 00 01 00 00 74 50 81 e2 00 ff ff ff
85 d2
[ 137.003712] EAX: 00000001 EBX: c331e0c4 ECX: 00000000 EDX: 00000001
[ 137.003714] ESI: 00000002 EDI: c331e0c0 EBP: c34e1d94 ESP: c34e1d84
[ 137.003716] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00200002
[ 137.003720] CR0: 80050033 CR2: b7eda51f CR3: 03e07000 CR4: 003506d0
[ 137.003723] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 137.003724] DR6: ffff4ff0 DR7: 00000400
[ 137.003725] Call Trace:
[ 137.003731] _raw_spin_lock+0x31/0x40
[ 137.003737] perf_event_task_tick+0x97/0x370
[ 137.003743] ? task_tick_fair+0x77/0x2f0
[ 137.003747] ? __wake_up+0x21/0x30
[ 137.003751] ? update_rq_clock+0x39/0x200
[ 137.003754] ? task_fork_fair+0x180/0x180
[ 137.003756] scheduler_tick+0xbe/0x2b0
[ 137.003760] ? task_fork_fair+0x180/0x180
[ 137.003761] update_process_times+0x85/0x90
[ 137.003766] tick_sched_handle+0x3d/0x60
[ 137.003769] tick_sched_timer+0x92/0xb0
[ 137.003771] __hrtimer_run_queues+0xb2/0x300
[ 137.003774] ? tick_sched_do_timer+0xa0/0xa0
[ 137.003776] hrtimer_interrupt+0x129/0x270
[ 137.003778] ? _prb_read_valid+0x84/0x3c0
[ 137.003783] ? sysvec_call_function_single+0x50/0x50
[ 137.003785] __sysvec_apic_timer_interrupt+0x76/0x160
[ 137.003791] ? debug_smp_processor_id+0x12/0x20
[ 137.003793] sysvec_apic_timer_interrupt+0x31/0x50
[ 137.003794] handle_exception+0x133/0x133
[ 137.003796] EIP: _raw_spin_unlock_irq+0x16/0x40
[ 137.003799] Code: c0 74 09 5d c3 8d b4 26 00 00 00 00 e8 73 25 00
00 5d c3 90 3e 8d 74 26 00 55 89 e5 c6 00 00 e8 c0 cb 25 ff fb b8 01
00 00 00 <e8> 45 b1 17 ff 64 a1 0c 77 8d c6 85 c0 74 0b 5d c3 8d b4 26
00 00
[ 137.003801] EAX: 00000001 EBX: c26f24c0 ECX: c5111bf4 EDX: 00000001
[ 137.003802] ESI: c26f24c0 EDI: 00000000 EBP: c34e1f4c ESP: c34e1f4c
[ 137.003803] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00200246
[ 137.003805] ? do_exit+0x54/0x9c0
[ 137.003809] ? sysvec_call_function_single+0x50/0x50
[ 137.003811] ? sysvec_call_function_single+0x50/0x50
[ 137.003812] ? _raw_spin_unlock_irq+0x16/0x40
[ 137.003814] do_exit+0x54/0x9c0
[ 137.003816] ? vprintk+0x55/0x60
[ 137.003818] make_task_dead+0x56/0x60
[ 137.003820] rewind_stack_and_make_dead+0x11/0x20
[ 137.003824] EIP: 0xb7eda549
[ 137.003837] Code: Unable to access opcode bytes at RIP 0xb7eda51f.
[ 137.003838] EAX: ffffffda EBX: bfa6d940 ECX: bfa730f8 EDX: 08ea9dc0
[ 137.003839] ESI: bfa73d61 EDI: bfa6d949 EBP: bfa6da38 ESP: bfa6d918
[ 137.003840] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 007b EFLAGS: 00200296
[ 200.005419] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[ 200.010134] rcu: 2-...0: (1 ticks this GP) idle=ed7c/1/0x40000000
softirq=4094/4094 fqs=19175
[ 200.011177] (detected by 1, t=84017 jiffies, g=7361, q=436 ncpus=4)
[ 200.011949] Sending NMI from CPU 1 to CPUs 2:
[ 200.012561] NMI backtrace for cpu 2
[ 200.012569] CPU: 2 PID: 449 Comm: perf-exec Tainted: G D
6.0.7-rc1 #1
[ 200.012572] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.12.0-1 04/01/2014
[ 200.012574] EIP: queued_spin_lock_slowpath+0x3a/0x2d0
[ 200.012583] Code: 3e 8d 74 26 00 ba 01 00 00 00 8d b6 00 00 00 00
8b 03 85 c0 75 12 f0 0f b1 13 85 c0 75 f2 58 5b 5e 5f 5d c3 8d 74 26
00 f3 90 <eb> e4 8d 74 26 00 81 fa 00 01 00 00 74 50 81 e2 00 ff ff ff
85 d2
[ 200.012585] EAX: 00000001 EBX: c331e0c4 ECX: 00000000 EDX: 00000001
[ 200.012587] ESI: 00000002 EDI: c331e0c0 EBP: c34e1d94 ESP: c34e1d84
[ 200.012588] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00200002
[ 200.012592] CR0: 80050033 CR2: b7eda51f CR3: 03e07000 CR4: 003506d0
[ 200.012595] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 200.012596] DR6: ffff4ff0 DR7: 00000400
[ 200.012597] Call Trace:
[ 200.012601] _raw_spin_lock+0x31/0x40
[ 200.012606] perf_event_task_tick+0x97/0x370
[ 200.012610] ? task_tick_fair+0x77/0x2f0
[ 200.012613] ? __wake_up+0x21/0x30
[ 200.012616] ? update_rq_clock+0x39/0x200
[ 200.012618] ? task_fork_fair+0x180/0x180
[ 200.012620] scheduler_tick+0xbe/0x2b0
[ 200.012622] ? task_fork_fair+0x180/0x180
[ 200.012624] update_process_times+0x85/0x90
[ 200.012627] tick_sched_handle+0x3d/0x60
[ 200.012629] tick_sched_timer+0x92/0xb0
[ 200.012631] __hrtimer_run_queues+0xb2/0x300
[ 200.012633] ? tick_sched_do_timer+0xa0/0xa0
[ 200.012635] hrtimer_interrupt+0x129/0x270
[ 200.012638] ? _prb_read_valid+0x84/0x3c0
[ 200.012641] ? sysvec_call_function_single+0x50/0x50
[ 200.012643] __sysvec_apic_timer_interrupt+0x76/0x160
[ 200.012647] ? debug_smp_processor_id+0x12/0x20
[ 200.012648] sysvec_apic_timer_interrupt+0x31/0x50
[ 200.012650] handle_exception+0x133/0x133
metadata:
git_ref: linux-6.0.y
git_repo: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
git_sha: 436175d0f780af8302164b3102ecf0ff99f7a376
git_describe: v6.0.6-241-g436175d0f780
kernel_version: 6.0.7-rc1
kernel-config: https://builds.tuxbuild.com/2GyMhllOBAqVhs03YoIHIAE7E8c/config
build-url: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/pipelines/683032123
artifact-location: https://builds.tuxbuild.com/2GyMhllOBAqVhs03YoIHIAE7E8c
toolchain: gcc-11
Test full log link,
https://lkft.validation.linaro.org/scheduler/job/5799947#L16491
--
Linaro LKFT
https://lkft.linaro.org
Powered by blists - more mailing lists