| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202301151942.4b0281d1-yujie.liu@intel.com>
Date: Mon, 16 Jan 2023 00:01:54 +0800
From: kernel test robot <yujie.liu@...el.com>
To: Kefeng Wang <wangkefeng.wang@...wei.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-mm@...ck.org>,
<akpm@...ux-foundation.org>, <willy@...radead.org>,
<linux-kernel@...r.kernel.org>,
Kefeng Wang <wangkefeng.wang@...wei.com>
Subject: Re: [PATCH -next 5/7] mm: memory: convert wp_page_copy() to use
folios
Greeting,
FYI, we noticed BUG:kernel_NULL_pointer_dereference,address due to commit (built with gcc-11):
commit: 94dd2d69bf084166a5537f957dac6a3b79fa238f ("[PATCH -next 5/7] mm: memory: convert wp_page_copy() to use folios")
url: https://github.com/intel-lab-lkp/linux/commits/Kefeng-Wang/mm-huge_memory-make-__do_huge_pmd_anonymous_page-to-take-a-folio/20230112-161810
base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything
patch link: https://lore.kernel.org/all/20230112083006.163393-6-wangkefeng.wang@huawei.com/
patch subject: [PATCH -next 5/7] mm: memory: convert wp_page_copy() to use folios
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
[ 6.211602][ T64] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 6.213035][ T64] #PF: supervisor read access in kernel mode
[ 6.214169][ T64] #PF: error_code(0x0000) - not-present page
[ 6.215275][ T64] PGD 80000001202fc067 P4D 80000001202fc067 PUD 1202f9067 PMD 0
[ 6.216694][ T64] Oops: 0000 [#1] SMP PTI
[ 6.217525][ T64] CPU: 1 PID: 64 Comm: modprobe Not tainted 6.2.0-rc3-00317-g94dd2d69bf08 #1
[ 6.219042][ T64] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
[ 6.220947][ T64] RIP: 0010:_compound_head (include/linux/page-flags.h:251)
[ 6.221957][ T64] Code: 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> 8b 47 08 a8 01 75 24 66 90 48 89 f8 c3 cc cc cc cc f7 c7 ff 0f
All code
========
0: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
7: 00 00 00
a: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
11: 00 00 00 00
15: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
29: 90 nop
2a:* 48 8b 47 08 mov 0x8(%rdi),%rax <-- trapping instruction
2e: a8 01 test $0x1,%al
30: 75 24 jne 0x56
32: 66 90 xchg %ax,%ax
34: 48 89 f8 mov %rdi,%rax
37: c3 retq
38: cc int3
39: cc int3
3a: cc int3
3b: cc int3
3c: f7 .byte 0xf7
3d: c7 (bad)
3e: ff 0f decl (%rdi)
Code starting with the faulting instruction
===========================================
0: 48 8b 47 08 mov 0x8(%rdi),%rax
4: a8 01 test $0x1,%al
6: 75 24 jne 0x2c
8: 66 90 xchg %ax,%ax
a: 48 89 f8 mov %rdi,%rax
d: c3 retq
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: f7 .byte 0xf7
13: c7 (bad)
14: ff 0f decl (%rdi)
[ 6.225382][ T64] RSP: 0000:ffffc900004c3d38 EFLAGS: 00010282
[ 6.226529][ T64] RAX: 0000000000000a55 RBX: ffffc900004c3df8 RCX: 0000000000003663
[ 6.230756][ T64] RDX: 0000000000000000 RSI: 00000000f7f80000 RDI: 0000000000000000
[ 6.232224][ T64] RBP: ffff8881202f6240 R08: 8000000003663225 R09: ffff888120201000
[ 6.233742][ T64] R10: 0000000000000000 R11: 00000000f7f80684 R12: 00000000f7f80684
[ 6.235231][ T64] R13: 0000000000000df8 R14: 0000000000000000 R15: ffff88812024f440
[ 6.236759][ T64] FS: 0000000000000000(0000) GS:ffff88842fd00000(0063) knlGS:00000000f7ddb900
[ 6.238454][ T64] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 6.239697][ T64] CR2: 0000000000000008 CR3: 00000001009e2000 CR4: 00000000000406e0
[ 6.241215][ T64] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 6.242709][ T64] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 6.244212][ T64] Call Trace:
[ 6.244933][ T64] <TASK>
[ 6.245575][ T64] wp_page_copy (mm/memory.c:3047)
[ 6.246461][ T64] ? do_anonymous_page (arch/x86/include/asm/preempt.h:85 include/linux/spinlock_api_smp.h:143 include/linux/spinlock.h:390 mm/memory.c:4106)
[ 6.247440][ T64] __handle_mm_fault (mm/memory.c:5061)
[ 6.248338][ T64] handle_mm_fault (mm/memory.c:5207)
[ 6.249227][ T64] do_user_addr_fault (arch/x86/mm/fault.c:1407)
[ 6.250166][ T64] ? do_set_thread_area (arch/x86/kernel/tls.c:152)
[ 6.251133][ T64] exc_page_fault (arch/x86/include/asm/irqflags.h:40 arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1506 arch/x86/mm/fault.c:1554)
[ 6.252009][ T64] asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 6.252931][ T64] RIP: 0023:0xf7df587c
[ 6.253753][ T64] Code: 1c 31 c0 89 5c 24 0c e8 45 d4 10 00 81 c3 96 77 18 00 89 74 24 10 87 de 0f a2 87 de 81 f9 6e 74 65 6c 89 7c 24 14 89 6c 24 18 <89> 83 90 36 00 00 75 14 81 fe 47 65 6e 75 75 0c 81 fa 69 6e 65 49
All code
========
0: 1c 31 sbb $0x31,%al
2: c0 89 5c 24 0c e8 45 rorb $0x45,-0x17f3dba4(%rcx)
9: d4 (bad)
a: 10 00 adc %al,(%rax)
c: 81 c3 96 77 18 00 add $0x187796,%ebx
12: 89 74 24 10 mov %esi,0x10(%rsp)
16: 87 de xchg %ebx,%esi
18: 0f a2 cpuid
1a: 87 de xchg %ebx,%esi
1c: 81 f9 6e 74 65 6c cmp $0x6c65746e,%ecx
22: 89 7c 24 14 mov %edi,0x14(%rsp)
26: 89 6c 24 18 mov %ebp,0x18(%rsp)
2a:* 89 83 90 36 00 00 mov %eax,0x3690(%rbx) <-- trapping instruction
30: 75 14 jne 0x46
32: 81 fe 47 65 6e 75 cmp $0x756e6547,%esi
38: 75 0c jne 0x46
3a: 81 fa 69 6e 65 49 cmp $0x49656e69,%edx
Code starting with the faulting instruction
===========================================
0: 89 83 90 36 00 00 mov %eax,0x3690(%rbx)
6: 75 14 jne 0x1c
8: 81 fe 47 65 6e 75 cmp $0x756e6547,%esi
e: 75 0c jne 0x1c
10: 81 fa 69 6e 65 49 cmp $0x49656e69,%edx
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202301151942.4b0281d1-yujie.liu@intel.com
To reproduce:
# build kernel
cd linux
cp config-6.2.0-rc3-00317-g94dd2d69bf08 .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
View attachment "config-6.2.0-rc3-00317-g94dd2d69bf08" of type "text/plain" (167003 bytes)
View attachment "job-script" of type "text/plain" (4891 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (25240 bytes)
Powered by blists - more mailing lists