linux-kernel - Re: selftests: ftrace: RIP: 0010:__lock_acquire (kernel/locking/lockdep.c:5005)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <8f86f22a-e182-4ddf-b533-b4ae8b088dd4@app.fastmail.com>
Date:   Fri, 27 Oct 2023 14:55:14 +0200
From:   "Arnd Bergmann" <arnd@...db.de>
To:     "Naresh Kamboju" <naresh.kamboju@...aro.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@...r.kernel.org>,
        linux-trace-kernel@...r.kernel.org,
        "open list" <linux-kernel@...r.kernel.org>,
        linux-mm <linux-mm@...ck.org>, lkft-triage@...ts.linaro.org
Cc:     "Masami Hiramatsu" <mhiramat@...nel.org>,
        "Mark Rutland" <mark.rutland@....com>,
        "Andrew Morton" <akpm@...ux-foundation.org>,
        "Steven Rostedt" <rostedt@...dmis.org>,
        "Oleg Nesterov" <oleg@...hat.com>, "Dave Jones" <davej@...hat.com>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        "Paul McKenney" <paulmck@...ux.vnet.ibm.com>,
        "Alan Stern" <stern@...land.harvard.edu>,
        "Sasha Levin" <sasha.levin@...cle.com>,
        "Peter Zijlstra" <peterz@...radead.org>,
        "Ingo Molnar" <mingo@...nel.org>,
        "Dan Carpenter" <dan.carpenter@...aro.org>,
        "Ajay Kaher" <akaher@...are.com>
Subject: Re: selftests: ftrace: RIP: 0010:__lock_acquire
 (kernel/locking/lockdep.c:5005)

On Fri, Oct 27, 2023, at 13:47, Naresh Kamboju wrote:
> Following kernel crash noticed on x86_64 while running selftests ftracetests
> running 6.6.0-rc7-next-20231026.
>
> Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>

My guess would be that this is caused by 5790b1fb3d67 ("eventfs:
Remove eventfs_file and just use eventfs_inode"), in which
Steven Rostedt recently added the create_dir_dentry() function
through a rewrite:


> log:
> -----
> # ok 44 ftrace - test for function traceon/off triggers
> # ok 45 ftrace - test tracing error log support
> # ok 46 Test creation and deletion of trace instances while setting an event
> [ 1402.419605] BUG: kernel NULL pointer dereference, address: 0000000000000097
> [ 1402.426574] #PF: supervisor read access in kernel mode
...
> [ 1402.581170] ? exc_page_fault (arch/x86/include/asm/irqflags.h:26
> arch/x86/include/asm/irqflags.h:67 arch/x86/include/asm/irqflags.h:127
> arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561)
> [ 1402.585094] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
> [ 1402.589283] ? __lock_acquire (kernel/locking/lockdep.c:5005)
> [ 1402.593296] ? lock_acquire (kernel/locking/lockdep.c:467
> (discriminator 4) kernel/locking/lockdep.c:5755 (discriminator 4)
> kernel/locking/lockdep.c:5718 (discriminator 4))

The lock passed to spin_lock() and lock_acquire() is a NULL
pointer.

> [ 1402.597045] ? create_dir_dentry.part.0
> (fs/tracefs/event_inode.c:357 (discriminator 1))
> [ 1402.601928] lock_acquire (kernel/locking/lockdep.c:467
> (discriminator 4) kernel/locking/lockdep.c:5755 (discriminator 4)
> kernel/locking/lockdep.c:5718 (discriminator 4))
> [ 1402.605503] ? d_invalidate (fs/dcache.c:1725 (discriminator 1))


This lock is part of the dentry passed to d_invalidate()

> [ 1402.609170] ? lock_release (kernel/locking/lockdep.c:5429
> kernel/locking/lockdep.c:5773)
> [ 1402.612923] ? create_dir_dentry.part.0 (fs/tracefs/event_inode.c:387)
> [ 1402.617803] _raw_spin_lock (include/linux/spinlock_api_smp.h:134
> kernel/locking/spinlock.c:154)
> [ 1402.621467] ? d_invalidate (fs/dcache.c:1725 (discriminator 1))
> [ 1402.625126] d_invalidate (fs/dcache.c:1725 (discriminator 1))
> [ 1402.628619] create_dir_dentry.part.0 (fs/tracefs/event_inode.c:390)

Which is called by create_dir_dentry(). I don't see a bug
in that function, but maybe Steve has an idea.

    Arnd