| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202401161610.edf0ac63-oliver.sang@intel.com>
Date: Tue, 16 Jan 2024 16:29:35 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Gui-Dong Han <2045gemini@...il.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
<linux-serial@...r.kernel.org>, <gregkh@...uxfoundation.org>,
<jirislaby@...nel.org>, <baijiaju1990@...look.com>, Gui-Dong Han
<2045gemini@...il.com>, <stable@...r.kernel.org>, <oliver.sang@...el.com>
Subject: Re: [PATCH] tty: fix atomicity violation in n_tty_read
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 5c6ca526d56e87f85cf980c77f7470e76e5dd5f7 ("[PATCH] tty: fix atomicity violation in n_tty_read")
url: https://github.com/intel-lab-lkp/linux/commits/Gui-Dong-Han/tty-fix-atomicity-violation-in-n_tty_read/20240112-205942
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/tty.git tty-testing
patch link: https://lore.kernel.org/all/20240112125801.2650-1-2045gemini@gmail.com/
patch subject: [PATCH] tty: fix atomicity violation in n_tty_read
in testcase: boot
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+---------------------------------------------+------------+------------+
| | 0c84bea0ca | 5c6ca526d5 |
+---------------------------------------------+------------+------------+
| boot_failures | 0 | 6 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 6 |
| Oops:#[##] | 0 | 6 |
| RIP:_raw_spin_lock_irq | 0 | 6 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 6 |
+---------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202401161610.edf0ac63-oliver.sang@intel.com
[ 53.979086][ T401] BUG: kernel NULL pointer dereference, address: 00000000000001d0
[ 53.989877][ T401] #PF: supervisor write access in kernel mode
[ 53.998103][ T401] #PF: error_code(0x0002) - not-present page
[ 54.006595][ T401] PGD 800000011f423067 P4D 800000011f423067 PUD 303527067 PMD 0
[ 54.017130][ T401] Oops: 0002 [#1] SMP PTI
[ 54.022798][ T401] CPU: 1 PID: 401 Comm: getty Not tainted 6.7.0-rc5-00199-g5c6ca526d56e #1
[ 54.032166][ T401] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 54.046197][ T401] RIP: 0010:_raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 54.054135][ T401] Code: cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e8 1d 01 00 00 90 c3 cc cc
All code
========
0: cc int3
1: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
8: 00
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: f3 0f 1e fa endbr64
1d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
22: fa cli
23: 31 c0 xor %eax,%eax
25: ba 01 00 00 00 mov $0x1,%edx
2a:* f0 0f b1 17 lock cmpxchg %edx,(%rdi) <-- trapping instruction
2e: 75 05 jne 0x35
30: c3 retq
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: 89 c6 mov %eax,%esi
37: e8 1d 01 00 00 callq 0x159
3c: 90 nop
3d: c3 retq
3e: cc int3
3f: cc int3
Code starting with the faulting instruction
===========================================
0: f0 0f b1 17 lock cmpxchg %edx,(%rdi)
4: 75 05 jne 0xb
6: c3 retq
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: 89 c6 mov %eax,%esi
d: e8 1d 01 00 00 callq 0x12f
12: 90 nop
13: c3 retq
14: cc int3
15: cc int3
[ 54.079836][ T401] RSP: 0018:ffffab01406cbcd8 EFLAGS: 00010046
[ 54.088222][ T401] RAX: 0000000000000000 RBX: ffffab01406cbdc8 RCX: 0000000000000000
[ 54.098106][ T401] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 00000000000001d0
[ 54.109098][ T401] RBP: ffffab01406e9000 R08: ffff9dfa447a2210 R09: ffff9dfa447a2210
[ 54.119762][ T401] R10: ffff9dfa447a2210 R11: 0000000000000000 R12: 0000000000000000
[ 54.130902][ T401] R13: 7fffffffffffffff R14: ffff9dfa447a2000 R15: 0000000000000000
[ 54.141603][ T401] FS: 0000000000000000(0000) GS:ffff9dfd2fd00000(0063) knlGS:00000000f7e1f900
[ 54.153625][ T401] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 54.162764][ T401] CR2: 00000000000001d0 CR3: 0000000144742000 CR4: 00000000000006f0
[ 54.171900][ T401] Call Trace:
[ 54.182172][ T401] <TASK>
[ 54.186095][ T401] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)
[ 54.191409][ T401] ? page_fault_oops (arch/x86/mm/fault.c:707)
[ 54.197798][ T401] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:72 arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561)
[ 54.204312][ T401] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 54.211244][ T401] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 54.211300][ T401] n_tty_read (drivers/tty/n_tty.c:2226)
[ 54.216906][ T401] ? __pfx_woken_wake_function (kernel/sched/wait.c:439)
[ 54.233693][ T401] tty_read (drivers/tty/tty_io.c:862 drivers/tty/tty_io.c:937)
[ 54.239403][ T401] vfs_read (include/linux/fs.h:2014 fs/read_write.c:389 fs/read_write.c:470)
[ 54.244978][ T401] ksys_read (fs/read_write.c:613)
[ 54.249805][ T401] __do_fast_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:321)
[ 54.255574][ T401] do_fast_syscall_32 (arch/x86/entry/common.c:346)
[ 54.255607][ T401] entry_SYSENTER_compat_after_hwframe (arch/x86/entry/entry_64_compat.S:121)
[ 54.255641][ T401] RIP: 0023:0xf7fce589
[ 54.255671][ T401] Code: 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
All code
========
0: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
...
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24:* 89 e5 mov %esp,%ebp <-- trapping instruction
26: 0f 34 sysenter
28: cd 80 int $0x80
2a: 5d pop %rbp
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
39: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 retq
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
f: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240116/202401161610.edf0ac63-oliver.sang@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists