| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202405171417.1bb0856a-lkp@intel.com>
Date: Fri, 17 May 2024 15:03:20 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Miaohe Lin <linmiaohe@...wei.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-mm@...ck.org>,
<akpm@...ux-foundation.org>, <shy828301@...il.com>,
<nao.horiguchi@...il.com>, <xuyu@...ux.alibaba.com>, <linmiaohe@...wei.com>,
<linux-kernel@...r.kernel.org>, <oliver.sang@...el.com>
Subject: Re: [PATCH -rc7] mm/huge_memory: mark huge_zero_page reserved
Hello,
kernel test robot noticed "kernel_BUG_at_include/linux/page-flags.h" on:
commit: 8e6ff9c4aad2c677c53f70d9e193c35cbbafcb88 ("[PATCH -rc7] mm/huge_memory: mark huge_zero_page reserved")
url: https://github.com/intel-lab-lkp/linux/commits/Miaohe-Lin/mm-huge_memory-mark-huge_zero_page-reserved/20240511-115840
base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git cf87f46fd34d6c19283d9625a7822f20d90b64a4
patch link: https://lore.kernel.org/all/20240511035435.1477004-1-linmiaohe@huawei.com/
patch subject: [PATCH -rc7] mm/huge_memory: mark huge_zero_page reserved
in testcase: trinity
version: trinity-i386-abe9de86-1_20230429
with following parameters:
runtime: 300s
group: group-03
nr_groups: 5
compiler: gcc-13
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+------------------------------------------+------------+------------+
| | cf87f46fd3 | 8e6ff9c4aa |
+------------------------------------------+------------+------------+
| kernel_BUG_at_include/linux/page-flags.h | 0 | 11 |
| invalid_opcode:#[##] | 0 | 11 |
| RIP:get_huge_zero_page | 0 | 11 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 11 |
+------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202405171417.1bb0856a-lkp@intel.com
[ 272.633454][ T3838] ------------[ cut here ]------------
[ 272.634362][ T3838] kernel BUG at include/linux/page-flags.h:540!
[ 272.635422][ T3838] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
[ 272.636518][ T3838] CPU: 0 PID: 3838 Comm: trinity-c2 Not tainted 6.9.0-rc7-00184-g8e6ff9c4aad2 #1
[ 272.638008][ T3838] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 272.639707][ T3838] RIP: 0010:get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.650951][ T3838] Code: 04 02 00 00 00 65 ff 0d 0a 0b 75 7e 74 1e 65 48 ff 05 50 e5 74 7e e9 5c fe ff ff 48 c7 c6 a0 bb 52 83 48 89 df e8 64 89 f2 ff <0f> 0b 0f 1f 44 00 00 eb db 48 c7 c6 40 bc 52 83 48 89 df e8 4c 89
All code
========
0: 04 02 add $0x2,%al
2: 00 00 add %al,(%rax)
4: 00 65 ff add %ah,-0x1(%rbp)
7: 0d 0a 0b 75 7e or $0x7e750b0a,%eax
c: 74 1e je 0x2c
e: 65 48 ff 05 50 e5 74 incq %gs:0x7e74e550(%rip) # 0x7e74e566
15: 7e
16: e9 5c fe ff ff jmp 0xfffffffffffffe77
1b: 48 c7 c6 a0 bb 52 83 mov $0xffffffff8352bba0,%rsi
22: 48 89 df mov %rbx,%rdi
25: e8 64 89 f2 ff call 0xfffffffffff2898e
2a:* 0f 0b ud2 <-- trapping instruction
2c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
31: eb db jmp 0xe
33: 48 c7 c6 40 bc 52 83 mov $0xffffffff8352bc40,%rsi
3a: 48 89 df mov %rbx,%rdi
3d: e8 .byte 0xe8
3e: 4c rex.WR
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
7: eb db jmp 0xffffffffffffffe4
9: 48 c7 c6 40 bc 52 83 mov $0xffffffff8352bc40,%rsi
10: 48 89 df mov %rbx,%rdi
13: e8 .byte 0xe8
14: 4c rex.WR
15: 89 .byte 0x89
[ 272.654159][ T3838] RSP: 0000:ffffc90001507988 EFLAGS: 00010246
[ 272.655196][ T3838] RAX: 0000000000000000 RBX: ffffea00068d8000 RCX: 0000000000000000
[ 272.656504][ T3838] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 272.657799][ T3838] RBP: ffff8881b94fdf08 R08: 0000000000000000 R09: 0000000000000000
[ 272.659142][ T3838] R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00043fb100
[ 272.660533][ T3838] R13: ffff888109ecdb08 R14: ffffc90001507a70 R15: 0000000000100173
[ 272.661849][ T3838] FS: 0000000000000000(0000) GS:ffff8883af200000(0063) knlGS:00000000f7f1a280
[ 272.663303][ T3838] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 272.664430][ T3838] CR2: 00000000ff7fffff CR3: 00000001ba4ca000 CR4: 00000000000406b0
[ 272.665759][ T3838] Call Trace:
[ 272.666325][ T3838] <TASK>
[ 272.666824][ T3838] ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)
[ 272.667483][ T3838] ? do_trap (arch/x86/kernel/traps.c:114 arch/x86/kernel/traps.c:155)
[ 272.668253][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.669128][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.669985][ T3838] ? do_error_trap (arch/x86/kernel/traps.c:176)
[ 272.670793][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.671731][ T3838] ? handle_invalid_op (arch/x86/kernel/traps.c:214)
[ 272.672551][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.673411][ T3838] ? exc_invalid_op (arch/x86/kernel/traps.c:267)
[ 272.674224][ T3838] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621)
[ 272.675064][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.679035][ T3838] ? get_huge_zero_page (include/linux/page-flags.h:540 (discriminator 1) mm/huge_memory.c:211 (discriminator 1))
[ 272.679922][ T3838] mm_get_huge_zero_page (mm/huge_memory.c:235 (discriminator 1))
[ 272.680764][ T3838] do_huge_pmd_anonymous_page (mm/huge_memory.c:1020)
[ 272.681694][ T3838] ? mt_find (include/linux/rcupdate.h:339 (discriminator 1) include/linux/rcupdate.h:814 (discriminator 1) lib/maple_tree.c:6954 (discriminator 1))
[ 272.682432][ T3838] __handle_mm_fault (mm/memory.c:5175 mm/memory.c:5412)
[ 272.683260][ T3838] ? handle_pte_fault (mm/memory.c:5352)
[ 272.684150][ T3838] ? find_vma (mm/mmap.c:1889)
[ 272.684891][ T3838] ? vma_link_file (mm/mmap.c:1889)
[ 272.685676][ T3838] ? handle_mm_fault (mm/memory.c:5576)
[ 272.686461][ T3838] handle_mm_fault (mm/memory.c:5466 mm/memory.c:5622)
[ 272.687265][ T3838] do_user_addr_fault (arch/x86/mm/fault.c:1384)
[ 272.688116][ T3838] exc_page_fault (arch/x86/include/asm/irqflags.h:26 arch/x86/include/asm/irqflags.h:67 arch/x86/include/asm/irqflags.h:127 arch/x86/mm/fault.c:1482 arch/x86/mm/fault.c:1532)
[ 272.689202][ T3838] asm_exc_page_fault (arch/x86/include/asm/idtentry.h:623)
[ 272.690523][ T3838] RIP: 0010:rep_movs_alternative (arch/x86/lib/copy_user_64.S:57)
[ 272.692228][ T3838] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08
All code
========
0: 83 f9 08 cmp $0x8,%ecx
3: 73 25 jae 0x2a
5: 85 c9 test %ecx,%ecx
7: 74 0f je 0x18
9: 8a 06 mov (%rsi),%al
b: 88 07 mov %al,(%rdi)
d: 48 ff c7 inc %rdi
10: 48 ff c6 inc %rsi
13: 48 ff c9 dec %rcx
16: 75 f1 jne 0x9
18: c3 ret
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
24: 00 00 00 00
28: 66 90 xchg %ax,%ax
2a:* 48 8b 06 mov (%rsi),%rax <-- trapping instruction
2d: 48 89 07 mov %rax,(%rdi)
30: 48 83 c6 08 add $0x8,%rsi
34: 48 83 c7 08 add $0x8,%rdi
38: 83 e9 08 sub $0x8,%ecx
3b: 74 db je 0x18
3d: 83 f9 08 cmp $0x8,%ecx
Code starting with the faulting instruction
===========================================
0: 48 8b 06 mov (%rsi),%rax
3: 48 89 07 mov %rax,(%rdi)
6: 48 83 c6 08 add $0x8,%rsi
a: 48 83 c7 08 add $0x8,%rdi
e: 83 e9 08 sub $0x8,%ecx
11: 74 db je 0xffffffffffffffee
13: 83 f9 08 cmp $0x8,%ecx
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240517/202405171417.1bb0856a-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists