| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202501252228.adc2a908-lkp@intel.com>
Date: Sat, 25 Jan 2025 22:50:53 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Peter Zijlstra <peterz@...radead.org>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
<linux-perf-users@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<oliver.sang@...el.com>
Subject: [peterz-queue:perf/pmu-unregister] [perf] 6eab6eb61b:
BUG:kernel_NULL_pointer_dereference,address
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 6eab6eb61b0cef86bc2e35a427458eb9e584d3e0 ("perf: Remove retry loop from perf_mmap()")
https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git perf/pmu-unregister
in testcase: trinity
version:
with following parameters:
runtime: 300s
group: group-04
nr_groups: 5
config: i386-randconfig-016-20250123
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+---------------------------------------------+------------+------------+
| | d06f4f3d99 | 6eab6eb61b |
+---------------------------------------------+------------+------------+
| boot_successes | 12 | 0 |
| boot_failures | 0 | 12 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 12 |
| Oops:Oops:#[##] | 0 | 12 |
| EIP:perf_mmap_to_page | 0 | 12 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 12 |
+---------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202501252228.adc2a908-lkp@intel.com
[ 54.550060][ T3705] BUG: kernel NULL pointer dereference, address: 00000110
[ 54.550634][ T3705] #PF: supervisor read access in kernel mode
[ 54.551060][ T3705] #PF: error_code(0x0000) - not-present page
[ 54.551482][ T3705] *pde = 00000000
[ 54.551762][ T3705] Oops: Oops: 0000 [#1]
[ 54.552057][ T3705] CPU: 0 UID: 65534 PID: 3705 Comm: trinity-c2 Not tainted 6.13.0-rc1-00058-g6eab6eb61b0c #1
[ 54.552785][ T3705] EIP: perf_mmap_to_page (kernel/events/ring_buffer.c:950)
[ 54.553155][ T3705] Code: 00 b9 18 cf 8f cc ba 59 04 a3 cb e8 a9 4b f0 ff 8d 65 f4 89 d8 5b 5e 5f 5d c3 3e 8d 74 26 00 55 89 e5 57 56 89 c6 53 89 d3 51 <8b> 90 10 01 00 00 85 d2 74 46 8b 80 0c 01 00 00 8d 0c 10 39 d9 73
All code
========
0: 00 b9 18 cf 8f cc add %bh,-0x337030e8(%rcx)
6: ba 59 04 a3 cb mov $0xcba30459,%edx
b: e8 a9 4b f0 ff call 0xfffffffffff04bb9
10: 8d 65 f4 lea -0xc(%rbp),%esp
13: 89 d8 mov %ebx,%eax
15: 5b pop %rbx
16: 5e pop %rsi
17: 5f pop %rdi
18: 5d pop %rbp
19: c3 ret
1a: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
1f: 55 push %rbp
20: 89 e5 mov %esp,%ebp
22: 57 push %rdi
23: 56 push %rsi
24: 89 c6 mov %eax,%esi
26: 53 push %rbx
27: 89 d3 mov %edx,%ebx
29: 51 push %rcx
2a:* 8b 90 10 01 00 00 mov 0x110(%rax),%edx <-- trapping instruction
30: 85 d2 test %edx,%edx
32: 74 46 je 0x7a
34: 8b 80 0c 01 00 00 mov 0x10c(%rax),%eax
3a: 8d 0c 10 lea (%rax,%rdx,1),%ecx
3d: 39 d9 cmp %ebx,%ecx
3f: 73 .byte 0x73
Code starting with the faulting instruction
===========================================
0: 8b 90 10 01 00 00 mov 0x110(%rax),%edx
6: 85 d2 test %edx,%edx
8: 74 46 je 0x50
a: 8b 80 0c 01 00 00 mov 0x10c(%rax),%eax
10: 8d 0c 10 lea (%rax,%rdx,1),%ecx
13: 39 d9 cmp %ebx,%ecx
15: 73 .byte 0x73
[ 54.554483][ T3705] EAX: 00000000 EBX: 00000000 ECX: 00000001 EDX: 00000000
[ 54.554938][ T3705] ESI: 00000000 EDI: b4cda000 EBP: c4d51be0 ESP: c4d51bd0
[ 54.555416][ T3705] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010286
[ 54.555931][ T3705] CR0: 80050033 CR2: 00000110 CR3: 04f6c000 CR4: 00040690
[ 54.556417][ T3705] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 54.556930][ T3705] DR6: fffe0ff0 DR7: 00000400
[ 54.557261][ T3705] Call Trace:
[ 54.557500][ T3705] ? show_regs (arch/x86/kernel/dumpstack.c:479 arch/x86/kernel/dumpstack.c:465)
[ 54.557807][ T3705] ? __die_body (arch/x86/kernel/dumpstack.c:421)
[ 54.558116][ T3705] ? __die (arch/x86/kernel/dumpstack.c:435)
[ 54.558390][ T3705] ? page_fault_oops (arch/x86/mm/fault.c:710)
[ 54.558732][ T3705] ? kernelmode_fixup_or_oops+0x55/0x5d
[ 54.559212][ T3705] ? __bad_area_nosemaphore+0x31/0x17b
[ 54.559683][ T3705] ? bad_area_nosemaphore (arch/x86/mm/fault.c:835)
[ 54.560068][ T3705] ? do_user_addr_fault (arch/x86/mm/fault.c:1280 (discriminator 1))
[ 54.560428][ T3705] ? exc_page_fault (arch/x86/include/asm/irqflags.h:26 arch/x86/include/asm/irqflags.h:87 arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)
[ 54.560791][ T3705] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1494)
[ 54.561249][ T3705] ? handle_exception (arch/x86/entry/entry_32.S:1048)
[ 54.561627][ T3705] ? is_mmconf_reserved (arch/x86/pci/mmconfig-shared.c:485)
[ 54.562006][ T3705] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1494)
[ 54.562451][ T3705] ? perf_mmap_to_page (kernel/events/ring_buffer.c:950)
[ 54.562804][ T3705] ? is_mmconf_reserved (arch/x86/pci/mmconfig-shared.c:485)
[ 54.563168][ T3705] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1494)
[ 54.563605][ T3705] ? perf_mmap_to_page (kernel/events/ring_buffer.c:950)
[ 54.563961][ T3705] perf_mmap (kernel/events/core.c:6599 kernel/events/core.c:6842)
[ 54.564268][ T3705] __mmap_new_vma (include/linux/fs.h:2183 mm/internal.h:124 mm/vma.c:2291 mm/vma.c:2355)
[ 54.564613][ T3705] __mmap_region (mm/vma.c:2456)
[ 54.564945][ T3705] mmap_region (mm/mmap.c:1350)
[ 54.565255][ T3705] do_mmap (mm/mmap.c:497)
[ 54.565556][ T3705] vm_mmap_pgoff (mm/util.c:580)
[ 54.565878][ T3705] ksys_mmap_pgoff (mm/mmap.c:544)
[ 54.566215][ T3705] ? local_clock_noinstr (kernel/sched/clock.c:301)
[ 54.566596][ T3705] __ia32_sys_mmap_pgoff (mm/mmap.c:549)
[ 54.566871][ T3705] ia32_sys_call (kbuild/obj/consumer/i386-randconfig-016-20250123/./arch/x86/include/generated/asm/syscalls_32.h:193)
[ 54.567101][ T3705] do_int80_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:339)
[ 54.567335][ T3705] ? tracer_hardirqs_off (kernel/trace/trace_irqsoff.c:620)
[ 54.567571][ T3705] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:80)
[ 54.567807][ T3705] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4658)
[ 54.568115][ T3705] ? syscall_exit_to_user_mode (kernel/entry/common.c:221)
[ 54.568447][ T3705] ? do_int80_syscall_32 (arch/x86/entry/common.c:343)
[ 54.568759][ T3705] ? __lock_release+0xb0/0x14a
[ 54.569073][ T3705] ? find_ge_pid (include/linux/rcupdate.h:877)
[ 54.569330][ T3705] ? tracer_hardirqs_off (kernel/trace/trace_irqsoff.c:620)
[ 54.569618][ T3705] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:80)
[ 54.569925][ T3705] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4658)
[ 54.570299][ T3705] ? syscall_exit_to_user_mode (kernel/entry/common.c:221)
[ 54.570632][ T3705] ? do_int80_syscall_32 (arch/x86/entry/common.c:343)
[ 54.570949][ T3705] ? syscall_exit_to_user_mode (kernel/entry/common.c:221)
[ 54.571326][ T3705] ? do_int80_syscall_32 (arch/x86/entry/common.c:343)
[ 54.571644][ T3705] ? do_int80_syscall_32 (arch/x86/entry/common.c:343)
[ 54.571976][ T3705] ? common_interrupt (arch/x86/kernel/irq.c:278)
[ 54.572295][ T3705] entry_INT80_32 (arch/x86/entry/entry_32.S:945)
[ 54.572617][ T3705] EIP: 0x8097522
[ 54.572846][ T3705] Code: 89 c8 c3 90 8d 74 26 00 85 c0 c7 01 01 00 00 00 75 d8 a1 cc 3c ad 08 eb d1 66 90 66 90 66 90 66 90 66 90 66 90 66 90 90 cd 80 <c3> 8d b6 00 00 00 00 8d bc 27 00 00 00 00 8b 10 a3 f4 3c ad 08 85
All code
========
0: 89 c8 mov %ecx,%eax
2: c3 ret
3: 90 nop
4: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
8: 85 c0 test %eax,%eax
a: c7 01 01 00 00 00 movl $0x1,(%rcx)
10: 75 d8 jne 0xffffffffffffffea
12: a1 cc 3c ad 08 eb d1 movabs 0x9066d1eb08ad3ccc,%eax
19: 66 90
1b: 66 90 xchg %ax,%ax
1d: 66 90 xchg %ax,%ax
1f: 66 90 xchg %ax,%ax
21: 66 90 xchg %ax,%ax
23: 66 90 xchg %ax,%ax
25: 66 90 xchg %ax,%ax
27: 90 nop
28: cd 80 int $0x80
2a:* c3 ret <-- trapping instruction
2b: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
31: 8d bc 27 00 00 00 00 lea 0x0(%rdi,%riz,1),%edi
38: 8b 10 mov (%rax),%edx
3a: a3 .byte 0xa3
3b: f4 hlt
3c: 3c ad cmp $0xad,%al
3e: 08 .byte 0x8
3f: 85 .byte 0x85
Code starting with the faulting instruction
===========================================
0: c3 ret
1: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
7: 8d bc 27 00 00 00 00 lea 0x0(%rdi,%riz,1),%edi
e: 8b 10 mov (%rax),%edx
10: a3 .byte 0xa3
11: f4 hlt
12: 3c ad cmp $0xad,%al
14: 08 .byte 0x8
15: 85 .byte 0x85
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250125/202501252228.adc2a908-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists