| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202502121009.f7bc8e67-lkp@intel.com>
Date: Wed, 12 Feb 2025 10:50:41 +0800
From: kernel test robot <oliver.sang@...el.com>
To: NeilBrown <neilb@...e.de>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
<linux-fsdevel@...r.kernel.org>, <linux-nfs@...r.kernel.org>,
<linux-cifs@...r.kernel.org>, Christian Brauner <brauner@...nel.org>,
Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>, "Greg
Kroah-Hartman" <gregkh@...uxfoundation.org>, "Rafael J. Wysocki"
<rafael@...nel.org>, Danilo Krummrich <dakr@...nel.org>, Kent Overstreet
<kent.overstreet@...ux.dev>, Trond Myklebust <trondmy@...nel.org>, "Anna
Schumaker" <anna@...nel.org>, Namjae Jeon <linkinjeon@...nel.org>, "Steve
French" <sfrench@...ba.org>, Sergey Senozhatsky <senozhatsky@...omium.org>,
Tom Talpey <tom@...pey.com>, Paul Moore <paul@...l-moore.com>, Eric Paris
<eparis@...hat.com>, <linux-kernel@...r.kernel.org>,
<linux-bcachefs@...r.kernel.org>, <audit@...r.kernel.org>,
<oliver.sang@...el.com>
Subject: Re: [PATCH 2/2] VFS: add common error checks to
lookup_one_qstr_excl()
Hello,
kernel test robot noticed "BUG:unable_to_handle_page_fault_for_address" on:
commit: 9a292bc4cbb25ca84f90dbacdf3064a9d6e7804f ("[PATCH 2/2] VFS: add common error checks to lookup_one_qstr_excl()")
url: https://github.com/intel-lab-lkp/linux/commits/NeilBrown/VFS-change-kern_path_locked-and-user_path_locked_at-to-never-return-negative-dentry/20250207-185417
base: https://git.kernel.org/cgit/linux/kernel/git/vfs/vfs.git vfs.all
patch link: https://lore.kernel.org/all/20250207034040.3402438-3-neilb@suse.de/
patch subject: [PATCH 2/2] VFS: add common error checks to lookup_one_qstr_excl()
in testcase: trinity
version:
with following parameters:
runtime: 300s
group: group-01
nr_groups: 5
config: i386-randconfig-053-20250208
compiler: clang-19
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202502121009.f7bc8e67-lkp@intel.com
[ 163.118842][ T4188] BUG: unable to handle page fault for address: fffffffe
[ 163.119485][ T4188] #PF: supervisor read access in kernel mode
[ 163.120015][ T4188] #PF: error_code(0x0000) - not-present page
[ 163.120523][ T4188] *pde = 026d3067 *pte = 00000000
[ 163.120971][ T4188] Oops: Oops: 0000 [#1]
[ 163.121339][ T4188] CPU: 0 UID: 65534 PID: 4188 Comm: trinity-c3 Tainted: G S 6.14.0-rc1-00084-g9a292bc4cbb2 #1
[ 163.122321][ T4188] Tainted: [S]=CPU_OUT_OF_SPEC
[ 163.122717][ T4188] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 163.123520][ T4188] EIP: lookup_one_qstr_excl (include/linux/dcache.h:416 include/linux/dcache.h:421 include/linux/dcache.h:467 fs/namei.c:1696)
[ 163.123973][ T4188] Code: 5e 89 d8 89 fa e8 62 ed 00 00 85 c0 74 58 8b 7e 18 89 c2 89 f0 89 d6 8b 4d f0 ff 17 85 c0 75 4d 89 f0 8b 75 f0 b9 00 00 38 00 <23> 08 89 f2 81 e2 00 00 02 00 09 ca 74 13 f7 c6 00 00 04 00 74 17
All code
========
0: 5e pop %rsi
1: 89 d8 mov %ebx,%eax
3: 89 fa mov %edi,%edx
5: e8 62 ed 00 00 call 0xed6c
a: 85 c0 test %eax,%eax
c: 74 58 je 0x66
e: 8b 7e 18 mov 0x18(%rsi),%edi
11: 89 c2 mov %eax,%edx
13: 89 f0 mov %esi,%eax
15: 89 d6 mov %edx,%esi
17: 8b 4d f0 mov -0x10(%rbp),%ecx
1a: ff 17 call *(%rdi)
1c: 85 c0 test %eax,%eax
1e: 75 4d jne 0x6d
20: 89 f0 mov %esi,%eax
22: 8b 75 f0 mov -0x10(%rbp),%esi
25: b9 00 00 38 00 mov $0x380000,%ecx
2a:* 23 08 and (%rax),%ecx <-- trapping instruction
2c: 89 f2 mov %esi,%edx
2e: 81 e2 00 00 02 00 and $0x20000,%edx
34: 09 ca or %ecx,%edx
36: 74 13 je 0x4b
38: f7 c6 00 00 04 00 test $0x40000,%esi
3e: 74 17 je 0x57
Code starting with the faulting instruction
===========================================
0: 23 08 and (%rax),%ecx
2: 89 f2 mov %esi,%edx
4: 81 e2 00 00 02 00 and $0x20000,%edx
a: 09 ca or %ecx,%edx
c: 74 13 je 0x21
e: f7 c6 00 00 04 00 test $0x40000,%esi
14: 74 17 je 0x2d
[ 163.125537][ T4188] EAX: fffffffe EBX: c3e7e540 ECX: 00380000 EDX: 273874b2
[ 163.126145][ T4188] ESI: 00060000 EDI: fffffffe EBP: ebef9ef4 ESP: ebef9edc
[ 163.126716][ T4188] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010246
[ 163.127324][ T4188] CR0: 80050033 CR2: fffffffe CR3: 2b2df000 CR4: 00040690
[ 163.127872][ T4188] Call Trace:
[ 163.128178][ T4188] ? __die_body (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420)
[ 163.128552][ T4188] ? __die (arch/x86/kernel/dumpstack.c:434)
[ 163.128898][ T4188] ? page_fault_oops (arch/x86/mm/fault.c:710)
[ 163.129329][ T4188] ? lock_acquire (kernel/locking/lockdep.c:5851)
[ 163.129723][ T4188] ? kernelmode_fixup_or_oops (arch/x86/mm/fault.c:737)
[ 163.130222][ T4188] ? __bad_area_nosemaphore (arch/x86/mm/fault.c:784)
[ 163.130687][ T4188] ? bad_area_nosemaphore (arch/x86/mm/fault.c:833)
[ 163.131129][ T4188] ? do_kern_addr_fault (arch/x86/mm/fault.c:1197)
[ 163.131569][ T4188] ? exc_page_fault (arch/x86/mm/fault.c:1479)
[ 163.132004][ T4188] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:? kernel/locking/lockdep.c:4408)
[ 163.132482][ T4188] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1493)
[ 163.132999][ T4188] ? handle_exception (arch/x86/entry/entry_32.S:1048)
[ 163.133429][ T4188] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1493)
[ 163.133946][ T4188] ? lookup_one_qstr_excl (include/linux/dcache.h:416 include/linux/dcache.h:421 include/linux/dcache.h:467 fs/namei.c:1696)
[ 163.134390][ T4188] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1493)
[ 163.134919][ T4188] ? lookup_one_qstr_excl (include/linux/dcache.h:416 include/linux/dcache.h:421 include/linux/dcache.h:467 fs/namei.c:1696)
[ 163.135354][ T4188] filename_create (include/linux/err.h:67 fs/namei.c:4091)
[ 163.135763][ T4188] do_symlinkat (fs/namei.c:4676)
[ 163.136166][ T4188] __ia32_sys_symlinkat (fs/namei.c:4696)
[ 163.136593][ T4188] ia32_sys_call (arch/x86/entry/syscall_32.c:44)
[ 163.136967][ T4188] __do_fast_syscall_32 (arch/x86/entry/common.c:?)
[ 163.137377][ T4188] do_fast_syscall_32 (arch/x86/entry/common.c:411)
[ 163.137774][ T4188] do_SYSENTER_32 (arch/x86/entry/common.c:449)
[ 163.138146][ T4188] entry_SYSENTER_32 (arch/x86/entry/entry_32.S:836)
[ 163.138542][ T4188] EIP: 0xb7f61539
[ 163.138845][ T4188] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 0f 1f 00 58 b8 77 00 00 00 cd 80 90 0f 1f
All code
========
0: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
4: 10 07 adc %al,(%rdi)
6: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
a: 10 08 adc %cl,(%rax)
c: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
...
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24:* 89 e5 mov %esp,%ebp <-- trapping instruction
26: 0f 34 sysenter
28: cd 80 int $0x80
2a: 5d pop %rbp
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 ret
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 0f 1f 00 nopl (%rax)
35: 58 pop %rax
36: b8 77 00 00 00 mov $0x77,%eax
3b: cd 80 int $0x80
3d: 90 nop
3e: 0f .byte 0xf
3f: 1f (bad)
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 ret
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 0f 1f 00 nopl (%rax)
b: 58 pop %rax
c: b8 77 00 00 00 mov $0x77,%eax
11: cd 80 int $0x80
13: 90 nop
14: 0f .byte 0xf
15: 1f (bad)
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250212/202502121009.f7bc8e67-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists