| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202504172247.26db367d-lkp@intel.com>
Date: Thu, 17 Apr 2025 22:46:58 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Steven Rostedt <rostedt@...dmis.org>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
Masami Hiramatsu <mhiramat@...nel.org>, Mark Rutland <mark.rutland@....com>,
Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, Andrew Morton
<akpm@...ux-foundation.org>, Shuah Khan <skhan@...uxfoundation.org>, "Andy
Chiu" <andybnac@...il.com>, <linux-trace-kernel@...r.kernel.org>,
<oliver.sang@...el.com>
Subject: [linus:master] [ftrace] 0ae6b8ce20:
UBSAN:shift-out-of-bounds_in_kernel/trace/ftrace.c
Hello,
kernel test robot noticed "UBSAN:shift-out-of-bounds_in_kernel/trace/ftrace.c" on:
commit: 0ae6b8ce200da00a78f33c055fdc4fe3225d22ec ("ftrace: Fix accounting of subop hashes")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linus/master 8ffd015db85fea3e15a77027fda6c02ced4d2444]
[test failed on linux-next/master b425262c07a6a643ebeed91046e161e20b944164]
in testcase: boot
config: x86_64-rhel-9.4-kunit
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+--------------------------------------------------------------------------------------+------------+------------+
| | 04a80a34c2 | 0ae6b8ce20 |
+--------------------------------------------------------------------------------------+------------+------------+
| boot_successes | 27 | 0 |
| boot_failures | 0 | 30 |
| UBSAN:shift-out-of-bounds_in_kernel/trace/ftrace.c | 0 | 30 |
| Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI | 0 | 30 |
| KASAN:maybe_wild-memory-access_in_range[#-#] | 0 | 30 |
| RIP:__ftrace_hash_move | 0 | 30 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 30 |
+--------------------------------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202504172247.26db367d-lkp@intel.com
[ 12.139798][ T1] ------------[ cut here ]------------
[ 12.140960][ T1] UBSAN: shift-out-of-bounds in kernel/trace/ftrace.c:1426:11
[ 12.142488][ T1] shift exponent 51870560556424975 is too large for 32-bit type 'int'
[ 12.143262][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.15.0-rc1-00004-g0ae6b8ce200d #1 PREEMPT(voluntary)
[ 12.143266][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 12.143266][ T1] Call Trace:
[ 12.143266][ T1] <TASK>
[ 12.143266][ T1] dump_stack_lvl (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/dump_stack.c:123 (discriminator 1))
[ 12.143266][ T1] __ubsan_handle_shift_out_of_bounds (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/ubsan.c:232 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/lib/ubsan.c:492)
[ 12.143266][ T1] ? __pfx_mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] __ftrace_hash_move.cold (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1426 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1449)
[ 12.143266][ T1] ? kasan_save_track (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/include/asm/current.h:25 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:60 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:69)
[ 12.143266][ T1] ? mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/instrumented.h:96 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-instrumented.h:4479 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:166 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:536)
[ 12.143266][ T1] ? __kasan_kmalloc (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:377 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/kasan/common.c:394)
[ 12.143266][ T1] ? alloc_and_copy_ftrace_hash (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1198 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1377)
[ 12.143266][ T1] ? __pfx_mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] __ftrace_hash_move_and_update_ops (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1483 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3364)
[ 12.143266][ T1] ? __pfx_mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ftrace_update_ops (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3387)
[ 12.143266][ T1] ? __pfx_mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ftrace_startup_subops (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3566)
[ 12.143266][ T1] ? __SCT__fgraph_func (??:?)
[ 12.143266][ T1] ? __pfx_ftrace_startup_subops (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:3492)
[ 12.143266][ T1] ? __pfx_mutex_unlock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:534)
[ 12.143266][ T1] ? __pfx_store_entry (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:781)
[ 12.143266][ T1] register_ftrace_graph (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/fgraph.c:1385)
[ 12.143266][ T1] ? ftrace_set_regex (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:6251)
[ 12.143266][ T1] ? __pfx_register_ftrace_graph (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/fgraph.c:1322)
[ 12.143266][ T1] ? __pfx_ftrace_set_regex (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:6228)
[ 12.143266][ T1] test_graph_storage (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:966 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1014)
[ 12.143266][ T1] trace_selftest_startup_function_graph (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1181)
[ 12.143266][ T1] ? __pfx_trace_selftest_startup_function_graph (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_selftest.c:1064)
[ 12.143266][ T1] ? __pfx_tracing_reset_online_cpus (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2354)
[ 12.143266][ T1] ? mutex_lock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/include/asm/atomic64_64.h:101 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-arch-fallback.h:4296 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-long.h:1482 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/atomic/atomic-instrumented.h:4458 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:156 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:276)
[ 12.143266][ T1] ? __pfx_mutex_lock (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/locking/mutex.c:273)
[ 12.143266][ T1] run_tracer_selftest (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2152 (discriminator 1))
[ 12.143266][ T1] register_tracer (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2190 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace.c:2306)
[ 12.143266][ T1] ? __pfx_init_graph_trace (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/trace_functions_graph.c:1731)
[ 12.143266][ T1] do_one_initcall (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1257)
[ 12.143266][ T1] ? __pfx_do_one_initcall (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1248)
[ 12.143266][ T1] ? __pfx_parse_args (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/params.c:168)
[ 12.143266][ T1] ? __kmalloc_noprof (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/kasan.h:260 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/slub.c:4331 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/mm/slub.c:4343)
[ 12.143266][ T1] ? do_initcalls (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/slab.h:909 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/include/linux/slab.h:1039 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1328)
[ 12.143266][ T1] do_initcalls (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1318 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1335)
[ 12.143266][ T1] kernel_init_freeable (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1569)
[ 12.143266][ T1] ? __pfx_kernel_init (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1449)
[ 12.143266][ T1] kernel_init (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1459)
[ 12.143266][ T1] ? calculate_sigpending (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/signal.c:194)
[ 12.143266][ T1] ret_from_fork (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/kernel/process.c:159)
[ 12.143266][ T1] ? __pfx_kernel_init (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/init/main.c:1449)
[ 12.143266][ T1] ret_from_fork_asm (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/arch/x86/entry/entry_64.S:258)
[ 12.143266][ T1] </TASK>
[ 12.177300][ T1] ---[ end trace ]---
[ 12.177951][ T1] Oops: general protection fault, probably for non-canonical address 0xeabbfbff80000000: 0000 [#1] SMP KASAN PTI
[ 12.178266][ T1] KASAN: maybe wild-memory-access in range [0x55dffffc00000000-0x55dffffc00000007]
[ 12.178266][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.15.0-rc1-00004-g0ae6b8ce200d #1 PREEMPT(voluntary)
[ 12.178266][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 12.178266][ T1] RIP: 0010:__ftrace_hash_move (kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1429 kbuild/obj/consumer/x86_64-rhel-9.4-kunit/kernel/trace/ftrace.c:1449)
[ 12.178266][ T1] Code: 49 01 e9 49 89 c2 49 89 fc 48 8b 44 24 08 48 c1 e8 03 80 3c 28 00 0f 85 b8 05 00 00 49 8b 5f 08 4c 01 f3 48 89 d8 48 c1 e8 03 <80> 3c 28 00 0f 85 81 05 00 00 4c 8b 1b 4d 85 db 0f 84 90 01 00 00
All code
========
0: 49 01 e9 add %rbp,%r9
3: 49 89 c2 mov %rax,%r10
6: 49 89 fc mov %rdi,%r12
9: 48 8b 44 24 08 mov 0x8(%rsp),%rax
e: 48 c1 e8 03 shr $0x3,%rax
12: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
16: 0f 85 b8 05 00 00 jne 0x5d4
1c: 49 8b 5f 08 mov 0x8(%r15),%rbx
20: 4c 01 f3 add %r14,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
2a:* 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 0f 85 81 05 00 00 jne 0x5b5
34: 4c 8b 1b mov (%rbx),%r11
37: 4d 85 db test %r11,%r11
3a: 0f 84 90 01 00 00 je 0x1d0
Code starting with the faulting instruction
===========================================
0: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1)
4: 0f 85 81 05 00 00 jne 0x58b
a: 4c 8b 1b mov (%rbx),%r11
d: 4d 85 db test %r11,%r11
10: 0f 84 90 01 00 00 je 0x1a6
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250417/202504172247.26db367d-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists