| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202505281032.80741674-lkp@intel.com>
Date: Wed, 28 May 2025 12:50:27 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Charlie Jenkins <charlie@...osinc.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
Thomas Gleixner <tglx@...utronix.de>, Alexandre Ghiti
<alexghiti@...osinc.com>, <oliver.sang@...el.com>
Subject: [linus:master] [entry] e43b8bb56e:
WARNING:at_arch/x86/mm/fault.c:#do_user_addr_fault
Hello,
kernel test robot noticed "WARNING:at_arch/x86/mm/fault.c:#do_user_addr_fault" on:
commit: e43b8bb56e537bfc8d9076793091e7679020fc9c ("entry: Inline syscall_exit_to_user_mode()")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linux-next/master 176e917e010cb7dcc605f11d2bc33f304292482b]
in testcase: boot
config: i386-randconfig-013-20250522
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+------------------------------------------------------------------+------------+------------+
| | 7ace1602ab | e43b8bb56e |
+------------------------------------------------------------------+------------+------------+
| WARNING:at_arch/x86/mm/fault.c:#do_user_addr_fault | 0 | 12 |
| EIP:do_user_addr_fault | 0 | 12 |
| EIP:do_int80_syscall_32 | 0 | 12 |
| BUG:unable_to_handle_page_fault_for_address | 0 | 6 |
| Oops | 0 | 12 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 12 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 6 |
+------------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202505281032.80741674-lkp@intel.com
[ 10.101039][ T94] ------------[ cut here ]------------
[ 10.101532][ T94] WARNING: CPU: 1 PID: 94 at arch/x86/mm/fault.c:1277 do_user_addr_fault (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1277)
[ 10.102357][ T94] Modules linked in:
[ 10.102759][ T94] CPU: 1 UID: 0 PID: 94 Comm: (sd-executor) Tainted: G T 6.15.0-rc4-00004-ge43b8bb56e53 #1 PREEMPT cb8ad9d0051fab6c2c2b90122348bdb04995c14e
[ 10.104048][ T94] Tainted: [T]=RANDSTRUCT
[ 10.104443][ T94] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 10.105320][ T94] EIP: do_user_addr_fault (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1277)
[ 10.105791][ T94] Code: ff ff 89 f9 89 da ff 75 f0 e8 fa 00 00 00 83 c4 04 e9 03 fe ff ff 89 f9 89 da ff 75 f0 e8 96 c3 f6 ff 83 c4 04 e9 f7 fc ff ff <0f> 0b 89 f9 89 da ff 75 f0 e8 c0 03 00 00 83 c4 04 e9 d9 fd ff ff
All code
========
0: ff (bad)
1: ff 89 f9 89 da ff decl -0x257607(%rcx)
7: 75 f0 jne 0xfffffffffffffff9
9: e8 fa 00 00 00 call 0x108
e: 83 c4 04 add $0x4,%esp
11: e9 03 fe ff ff jmp 0xfffffffffffffe19
16: 89 f9 mov %edi,%ecx
18: 89 da mov %ebx,%edx
1a: ff 75 f0 push -0x10(%rbp)
1d: e8 96 c3 f6 ff call 0xfffffffffff6c3b8
22: 83 c4 04 add $0x4,%esp
25: e9 f7 fc ff ff jmp 0xfffffffffffffd21
2a:* 0f 0b ud2 <-- trapping instruction
2c: 89 f9 mov %edi,%ecx
2e: 89 da mov %ebx,%edx
30: ff 75 f0 push -0x10(%rbp)
33: e8 c0 03 00 00 call 0x3f8
38: 83 c4 04 add $0x4,%esp
3b: e9 d9 fd ff ff jmp 0xfffffffffffffe19
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 89 f9 mov %edi,%ecx
4: 89 da mov %ebx,%edx
6: ff 75 f0 push -0x10(%rbp)
9: e8 c0 03 00 00 call 0x3ce
e: 83 c4 04 add $0x4,%esp
11: e9 d9 fd ff ff jmp 0xfffffffffffffdef
[ 10.106105][ T95] systemd-bless-b (95) used greatest stack depth: 4736 bytes left
[ 10.106834][ T94] EAX: 80000000 EBX: 00000000 ECX: 82813c79 EDX: 827cb1c6
[ 10.106837][ T94] ESI: 85e2a800 EDI: 85b95b34 EBP: 85b95b10 ESP: 85b95ae8
[ 10.106839][ T94] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00210046
[ 10.106841][ T94] CR0: 80050033 CR2: 0000006a CR3: 05b96000 CR4: 000406b0
[ 10.106845][ T94] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 10.111108][ T94] DR6: fffe0ff0 DR7: 00000400
[ 10.111532][ T94] Call Trace:
[ 10.111863][ T94] exc_page_fault (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/include/asm/irqflags.h:19 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/include/asm/irqflags.h:109 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/include/asm/irqflags.h:151 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1488 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1538)
[ 10.112275][ T94] ? pvclock_clocksource_read_nowd (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1493)
[ 10.112801][ T94] handle_exception (??:?)
[ 10.113237][ T94] EIP: do_int80_syscall_32 (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/trace/trace_preemptirq.c:73 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:218 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/entry/common.c:99 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:330 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:414 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:449 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/entry/syscall_32.c:262)
[ 10.113707][ T94] Code: 85 c0 0f 85 a2 01 00 00 e8 a1 bc c1 fe 8b 06 8b 18 f7 c3 1e 30 02 00 0f 84 fa 00 00 00 64 a1 bc 78 22 83 85 c0 74 19 8b 45 00 <8b> 50 04 8b 4e 04 e8 29 0f e1 fe 64 c7 05 bc 78 22 83 00 00 00 00
All code
========
0: 85 c0 test %eax,%eax
2: 0f 85 a2 01 00 00 jne 0x1aa
8: e8 a1 bc c1 fe call 0xfffffffffec1bcae
d: 8b 06 mov (%rsi),%eax
f: 8b 18 mov (%rax),%ebx
11: f7 c3 1e 30 02 00 test $0x2301e,%ebx
17: 0f 84 fa 00 00 00 je 0x117
1d: 64 a1 bc 78 22 83 85 movabs %fs:0x1974c085832278bc,%eax
24: c0 74 19
27: 8b 45 00 mov 0x0(%rbp),%eax
2a:* 8b 50 04 mov 0x4(%rax),%edx <-- trapping instruction
2d: 8b 4e 04 mov 0x4(%rsi),%ecx
30: e8 29 0f e1 fe call 0xfffffffffee10f5e
35: 64 c7 05 bc 78 22 83 movl $0x0,%fs:-0x7cdd8744(%rip) # 0xffffffff832278fc
3c: 00 00 00 00
Code starting with the faulting instruction
===========================================
0: 8b 50 04 mov 0x4(%rax),%edx
3: 8b 4e 04 mov 0x4(%rsi),%ecx
6: e8 29 0f e1 fe call 0xfffffffffee10f34
b: 64 c7 05 bc 78 22 83 movl $0x0,%fs:-0x7cdd8744(%rip) # 0xffffffff832278d2
12: 00 00 00 00
[ 10.117058][ T94] EAX: 00000066 EBX: 00000004 ECX: 828d2222 EDX: 82a8d026
[ 10.117653][ T94] ESI: 85b95f70 EDI: 85b95fac EBP: 85b95fa4 ESP: 85b95b90
[ 10.118267][ T94] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00210002
[ 10.118942][ T94] ? inat_get_escape_attribute (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/lib/inat.c:38)
[ 10.119431][ T94] ? pvclock_clocksource_read_nowd (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1493)
[ 10.119957][ T94] ? pvclock_clocksource_read_nowd (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1493)
[ 10.120484][ T94] ? do_int80_syscall_32 (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/trace/trace_preemptirq.c:73 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:218 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/entry/common.c:99 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:330 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:414 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/entry-common.h:449 kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/entry/syscall_32.c:262)
[ 10.120954][ T94] ? __lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:4675 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5189)
[ 10.121402][ T94] ? __lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:4675 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5189)
[ 10.121842][ T94] ? rcu_read_lock_any_held (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/rcu/update.c:388)
[ 10.122330][ T94] ? find_stack (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/stackdepot.c:552)
[ 10.122752][ T94] ? __this_cpu_preempt_check (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/smp_processor_id.c:67)
[ 10.123234][ T94] ? rcu_read_lock_any_held (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/rcu/update.c:386)
[ 10.123709][ T94] ? __lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3802 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3822 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3877 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5235)
[ 10.124153][ T94] ? rcu_read_lock_any_held (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/rcu/update.c:386)
[ 10.124628][ T94] ? __lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3802 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3822 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3877 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5235)
[ 10.125070][ T94] ? rcu_read_lock_any_held (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/rcu/update.c:386)
[ 10.125548][ T94] ? __lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3802 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3822 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:3877 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5235)
[ 10.126004][ T94] ? lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5866)
[ 10.126424][ T94] ? __this_cpu_preempt_check (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/smp_processor_id.c:67)
[ 10.126901][ T94] ? local_lock_release.15463 (kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/local_lock_internal.h:54)
[ 10.127389][ T94] ? __this_cpu_preempt_check (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/smp_processor_id.c:67)
[ 10.127868][ T94] ? add_mm_rss_vec (kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/rcupdate.h:340)
[ 10.128295][ T94] ? rcu_lock_release.17856 (kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/rcupdate.h:342)
[ 10.128441][ T101] systemd-hiberna (101) used greatest stack depth: 4608 bytes left
[ 10.128586][ T94] ? do_wp_page (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/rcu/tree_plugin.h:? kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/rcupdate.h:873 kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/pgtable.h:136 kbuild/obj/consumer/i386-randconfig-013-20250522/mm/memory.c:3579 kbuild/obj/consumer/i386-randconfig-013-20250522/mm/memory.c:3939)
[ 10.129896][ T94] ? lock_acquire (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:5866)
[ 10.130327][ T94] ? _raw_spin_lock (kbuild/obj/consumer/i386-randconfig-013-20250522/include/linux/spinlock_api_smp.h:133 kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/spinlock.c:154)
[ 10.130754][ T94] ? handle_mm_fault (kbuild/obj/consumer/i386-randconfig-013-20250522/mm/memory.c:6013 kbuild/obj/consumer/i386-randconfig-013-20250522/mm/memory.c:6140 kbuild/obj/consumer/i386-randconfig-013-20250522/mm/memory.c:6309)
[ 10.131213][ T94] ? __this_cpu_preempt_check (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/smp_processor_id.c:67)
[ 10.131693][ T94] ? irqentry_exit (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/entry/common.c:320)
[ 10.132109][ T94] ? __this_cpu_preempt_check (kbuild/obj/consumer/i386-randconfig-013-20250522/lib/smp_processor_id.c:67)
[ 10.132583][ T94] ? lockdep_hardirqs_on (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/locking/lockdep.c:4473)
[ 10.133046][ T94] ? irqentry_exit_to_user_mode (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/entry/common.c:187)
[ 10.133542][ T94] ? entry_INT80_32 (??:?)
[ 10.133986][ T94] ? irqentry_exit (kbuild/obj/consumer/i386-randconfig-013-20250522/kernel/entry/common.c:320)
[ 10.134408][ T94] ? exc_page_fault (kbuild/obj/consumer/i386-randconfig-013-20250522/arch/x86/mm/fault.c:1542)
[ 10.134835][ T94] entry_INT80_32 (??:?)
[ 10.135261][ T94] EIP: 0x77fcf092
[ 10.135614][ T94] Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 f8 ff ff ff 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00
All code
========
0: 00 00 add %al,(%rax)
2: 00 e9 add %ch,%cl
4: 90 nop
5: ff (bad)
6: ff (bad)
7: ff (bad)
8: ff a3 24 00 00 00 jmp *0x24(%rbx)
e: 68 30 00 00 00 push $0x30
13: e9 80 ff ff ff jmp 0xffffffffffffff98
18: ff a3 f8 ff ff ff jmp *-0x8(%rbx)
1e: 66 90 xchg %ax,%ax
...
28: cd 80 int $0x80
2a:* c3 ret <-- trapping instruction
2b: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
32: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
38: 8b 1c 24 mov (%rsp),%ebx
3b: c3 ret
3c: 8d .byte 0x8d
3d: b4 26 mov $0x26,%ah
...
Code starting with the faulting instruction
===========================================
0: c3 ret
1: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
8: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
e: 8b 1c 24 mov (%rsp),%ebx
11: c3 ret
12: 8d .byte 0x8d
13: b4 26 mov $0x26,%ah
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250528/202505281032.80741674-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists