Message-ID: <6f2ecd8e-a041-6c0d-e4bc-7a3886b7bdd2@maine.edu>
Date: Tue, 29 Jul 2025 14:06:29 -0400 (EDT)
From: Vince Weaver <vincent.weaver@...ne.edu>
To: Vince Weaver <vincent.weaver@...ne.edu>
cc: "Mi, Dapeng" <dapeng1.mi@...ux.intel.com>, linux-kernel@...r.kernel.org, 
    linux-perf-users@...r.kernel.org, "Liang, Kan" <kan.liang@...ux.intel.com>, 
    Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, 
    Arnaldo Carvalho de Melo <acme@...nel.org>, 
    Namhyung Kim <namhyung@...nel.org>, Mark Rutland <mark.rutland@....com>, 
    Alexander Shishkin <alexander.shishkin@...ux.intel.com>, 
    Jiri Olsa <jolsa@...nel.org>, Ian Rogers <irogers@...gle.com>, 
    Adrian Hunter <adrian.hunter@...el.com>
Subject: Re: [perf] fuzzer triggers "BUG: kernel NULL pointer dereference"

On Tue, 29 Jul 2025, Vince Weaver wrote:

> This is on a RaptorLake system.
> 
> I can reproduce this issue with the perf_fuzzer but it is possibly timing 
> sensitive and so if I enable fuzzer trace logging to try to make a 
> reproducible test case it won't trigger anymore.
> 
> The system locks up extremely hard and so I can't really get the panic 
> message besides taking a picture of the screen.
> 
> I can try enabling KASAN to see if that helps get better debug messages.

I managed to get KASAN to trigger the issue without crashing the system, 
not sure if this helps at all:

[  115.636383] ==================================================================
[  115.636432] BUG: KASAN: slab-use-after-free in rb_erase+0xd25/0x1370
[  115.636467] Read of size 8 at addr ffff8881151dc0b8 by task swapper/5/0

[  115.636508] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0+ #13 PREEMPT(voluntary) 
[  115.636517] Hardware name: Dell Inc. Precision 3660/0VJ7G2, BIOS 2.17.0 08/09/2024
[  115.636520] Call Trace:
[  115.636524]  <TASK>
[  115.636528]  dump_stack_lvl+0x64/0x80
[  115.636536]  print_report+0xce/0x650
[  115.636547]  ? rb_erase+0xd25/0x1370
[  115.636552]  kasan_report+0xce/0x100
[  115.636559]  ? rb_erase+0xd25/0x1370
[  115.636565]  rb_erase+0xd25/0x1370
[  115.636570]  ? __tmigr_cpu_activate+0x13d/0x310
[  115.636578]  timerqueue_del+0x68/0x120
[  115.636585]  __remove_hrtimer+0x84/0x200
[  115.636592]  hrtimer_try_to_cancel+0x19c/0x350
[  115.636597]  hrtimer_cancel+0x15/0x30
[  115.636602]  tick_nohz_restart_sched_tick+0x5b/0x210
[  115.636609]  tick_nohz_idle_exit+0xfc/0x180
[  115.636615]  do_idle+0x258/0x410
[  115.636623]  ? __pfx_do_idle+0x10/0x10
[  115.636631]  ? do_idle+0x2c1/0x410
[  115.636638]  cpu_startup_entry+0x54/0x60
[  115.636645]  start_secondary+0x20f/0x290
[  115.636654]  ? __pfx_start_secondary+0x10/0x10
[  115.636661]  common_startup_64+0x13e/0x141
[  115.636671]  </TASK>

[  115.637037] Allocated by task 1091:
[  115.637054]  kasan_save_stack+0x33/0x60
[  115.637062]  kasan_save_track+0x14/0x30
[  115.637069]  __kasan_slab_alloc+0x89/0x90
[  115.637076]  kmem_cache_alloc_node_noprof+0x136/0x450
[  115.637086]  perf_event_alloc+0x100/0x41e0
[  115.637093]  __do_sys_perf_event_open+0x39b/0x1c30
[  115.637098]  do_syscall_64+0x82/0x2f0
[  115.637105]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

[  115.637121] Freed by task 0:
[  115.637136]  kasan_save_stack+0x33/0x60
[  115.637143]  kasan_save_track+0x14/0x30
[  115.637149]  kasan_save_free_info+0x3b/0x60
[  115.637155]  __kasan_slab_free+0x51/0x70
[  115.637162]  kmem_cache_free+0x2f2/0x540
[  115.637167]  rcu_do_batch+0x39a/0xe00
[  115.637174]  rcu_core+0x3f0/0xb10
[  115.637180]  handle_softirqs+0x1bf/0x5d0
[  115.637188]  __irq_exit_rcu+0x14e/0x1a0
[  115.637193]  sysvec_apic_timer_interrupt+0x72/0x90
[  115.637201]  asm_sysvec_apic_timer_interrupt+0x1a/0x20

[  115.637216] Last potentially related work creation:
[  115.637235]  kasan_save_stack+0x33/0x60
[  115.637242]  kasan_record_aux_stack+0xa7/0xc0
[  115.637248]  __call_rcu_common.constprop.0+0xc8/0x1160
[  115.637255]  perf_event_release_kernel+0x2f6/0x400
[  115.637262]  perf_release+0x31/0x50
[  115.637270]  __fput+0x35b/0xac0
[  115.637276]  task_work_run+0x11a/0x1f0
[  115.637282]  do_exit+0x6c6/0x2400
[  115.637289]  do_group_exit+0xac/0x230
[  115.637297]  get_signal+0x1cbc/0x1e40
[  115.637304]  arch_do_signal_or_restart+0x8d/0x5e0
[  115.637312]  irqentry_exit_to_user_mode+0x12c/0x1f0
[  115.637319]  asm_sysvec_reschedule_ipi+0x1a/0x20

[  115.637334] The buggy address belongs to the object at ffff8881151dbf40
                which belongs to the cache perf_event of size 1344
[  115.637376] The buggy address is located 376 bytes inside of
                freed 1344-byte region [ffff8881151dbf40, ffff8881151dc480)

[  115.637428] The buggy address belongs to the physical page:
[  115.637450] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1151d8
[  115.637457] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  115.637461] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
[  115.637470] page_type: f5(slab)
[  115.637477] raw: 0017ffffc0000040 ffff88810004b040 dead000000000122 0000000000000000
[  115.637483] raw: 0000000000000000 0000000000160016 00000000f5000000 0000000000000000
[  115.637488] head: 0017ffffc0000040 ffff88810004b040 dead000000000122 0000000000000000
[  115.637492] head: 0000000000000000 0000000000160016 00000000f5000000 0000000000000000
[  115.637497] head: 0017ffffc0000003 ffffea0004547601 00000000ffffffff 00000000ffffffff
[  115.637501] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  115.637504] page dumped because: kasan: bad access detected

[  115.637517] Memory state around the buggy address:
[  115.637537]  ffff8881151dbf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.637564]  ffff8881151dc000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.637590] >ffff8881151dc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.637615]                                         ^
[  115.637636]  ffff8881151dc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.637661]  ffff8881151dc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.637687] ==================================================================
[  115.637712] Disabling lock debugging due to kernel taint

Powered by blists - more mailing lists