| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202511130911.5f5a69c0-lkp@intel.com>
Date: Fri, 14 Nov 2025 09:32:16 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Christian Brauner <brauner@...nel.org>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
<oliver.sang@...el.com>
Subject: [linux-next:master] [nsproxy] 53974b87cd:
BUG:unable_to_handle_page_fault_for_address
Hello,
kernel test robot noticed "BUG:unable_to_handle_page_fault_for_address" on:
commit: 53974b87cdc40afc34928cea4c8bf8278e22c5fc ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master b179ce312bafcb8c68dc718e015aee79b7939ff0]
in testcase: trinity
version: trinity-i386-abe9de86-1_20230429
with following parameters:
runtime: 300s
group: group-03
nr_groups: 5
config: i386-randconfig-2006-20250825
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202511130911.5f5a69c0-lkp@intel.com
[ 87.959060][ T3741] BUG: unable to handle page fault for address: 6b6b6bdf
[ 87.959840][ T3741] #PF: supervisor read access in kernel mode
[ 87.960464][ T3741] #PF: error_code(0x0000) - not-present page
[ 87.961071][ T3741] *pde = 00000000
[ 87.961484][ T3741] Oops: Oops: 0000 [#1]
[ 87.961929][ T3741] CPU: 0 UID: 65534 PID: 3741 Comm: trinity-c0 Not tainted 6.18.0-rc3-00109-g53974b87cdc4 #1 PREEMPT(full) 174112d1d4a5052193629697696b6f97a384c988
[ 87.963364][ T3741] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.964390][ T3741] EIP: put_pid_ns (include/linux/ns_common.h:70 (discriminator 1) kernel/pid_namespace.c:187 (discriminator 1))
[ 87.964892][ T3741] Code: fa ff 83 c4 10 c9 c3 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 3e 8d 74 26 00 85 c0 74 3d 55 89 e5 53 89 c3 b8 08 00 00 00 <3b> 43 74 b8 00 00 00 00 1b 43 78 73 22 8d 43 70 e8 67 fe ff ff 84
All code
========
0: fa cli
1: ff 83 c4 10 c9 c3 incl -0x3c36ef3c(%rbx)
7: 2e 8d b4 26 00 00 00 cs lea 0x0(%rsi,%riz,1),%esi
e: 00
f: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
16: 3e 8d 74 26 00 ds lea 0x0(%rsi,%riz,1),%esi
1b: 85 c0 test %eax,%eax
1d: 74 3d je 0x5c
1f: 55 push %rbp
20: 89 e5 mov %esp,%ebp
22: 53 push %rbx
23: 89 c3 mov %eax,%ebx
25: b8 08 00 00 00 mov $0x8,%eax
2a:* 3b 43 74 cmp 0x74(%rbx),%eax <-- trapping instruction
2d: b8 00 00 00 00 mov $0x0,%eax
32: 1b 43 78 sbb 0x78(%rbx),%eax
35: 73 22 jae 0x59
37: 8d 43 70 lea 0x70(%rbx),%eax
3a: e8 67 fe ff ff call 0xfffffffffffffea6
3f: 84 .byte 0x84
Code starting with the faulting instruction
===========================================
0: 3b 43 74 cmp 0x74(%rbx),%eax
3: b8 00 00 00 00 mov $0x0,%eax
8: 1b 43 78 sbb 0x78(%rbx),%eax
b: 73 22 jae 0x2f
d: 8d 43 70 lea 0x70(%rbx),%eax
10: e8 67 fe ff ff call 0xfffffffffffffe7c
15: 84 .byte 0x84
[ 87.966724][ T3741] EAX: 00000008 EBX: 6b6b6b6b ECX: c122f503 EDX: ffffffff
[ 87.967423][ T3741] ESI: c88f6478 EDI: ffffffea EBP: ca3c1be8 ESP: ca3c1be4
[ 87.968130][ T3741] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010202
[ 87.968908][ T3741] CR0: 80050033 CR2: 6b6b6bdf CR3: 0b261000 CR4: 000406d0
[ 87.969605][ T3741] Call Trace:
[ 87.969980][ T3741] nsproxy_free (kernel/nsproxy.c:69)
[ 87.970443][ T3741] create_new_namespaces (kernel/nsproxy.c:132)
[ 87.970983][ T3741] unshare_nsproxy_namespaces (kernel/nsproxy.c:197 (discriminator 2))
[ 87.971544][ T3741] ksys_unshare (kernel/fork.c:3130)
[ 87.972035][ T3741] __ia32_sys_unshare (kernel/fork.c:3199)
[ 87.972533][ T3741] ia32_sys_call (kbuild/obj/consumer/i386-randconfig-2006-20250825/./arch/x86/include/generated/asm/syscalls_32.h:311)
[ 87.973022][ T3741] do_int80_syscall_32 (arch/x86/entry/syscall_32.c:83 arch/x86/entry/syscall_32.c:259)
[ 87.973545][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.974033][ T3741] ? lock_acquire (include/trace/events/lock.h:24 (discriminator 7) kernel/locking/lockdep.c:5831 (discriminator 7))
[ 87.974569][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.975055][ T3741] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 87.975544][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.976036][ T3741] ? __lock_release+0x48/0x100
[ 87.976587][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.977071][ T3741] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 87.977559][ T3741] ? __probestub_sys_exit (include/linux/rcupdate_trace.h:71)
[ 87.978091][ T3741] ? __lock_release+0x48/0x100
[ 87.978642][ T3741] ? __probestub_sys_exit (include/linux/rcupdate_trace.h:71)
[ 87.979178][ T3741] ? tracer_hardirqs_off (kernel/trace/trace_irqsoff.c:645 (discriminator 1))
[ 87.979707][ T3741] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:111)
[ 87.980225][ T3741] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4662)
[ 87.980940][ T3741] ? do_int80_syscall_32 (arch/x86/entry/syscall_32.c:263)
[ 87.981477][ T3741] ? validate_chain (kernel/locking/lockdep.c:3823 kernel/locking/lockdep.c:3876)
[ 87.981975][ T3741] ? mark_lock (kernel/locking/lockdep.c:4731 (discriminator 1))
[ 87.982436][ T3741] ? __lock_acquire (kernel/locking/lockdep.c:5237 (discriminator 1))
[ 87.982938][ T3741] ? validate_chain (kernel/locking/lockdep.c:3823 kernel/locking/lockdep.c:3876)
[ 87.983432][ T3741] ? mark_lock (kernel/locking/lockdep.c:4731 (discriminator 1))
[ 87.983906][ T3741] ? __lock_acquire (kernel/locking/lockdep.c:5237 (discriminator 1))
[ 87.984416][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.984900][ T3741] ? lock_acquire (include/trace/events/lock.h:24 (discriminator 7) kernel/locking/lockdep.c:5831 (discriminator 7))
[ 87.985435][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.985922][ T3741] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 87.986413][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.986894][ T3741] ? __lock_release+0x48/0x100
[ 87.987440][ T3741] ? __might_fault (mm/memory.c:7081 (discriminator 1) mm/memory.c:7075 (discriminator 1))
[ 87.987929][ T3741] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 87.988420][ T3741] ? __probestub_sys_exit (include/linux/rcupdate_trace.h:71)
[ 87.988954][ T3741] ? __lock_release+0x48/0x100
[ 87.989499][ T3741] ? __probestub_sys_exit (include/linux/rcupdate_trace.h:71)
[ 87.990029][ T3741] ? tracer_hardirqs_off (kernel/trace/trace_irqsoff.c:645 (discriminator 1))
[ 87.990577][ T3741] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:111)
[ 87.991098][ T3741] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4662)
[ 87.991759][ T3741] ? do_int80_syscall_32 (arch/x86/entry/syscall_32.c:263)
[ 87.992298][ T3741] ? __probestub_sys_exit (include/linux/rcupdate_trace.h:71)
[ 87.992832][ T3741] ? tracer_hardirqs_off (kernel/trace/trace_irqsoff.c:645 (discriminator 1))
[ 87.993352][ T3741] ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:111)
[ 87.993873][ T3741] ? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4662)
[ 87.994527][ T3741] ? do_int80_syscall_32 (arch/x86/entry/syscall_32.c:263)
[ 87.995065][ T3741] ? do_int80_syscall_32 (arch/x86/entry/syscall_32.c:263)
[ 87.995604][ T3741] ? exc_page_fault (arch/x86/mm/fault.c:1536)
[ 87.996125][ T3741] entry_INT80_32 (arch/x86/entry/entry_32.S:945)
[ 87.996603][ T3741] EIP: 0xb7f52092
[ 87.997006][ T3741] Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 f8 ff ff ff 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00
All code
========
0: 00 00 add %al,(%rax)
2: 00 e9 add %ch,%cl
4: 90 nop
5: ff (bad)
6: ff (bad)
7: ff (bad)
8: ff a3 24 00 00 00 jmp *0x24(%rbx)
e: 68 30 00 00 00 push $0x30
13: e9 80 ff ff ff jmp 0xffffffffffffff98
18: ff a3 f8 ff ff ff jmp *-0x8(%rbx)
1e: 66 90 xchg %ax,%ax
...
28: cd 80 int $0x80
2a:* c3 ret <-- trapping instruction
2b: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
32: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
38: 8b 1c 24 mov (%rsp),%ebx
3b: c3 ret
3c: 8d .byte 0x8d
3d: b4 26 mov $0x26,%ah
...
Code starting with the faulting instruction
===========================================
0: c3 ret
1: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
8: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
e: 8b 1c 24 mov (%rsp),%ebx
11: c3 ret
12: 8d .byte 0x8d
13: b4 26 mov $0x26,%ah
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251113/202511130911.5f5a69c0-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists