netdev - [page_frag_cache] 47b0eaa4b5: BUG:unable_to_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180317021753.46j3a7jiwnm24lwt@inn>
Date:   Sat, 17 Mar 2018 10:17:53 +0800
From:   kernel test robot <fengguang.wu@...el.com>
To:     Matthew Wilcox <willy@...radead.org>
Cc:     Alexander Duyck <alexander.h.duyck@...el.com>,
        linux-mm@...r.kernel.org, netdev@...r.kernel.org,
        Matthew Wilcox <mawilcox@...rosoft.com>, lkp@...org
Subject: [page_frag_cache]  47b0eaa4b5: BUG:unable_to_handle_kernel

FYI, we noticed the following commit (built with gcc-7):

commit: 47b0eaa4b5814e82dbd7b6053926e181c7dc878f ("page_frag_cache: Store metadata in struct page")
url: https://github.com/0day-ci/linux/commits/Matthew-Wilcox/mm-Use-page-mapping-to-indicate-pfmemalloc/20180317-041855


in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -m 512M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | 41e42d493d | 47b0eaa4b5 |
+------------------------------------------+------------+------------+
| boot_successes                           | 8          | 0          |
| boot_failures                            | 0          | 8          |
| BUG:unable_to_handle_kernel              | 0          | 8          |
| Oops:#[##]                               | 0          | 8          |
| RIP:page_frag_alloc                      | 0          | 8          |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 8          |
+------------------------------------------+------------+------------+



[    9.277582] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[    9.278874] IP: page_frag_alloc+0xd/0x99
[    9.279514] PGD 0 P4D 0 
[    9.279945] Oops: 0000 [#1] PREEMPT SMP
[    9.280571] Modules linked in:
[    9.281085] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.16.0-rc4-00341-g47b0eaa #1
[    9.282245] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[    9.283505] RIP: 0010:page_frag_alloc+0xd/0x99
[    9.284199] RSP: 0000:ffffc9000000bc50 EFLAGS: 00010046
[    9.285065] RAX: 0000000000000002 RBX: 0000000000000780 RCX: 0000000000000000
[    9.286146] RDX: 0000000001080020 RSI: 0000000000000780 RDI: ffff88001da1d050
[    9.287222] RBP: ffffc9000000bc58 R08: ffffffffb494ff5a R09: ffffc900001a0000
[    9.288303] R10: 0000000000000001 R11: 000000000000175e R12: 0000000000000780
[    9.289380] R13: ffff8800173fd200 R14: 0000000000000000 R15: 0000000000000000
[    9.290456] FS:  0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000
[    9.291682] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    9.292560] CR2: 0000000000000010 CR3: 000000000820f000 CR4: 00000000000406b0
[    9.293644] Call Trace:
[    9.294081]  netdev_alloc_frag+0x3c/0x6d
[    9.294733]  e1000_alloc_frag+0x1b/0x26
[    9.295432]  e1000_alloc_rx_buffers+0x63/0x2f4
[    9.296170]  ? e1000_set_rx_mode+0x27e/0x28d
[    9.296880]  e1000_configure+0x2df/0x2ed
[    9.297528]  e1000_open+0x77/0x108
[    9.298101]  __dev_open+0xa1/0xdd
[    9.298657]  __dev_change_flags+0x109/0x1a3
[    9.299347]  dev_change_flags+0x20/0x53
[    9.299991]  ip_auto_config+0x1ac/0xe8a
[    9.300600]  ? tcp_ca_find+0x22/0x3c
[    9.301165]  ? root_nfs_parse_addr+0xa0/0xa0
[    9.301833]  ? do_early_param+0x8f/0x8f
[    9.302421]  do_one_initcall+0x9a/0x14f
[    9.303016]  ? do_one_initcall+0x9a/0x14f
[    9.303633]  kernel_init_freeable+0x11a/0x1ae
[    9.304317]  ? rest_init+0x21d/0x21d
[    9.304877]  kernel_init+0x9/0xe6
[    9.305523]  ret_from_fork+0x24/0x30
[    9.306088] Code: b6 48 61 ba 00 10 00 00 48 89 c3 48 d3 e2 89 50 10 5a 48 89 d8 5b 41 5c 41 5d 41 5e 5d c3 55 48 89 e5 53 48 8b 0f 89 f3 48 85 c9 <8b> 41 10 74 04 39 f0 73 14 89 de e8 e9 fe ff ff 48 89 c1 31 c0 
[    9.308955] RIP: page_frag_alloc+0xd/0x99 RSP: ffffc9000000bc50
[    9.309856] CR2: 0000000000000010
[    9.310368] ---[ end trace 8bcbb9720d77289e ]---


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
lkp

View attachment "config-4.16.0-rc4-00341-g47b0eaa" of type "text/plain" (96445 bytes)

View attachment "job-script" of type "text/plain" (3956 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (10088 bytes)