| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20181129073125.wi3ubymjhaiwdoqx@inn2.lkp.intel.com>
Date: Thu, 29 Nov 2018 15:31:25 +0800
From: kernel test robot <lkp@...el.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>
Cc: netdev@...r.kernel.org, davem@...emloft.net,
Willem de Bruijn <willemb@...gle.com>, lkp@...org
Subject: [udp] a4a142d3d7: WARNING:at_lib/refcount.c:#refcount_inc_checked
FYI, we noticed the following commit (built with gcc-6):
commit: a4a142d3d7ae19345838dabbf6aaa504dcc70021 ("[PATCH net-next v2 1/2] udp: msg_zerocopy")
url: https://github.com/0day-ci/linux/commits/Willem-de-Bruijn/udp-msg_zerocopy/20181127-021130
in testcase: trinity
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 2G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+----------------------------------------------------------+------------+------------+
| | 358be65640 | a4a142d3d7 |
+----------------------------------------------------------+------------+------------+
| boot_successes | 190 | 68 |
| boot_failures | 12 | 25 |
| Mem-Info | 12 | |
| invoked_oom-killer:gfp_mask=0x | 3 | |
| RIP:strnlen_user | 1 | |
| RIP:__put_user_4 | 1 | |
| RIP:copy_user_enhanced_fast_string | 1 | |
| Out_of_memory:Kill_process | 1 | |
| Out_of_memory_and_no_killable_processes | 1 | |
| Kernel_panic-not_syncing:System_is_deadlocked_on_memory | 1 | |
| RIP:iov_iter_fault_in_readable | 1 | |
| WARNING:at_lib/refcount.c:#refcount_inc_checked | 0 | 25 |
| RIP:refcount_inc_checked | 0 | 25 |
| WARNING:at_lib/refcount.c:#refcount_sub_and_test_checked | 0 | 25 |
| RIP:refcount_sub_and_test_checked | 0 | 25 |
+----------------------------------------------------------+------------+------------+
[ 255.028826] WARNING: CPU: 0 PID: 1255 at lib/refcount.c:153 refcount_inc_checked+0x41/0x50
[ 255.031189] Modules linked in:
[ 255.032022] CPU: 0 PID: 1255 Comm: trinity-c2 Not tainted 4.20.0-rc3-00915-ga4a142d #1
[ 255.033900] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 255.037952] RIP: 0010:refcount_inc_checked+0x41/0x50
[ 255.039161] Code: 75 1f 5a ff e8 70 1f 5a ff 80 3d 57 60 29 02 00 75 ec e8 62 1f 5a ff 48 c7 c7 00 d8 81 bc c6 05 42 60 29 02 01 e8 ff 62 3e ff <0f> 0b eb d0 90 66 2e 0f 1f 84 00 00 00 00 00 41 56 41 55 41 89 fd
[ 255.043305] RSP: 0018:ffff8880447bf4a0 EFLAGS: 00010282
[ 255.044553] RAX: 000000000000002b RBX: ffff88804b0dcd00 RCX: ffffffffba60489b
[ 255.046179] RDX: ffff88807e48a680 RSI: 0000000000000004 RDI: ffffffffbd3d7008
[ 255.047798] RBP: ffff88804b0dd6c0 R08: fffffbfff7a7ae02 R09: fffffbfff7a7ae01
[ 255.049425] R10: ffff88804b0dcd03 R11: fffffbfff7a7ae02 R12: 000000000000001c
[ 255.051064] R13: ffff88804b0dd778 R14: ffff88804b0dd774 R15: 0000000000000000
[ 255.052689] FS: 00007f1cf848cb40(0000) GS:ffffffffbce79000(0000) knlGS:0000000000000000
[ 255.054612] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 255.055965] CR2: 000055e15adc6fa0 CR3: 000000004e12a000 CR4: 00000000000406f0
[ 255.057601] DR0: 00007f1cf8367000 DR1: 0000000000000000 DR2: 0000000000000000
[ 255.059231] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 255.060859] Call Trace:
[ 255.061577] __ip_append_data+0x19ad/0x2980
[ 255.062757] ? udp_lib_close+0x20/0x20
[ 255.063730] ? rt_cache_valid+0x11f/0x170
[ 255.064739] ? ip_generic_getfrag+0x1c0/0x1c0
[ 255.065822] ? ipv4_mtu+0x23e/0x2c0
[ 255.066800] ip_make_skb+0x20e/0x280
[ 255.067725] ? udp_lib_close+0x20/0x20
[ 255.068697] ? ip_flush_pending_frames+0x30/0x30
[ 255.069838] udp_sendmsg+0xeda/0x1e80
[ 255.070784] ? udp_lib_close+0x20/0x20
[ 255.071752] ? udp_push_pending_frames+0xe0/0xe0
[ 255.072910] ? __lock_acquire+0x4c8/0x3010
[ 255.073952] ? __might_fault+0x105/0x1b0
[ 255.074953] ? rw_copy_check_uvector+0x1cf/0x2b0
[ 255.076089] ? import_iovec+0x202/0x390
[ 255.077084] ? _copy_from_user+0x92/0x100
[ 255.078108] ? move_addr_to_kernel+0x50/0x50
[ 255.079299] ? inet_sendmsg+0x106/0x1c0
[ 255.080294] ? udp_sendmsg+0x5/0x1e80
[ 255.081243] inet_sendmsg+0x106/0x1c0
[ 255.082186] ___sys_sendmsg+0x454/0x8f0
[ 255.083167] ? copy_msghdr_from_user+0x380/0x380
[ 255.084314] ? __lock_acquire+0x4c8/0x3010
[ 255.085353] ? hrtimer_start_range_ns+0x327/0x560
[ 255.086506] ? __fget_light+0xad/0x200
[ 255.087470] ? __sys_sendmsg+0xd2/0x170
[ 255.088456] ? ___sys_sendmsg+0x5/0x8f0
[ 255.089438] __sys_sendmsg+0xd2/0x170
[ 255.090380] ? __x64_sys_shutdown+0x80/0x80
[ 255.091430] ? perf_syscall_exit+0x286/0x4b0
[ 255.092500] ? ftrace_syscall_exit+0x520/0x520
[ 255.093601] ? lock_downgrade+0x570/0x570
[ 255.094616] do_syscall_64+0xdd/0xbc0
[ 255.095568] ? syscall_return_slowpath+0x320/0x320
[ 255.096746] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 255.097972] RIP: 0033:0x7f1cf7daf229
[ 255.098905] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3f 4c 2b 00 f7 d8 64 89 01 48
[ 255.103014] RSP: 002b:00007ffff99ba758 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 255.104834] RAX: ffffffffffffffda RBX: 000000000000002e RCX: 00007f1cf7daf229
[ 255.106464] RDX: 0000000064010860 RSI: 000055e15af397d0 RDI: 0000000000000163
[ 255.108098] RBP: 00007ffff99ba800 R08: ffffffff9d472af1 R09: 00000000dcdcdcdc
[ 255.109725] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000002
[ 255.111359] R13: 00007f1cf8477058 R14: 00007f1cf848cad8 R15: 00007f1cf8477000
[ 255.112992] irq event stamp: 118226
[ 255.113916] hardirqs last enabled at (118225): [<ffffffffba5ffe5c>] console_unlock+0x63c/0xa00
[ 255.115961] hardirqs last disabled at (118226): [<ffffffffba40375d>] trace_hardirqs_off_thunk+0x1a/0x1c
[ 255.118150] softirqs last enabled at (114672): [<ffffffffbbd53c55>] tcp_recvmsg+0xfb5/0x2770
[ 255.120149] softirqs last disabled at (114670): [<ffffffffbbbd17b0>] release_sock+0x20/0x1b0
[ 255.122147] ---[ end trace ff7f08ca16c230bf ]---
To reproduce:
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
lkp
View attachment "config-4.20.0-rc3-00915-ga4a142d" of type "text/plain" (120928 bytes)
View attachment "job-script" of type "text/plain" (4181 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (19044 bytes)
View attachment "trinity" of type "text/plain" (22856 bytes)
Powered by blists - more mailing lists