| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220131142223.GD16385@xsang-OptiPlex-9020>
Date: Mon, 31 Jan 2022 22:22:23 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Jann Horn <jannh@...gle.com>
Cc: 0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
lkp@...ts.01.org, "David S . Miller" <davem@...emloft.net>,
Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
Eric Dumazet <edumazet@...gle.com>,
Oliver Neukum <oneukum@...e.com>, Jann Horn <jannh@...gle.com>
Subject: [net] 85540a47fc: BUG:unable_to_handle_page_fault_for_address
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 85540a47fc03a568669f02a09a1ee223f9d8a98a ("[PATCH net] net: dev: Detect dev_hold() after netdev_wait_allrefs()")
url: https://github.com/0day-ci/linux/commits/Jann-Horn/net-dev-Detect-dev_hold-after-netdev_wait_allrefs/20220128-094513
patch link: https://lore.kernel.org/netdev/20220128014303.2334568-1-jannh@google.com
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu Icelake-Server -smp 4 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-------------------------------------------------------------+------------+------------+
| | 23a46422c5 | 85540a47fc |
+-------------------------------------------------------------+------------+------------+
| BUG:unable_to_handle_page_fault_for_address | 0 | 16 |
| Oops:#[##] | 0 | 16 |
| EIP:netdev_refcnt_read | 0 | 16 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 16 |
+-------------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 17.479496][ T1] BUG: unable to handle page fault for address: 3ef81000
[ 17.479636][ T1] #PF: supervisor read access in kernel mode
[ 17.479636][ T1] #PF: error_code(0x0000) - not-present page
[ 17.479636][ T1] *pde = 00000000
[ 17.479636][ T1] Oops: 0000 [#1] SMP
[ 17.479636][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.17.0-rc1-00187-g85540a47fc03 #1
[ 17.479636][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 17.479636][ T1] EIP: netdev_refcnt_read (net/core/dev.c:9803)
[ 17.479636][ T1] Code: ff ff ff ff 83 ec 08 8b 15 c0 7a 6f b3 89 55 f0 eb 1b 8d b6 00 00 00 00 8b 8e 50 03 00 00 83 fb 07 77 27 8b 04 9d 80 64 02 b3 <03> 3c 08 89 d8 ba 68 79 6f b3 e8 b7 fd 3b ff 89 c3 3b 45 f0 72 d8
All code
========
0: ff (bad)
1: ff (bad)
2: ff (bad)
3: ff 83 ec 08 8b 15 incl 0x158b08ec(%rbx)
9: c0 7a 6f b3 sarb $0xb3,0x6f(%rdx)
d: 89 55 f0 mov %edx,-0x10(%rbp)
10: eb 1b jmp 0x2d
12: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
18: 8b 8e 50 03 00 00 mov 0x350(%rsi),%ecx
1e: 83 fb 07 cmp $0x7,%ebx
21: 77 27 ja 0x4a
23: 8b 04 9d 80 64 02 b3 mov -0x4cfd9b80(,%rbx,4),%eax
2a:* 03 3c 08 add (%rax,%rcx,1),%edi <-- trapping instruction
2d: 89 d8 mov %ebx,%eax
2f: ba 68 79 6f b3 mov $0xb36f7968,%edx
34: e8 b7 fd 3b ff callq 0xffffffffff3bfdf0
39: 89 c3 mov %eax,%ebx
3b: 3b 45 f0 cmp -0x10(%rbp),%eax
3e: 72 d8 jb 0x18
Code starting with the faulting instruction
===========================================
0: 03 3c 08 add (%rax,%rcx,1),%edi
3: 89 d8 mov %ebx,%eax
5: ba 68 79 6f b3 mov $0xb36f7968,%edx
a: e8 b7 fd 3b ff callq 0xffffffffff3bfdc6
f: 89 c3 mov %eax,%ebx
11: 3b 45 f0 cmp -0x10(%rbp),%eax
14: 72 d8 jb 0xffffffffffffffee
[ 17.479636][ T1] EAX: 3ef81000 EBX: 00000000 ECX: 00000000 EDX: 00000000
[ 17.479636][ T1] ESI: b579a000 EDI: 00000000 EBP: b46a5ed0 ESP: b46a5ebc
[ 17.479636][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010297
[ 17.479636][ T1] CR0: 80050033 CR2: 3ef81000 CR3: 039ab000 CR4: 000406d0
[ 17.479636][ T1] Call Trace:
[ 17.479636][ T1] free_netdev (net/core/dev.c:10309)
[ 17.479636][ T1] tc515_probe (drivers/net/ethernet/3com/3c515.c:430)
[ 17.479636][ T1] net_olddevs_init (drivers/net/Space.c:192 drivers/net/Space.c:242 drivers/net/Space.c:251)
[ 17.479636][ T1] ? ether_boot_setup (drivers/net/Space.c:247)
[ 17.479636][ T1] do_one_initcall (init/main.c:1300)
[ 17.479636][ T1] ? rdinit_setup (init/main.c:1357)
[ 17.479636][ T1] ? rcu_read_lock_sched_held (include/linux/lockdep.h:283 kernel/rcu/update.c:125)
[ 17.479636][ T1] kernel_init_freeable (init/main.c:1372 init/main.c:1389 init/main.c:1408 init/main.c:1613)
[ 17.479636][ T1] ? rest_init (init/main.c:1494)
[ 17.479636][ T1] kernel_init (init/main.c:1504)
[ 17.479636][ T1] ret_from_fork (arch/x86/entry/entry_32.S:772)
[ 17.479636][ T1] Modules linked in:
[ 17.479636][ T1] CR2: 000000003ef81000
[ 17.479636][ T1] ---[ end trace 0000000000000000 ]---
[ 17.479636][ T1] EIP: netdev_refcnt_read (net/core/dev.c:9803)
[ 17.479636][ T1] Code: ff ff ff ff 83 ec 08 8b 15 c0 7a 6f b3 89 55 f0 eb 1b 8d b6 00 00 00 00 8b 8e 50 03 00 00 83 fb 07 77 27 8b 04 9d 80 64 02 b3 <03> 3c 08 89 d8 ba 68 79 6f b3 e8 b7 fd 3b ff 89 c3 3b 45 f0 72 d8
All code
========
0: ff (bad)
1: ff (bad)
2: ff (bad)
3: ff 83 ec 08 8b 15 incl 0x158b08ec(%rbx)
9: c0 7a 6f b3 sarb $0xb3,0x6f(%rdx)
d: 89 55 f0 mov %edx,-0x10(%rbp)
10: eb 1b jmp 0x2d
12: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
18: 8b 8e 50 03 00 00 mov 0x350(%rsi),%ecx
1e: 83 fb 07 cmp $0x7,%ebx
21: 77 27 ja 0x4a
23: 8b 04 9d 80 64 02 b3 mov -0x4cfd9b80(,%rbx,4),%eax
2a:* 03 3c 08 add (%rax,%rcx,1),%edi <-- trapping instruction
2d: 89 d8 mov %ebx,%eax
2f: ba 68 79 6f b3 mov $0xb36f7968,%edx
34: e8 b7 fd 3b ff callq 0xffffffffff3bfdf0
39: 89 c3 mov %eax,%ebx
3b: 3b 45 f0 cmp -0x10(%rbp),%eax
3e: 72 d8 jb 0x18
Code starting with the faulting instruction
===========================================
0: 03 3c 08 add (%rax,%rcx,1),%edi
3: 89 d8 mov %ebx,%eax
5: ba 68 79 6f b3 mov $0xb36f7968,%edx
a: e8 b7 fd 3b ff callq 0xffffffffff3bfdc6
f: 89 c3 mov %eax,%ebx
11: 3b 45 f0 cmp -0x10(%rbp),%eax
14: 72 d8 jb 0xffffffffffffffee
To reproduce:
# build kernel
cd linux
cp config-5.17.0-rc1-00187-g85540a47fc03 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang
View attachment "config-5.17.0-rc1-00187-g85540a47fc03" of type "text/plain" (166408 bytes)
View attachment "job-script" of type "text/plain" (4650 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (12088 bytes)
Powered by blists - more mailing lists