| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202406211653.493fbfdf-lkp@intel.com>
Date: Fri, 21 Jun 2024 16:45:45 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Sagi Grimberg <sagi@...mberg.me>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, Linux Memory Management List
<linux-mm@...ck.org>, Jakub Kicinski <kuba@...nel.org>,
<netdev@...r.kernel.org>, <oliver.sang@...el.com>
Subject: [linux-next:master] [net] 934c29999b: Kernel_BUG_at
Hello,
we reported similar issue for this patch in
https://lore.kernel.org/all/202406161539.b5ff7b20-oliver.sang@intel.com/
and we saw a lot of dicussion there.
now the patch is merged into linux-next/master, we are not sure if there
is a fix or debug patch is on-going, which will be our pleasure to test.
anyway, just report again FYI that we still observe issues in our tests for
linux-nexts/master
kernel test robot noticed "Kernel_BUG_at" on:
commit: 934c29999b57b835d65442da6f741d5e27f3b584 ("net: micro-optimize skb_datagram_iter")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master 2102cb0d050d34d50b9642a3a50861787527e922]
in testcase: boot
compiler: gcc-13
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+------------------------------------------------+------------+------------+
| | abef84957b | 934c29999b |
+------------------------------------------------+------------+------------+
| Kernel_BUG_at | 0 | 6 |
| Oops:invalid_opcode:#[##] | 0 | 6 |
| EIP:usercopy_abort | 0 | 6 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 6 |
+------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202406211653.493fbfdf-lkp@intel.com
[ 8.659454][ T161] ------------[ cut here ]------------
[ 8.659874][ T161] Kernel BUG at usercopy_abort+0x58/0x67 [verbose debug info unavailable]
[ 8.660744][ T161] Oops: invalid opcode: 0000 [#1]
[ 8.661134][ T161] CPU: 0 PID: 161 Comm: systemctl Not tainted 6.10.0-rc3-00688-g934c29999b57 #1 63c7b7fbd2f7622d539d732370d21837ac16d760
[ 8.662098][ T161] EIP: usercopy_abort (mm/usercopy.c:102)
[ 8.662483][ T161] Code: 25 40 43 b9 c8 38 41 43 eb 0a bf 9d 73 50 43 b9 e4 ce 3f 43 ff 75 0c ff 75 08 56 52 53 50 57 51 68 d1 38 41 43 e8 50 cc ee ff <0f> 0b b8 4c 09 c7 43 83 c4 24 e8 c2 69 42 00 55 89 e5 57 56 89 d7
All code
========
0: 25 40 43 b9 c8 and $0xc8b94340,%eax
5: 38 41 43 cmp %al,0x43(%rcx)
8: eb 0a jmp 0x14
a: bf 9d 73 50 43 mov $0x4350739d,%edi
f: b9 e4 ce 3f 43 mov $0x433fcee4,%ecx
14: ff 75 0c push 0xc(%rbp)
17: ff 75 08 push 0x8(%rbp)
1a: 56 push %rsi
1b: 52 push %rdx
1c: 53 push %rbx
1d: 50 push %rax
1e: 57 push %rdi
1f: 51 push %rcx
20: 68 d1 38 41 43 push $0x434138d1
25: e8 50 cc ee ff call 0xffffffffffeecc7a
2a:* 0f 0b ud2 <-- trapping instruction
2c: b8 4c 09 c7 43 mov $0x43c7094c,%eax
31: 83 c4 24 add $0x24,%esp
34: e8 c2 69 42 00 call 0x4269fb
39: 55 push %rbp
3a: 89 e5 mov %esp,%ebp
3c: 57 push %rdi
3d: 56 push %rsi
3e: 89 d7 mov %edx,%edi
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: b8 4c 09 c7 43 mov $0x43c7094c,%eax
7: 83 c4 24 add $0x24,%esp
a: e8 c2 69 42 00 call 0x4269d1
f: 55 push %rbp
10: 89 e5 mov %esp,%ebp
12: 57 push %rdi
13: 56 push %rsi
14: 89 d7 mov %edx,%edi
[ 8.664049][ T161] EAX: 00000052 EBX: 435c7250 ECX: 00000000 EDX: 43c4b518
[ 8.664589][ T161] ESI: 435c7250 EDI: 43402547 EBP: bf159c68 ESP: bf159c38
[ 8.665127][ T161] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010286
[ 8.665708][ T161] CR0: 80050033 CR2: 005c8afc CR3: 7f060000 CR4: 000406d0
[ 8.666244][ T161] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 8.666774][ T161] DR6: fffe0ff0 DR7: 00000400
[ 8.667136][ T161] Call Trace:
[ 8.667395][ T161] ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1))
[ 8.667732][ T161] ? __die_body (arch/x86/kernel/dumpstack.c:421)
[ 8.668060][ T161] ? __die (arch/x86/kernel/dumpstack.c:435)
[ 8.668358][ T161] ? die (arch/x86/kernel/dumpstack.c:449)
[ 8.668646][ T161] ? do_trap (arch/x86/kernel/traps.c:114 arch/x86/kernel/traps.c:155)
[ 8.668968][ T161] ? do_error_trap (arch/x86/kernel/traps.c:176)
[ 8.669323][ T161] ? usercopy_abort (mm/usercopy.c:102)
[ 8.669690][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 8.670057][ T161] ? handle_invalid_op (arch/x86/kernel/traps.c:214)
[ 8.670434][ T161] ? usercopy_abort (mm/usercopy.c:102)
[ 8.670803][ T161] ? exc_invalid_op (arch/x86/kernel/traps.c:267)
[ 8.671174][ T161] ? handle_exception (arch/x86/entry/entry_32.S:1054)
[ 8.671567][ T161] ? __ia32_sys_membarrier (kernel/sched/membarrier.c:497 kernel/sched/membarrier.c:659 kernel/sched/membarrier.c:625 kernel/sched/membarrier.c:625)
[ 8.671980][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 8.672322][ T161] ? usercopy_abort (mm/usercopy.c:102)
[ 8.672684][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 8.673039][ T161] ? usercopy_abort (mm/usercopy.c:102)
[ 8.673406][ T161] check_heap_object (mm/usercopy.c:182)
[ 8.673780][ T161] __check_object_size (mm/usercopy.c:123 mm/usercopy.c:254)
[ 8.674169][ T161] simple_copy_to_iter (include/linux/uio.h:196 net/core/datagram.c:513)
[ 8.674554][ T161] __skb_datagram_iter (net/core/datagram.c:424 (discriminator 1))
[ 8.674955][ T161] skb_copy_datagram_iter (net/core/datagram.c:529)
[ 8.675359][ T161] ? skb_free_datagram (include/linux/thread_info.h:249 (discriminator 1) include/linux/uio.h:195 (discriminator 1) net/core/datagram.c:513 (discriminator 1))
[ 8.675724][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866)
[ 8.676083][ T161] unix_stream_read_actor (net/unix/af_unix.c:2871)
[ 8.676481][ T161] unix_stream_read_generic (net/unix/af_unix.c:2803)
[ 8.676914][ T161] unix_stream_recvmsg (net/unix/af_unix.c:2907)
[ 8.677301][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866)
[ 8.677669][ T161] ? unix_stream_splice_read (net/unix/af_unix.c:2890)
[ 8.678097][ T161] sock_recvmsg_nosec (net/socket.c:1046 (discriminator 1))
[ 8.678472][ T161] ____sys_recvmsg (net/socket.c:1068 (discriminator 2) net/socket.c:2804 (discriminator 2))
[ 8.678835][ T161] ___sys_recvmsg (net/socket.c:2846)
[ 8.679188][ T161] __sys_recvmsg (net/socket.c:2878)
[ 8.679534][ T161] __do_sys_socketcall (net/socket.c:3173)
[ 8.679926][ T161] __ia32_sys_socketcall (net/socket.c:3077)
[ 8.680304][ T161] ia32_sys_call (kbuild/obj/consumer/i386-randconfig-012-20230823-CONFIG_NVME_CORE/./arch/x86/include/generated/asm/syscalls_32.h:103)
[ 8.680671][ T161] do_int80_syscall_32 (arch/x86/entry/common.c:165 (discriminator 1) arch/x86/entry/common.c:339 (discriminator 1))
[ 8.681053][ T161] entry_INT80_32 (arch/x86/entry/entry_32.S:944)
[ 8.681401][ T161] EIP: 0x37f37092
[ 8.681686][ T161] Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 f8 ff ff ff 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00
All code
========
0: 00 00 add %al,(%rax)
2: 00 e9 add %ch,%cl
4: 90 nop
5: ff (bad)
6: ff (bad)
7: ff (bad)
8: ff a3 24 00 00 00 jmp *0x24(%rbx)
e: 68 30 00 00 00 push $0x30
13: e9 80 ff ff ff jmp 0xffffffffffffff98
18: ff a3 f8 ff ff ff jmp *-0x8(%rbx)
1e: 66 90 xchg %ax,%ax
...
28: cd 80 int $0x80
2a:* c3 ret <-- trapping instruction
2b: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
32: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
38: 8b 1c 24 mov (%rsp),%ebx
3b: c3 ret
3c: 8d .byte 0x8d
3d: b4 26 mov $0x26,%ah
...
Code starting with the faulting instruction
===========================================
0: c3 ret
1: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
8: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
e: 8b 1c 24 mov (%rsp),%ebx
11: c3 ret
12: 8d .byte 0x8d
13: b4 26 mov $0x26,%ah
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240621/202406211653.493fbfdf-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists