Re: [PATCH] tty: fix atomicity violation in n_tty_read

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




Hello,

kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:

commit: 5c6ca526d56e87f85cf980c77f7470e76e5dd5f7 ("[PATCH] tty: fix atomicity violation in n_tty_read")
url: https://github.com/intel-lab-lkp/linux/commits/Gui-Dong-Han/tty-fix-atomicity-violation-in-n_tty_read/20240112-205942
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/tty.git tty-testing
patch link: https://lore.kernel.org/all/20240112125801.2650-1-2045gemini@xxxxxxxxx/
patch subject: [PATCH] tty: fix atomicity violation in n_tty_read

in testcase: boot

compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+---------------------------------------------+------------+------------+
|                                             | 0c84bea0ca | 5c6ca526d5 |
+---------------------------------------------+------------+------------+
| boot_failures                               | 0          | 6          |
| BUG:kernel_NULL_pointer_dereference,address | 0          | 6          |
| Oops:#[##]                                  | 0          | 6          |
| RIP:_raw_spin_lock_irq                      | 0          | 6          |
| Kernel_panic-not_syncing:Fatal_exception    | 0          | 6          |
+---------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202401161610.edf0ac63-oliver.sang@xxxxxxxxx


[   53.979086][  T401] BUG: kernel NULL pointer dereference, address: 00000000000001d0
[   53.989877][  T401] #PF: supervisor write access in kernel mode
[   53.998103][  T401] #PF: error_code(0x0002) - not-present page
[   54.006595][  T401] PGD 800000011f423067 P4D 800000011f423067 PUD 303527067 PMD 0
[   54.017130][  T401] Oops: 0002 [#1] SMP PTI
[   54.022798][  T401] CPU: 1 PID: 401 Comm: getty Not tainted 6.7.0-rc5-00199-g5c6ca526d56e #1
[   54.032166][  T401] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 54.046197][ T401] RIP: 0010:_raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170) 
[ 54.054135][ T401] Code: cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e8 1d 01 00 00 90 c3 cc cc
All code
========
   0:	cc                   	int3   
   1:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
   8:	00 
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	f3 0f 1e fa          	endbr64 
  1d:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  22:	fa                   	cli    
  23:	31 c0                	xor    %eax,%eax
  25:	ba 01 00 00 00       	mov    $0x1,%edx
  2a:*	f0 0f b1 17          	lock cmpxchg %edx,(%rdi)		<-- trapping instruction
  2e:	75 05                	jne    0x35
  30:	c3                   	retq   
  31:	cc                   	int3   
  32:	cc                   	int3   
  33:	cc                   	int3   
  34:	cc                   	int3   
  35:	89 c6                	mov    %eax,%esi
  37:	e8 1d 01 00 00       	callq  0x159
  3c:	90                   	nop
  3d:	c3                   	retq   
  3e:	cc                   	int3   
  3f:	cc                   	int3   

Code starting with the faulting instruction
===========================================
   0:	f0 0f b1 17          	lock cmpxchg %edx,(%rdi)
   4:	75 05                	jne    0xb
   6:	c3                   	retq   
   7:	cc                   	int3   
   8:	cc                   	int3   
   9:	cc                   	int3   
   a:	cc                   	int3   
   b:	89 c6                	mov    %eax,%esi
   d:	e8 1d 01 00 00       	callq  0x12f
  12:	90                   	nop
  13:	c3                   	retq   
  14:	cc                   	int3   
  15:	cc                   	int3   
[   54.079836][  T401] RSP: 0018:ffffab01406cbcd8 EFLAGS: 00010046
[   54.088222][  T401] RAX: 0000000000000000 RBX: ffffab01406cbdc8 RCX: 0000000000000000
[   54.098106][  T401] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 00000000000001d0
[   54.109098][  T401] RBP: ffffab01406e9000 R08: ffff9dfa447a2210 R09: ffff9dfa447a2210
[   54.119762][  T401] R10: ffff9dfa447a2210 R11: 0000000000000000 R12: 0000000000000000
[   54.130902][  T401] R13: 7fffffffffffffff R14: ffff9dfa447a2000 R15: 0000000000000000
[   54.141603][  T401] FS:  0000000000000000(0000) GS:ffff9dfd2fd00000(0063) knlGS:00000000f7e1f900
[   54.153625][  T401] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   54.162764][  T401] CR2: 00000000000001d0 CR3: 0000000144742000 CR4: 00000000000006f0
[   54.171900][  T401] Call Trace:
[   54.182172][  T401]  <TASK>
[ 54.186095][ T401] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) 
[ 54.191409][ T401] ? page_fault_oops (arch/x86/mm/fault.c:707) 
[ 54.197798][ T401] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:72 arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561) 
[ 54.204312][ T401] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570) 
[ 54.211244][ T401] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170) 
[ 54.211300][ T401] n_tty_read (drivers/tty/n_tty.c:2226) 
[ 54.216906][ T401] ? __pfx_woken_wake_function (kernel/sched/wait.c:439) 
[ 54.233693][ T401] tty_read (drivers/tty/tty_io.c:862 drivers/tty/tty_io.c:937) 
[ 54.239403][ T401] vfs_read (include/linux/fs.h:2014 fs/read_write.c:389 fs/read_write.c:470) 
[ 54.244978][ T401] ksys_read (fs/read_write.c:613) 
[ 54.249805][ T401] __do_fast_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:321) 
[ 54.255574][ T401] do_fast_syscall_32 (arch/x86/entry/common.c:346) 
[ 54.255607][ T401] entry_SYSENTER_compat_after_hwframe (arch/x86/entry/entry_64_compat.S:121) 
[   54.255641][  T401] RIP: 0023:0xf7fce589
[ 54.255671][ T401] Code: 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
All code
========
   0:	03 74 d8 01          	add    0x1(%rax,%rbx,8),%esi
	...
  20:	00 51 52             	add    %dl,0x52(%rcx)
  23:	55                   	push   %rbp
  24:*	89 e5                	mov    %esp,%ebp		<-- trapping instruction
  26:	0f 34                	sysenter 
  28:	cd 80                	int    $0x80
  2a:	5d                   	pop    %rbp
  2b:	5a                   	pop    %rdx
  2c:	59                   	pop    %rcx
  2d:	c3                   	retq   
  2e:	90                   	nop
  2f:	90                   	nop
  30:	90                   	nop
  31:	90                   	nop
  32:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
  39:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi

Code starting with the faulting instruction
===========================================
   0:	5d                   	pop    %rbp
   1:	5a                   	pop    %rdx
   2:	59                   	pop    %rcx
   3:	c3                   	retq   
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
   f:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240116/202401161610.edf0ac63-oliver.sang@xxxxxxxxx



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki





[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux