From: kernel test robot <oliver.sang@intel.com>
To: Gui-Dong Han <2045gemini@gmail.com>
Cc: <oe-lkp@lists.linux.dev>, <lkp@intel.com>,
<linux-kernel@vger.kernel.org>, <linux-serial@vger.kernel.org>,
<gregkh@linuxfoundation.org>, <jirislaby@kernel.org>,
<baijiaju1990@outlook.com>, Gui-Dong Han <2045gemini@gmail.com>,
<stable@vger.kernel.org>, <oliver.sang@intel.com>
Subject: Re: [PATCH] tty: fix atomicity violation in n_tty_read
Date: Tue, 16 Jan 2024 16:29:35 +0800 [thread overview]
Message-ID: <202401161610.edf0ac63-oliver.sang@intel.com> (raw)
In-Reply-To: <20240112125801.2650-1-2045gemini@gmail.com>
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 5c6ca526d56e87f85cf980c77f7470e76e5dd5f7 ("[PATCH] tty: fix atomicity violation in n_tty_read")
url: https://github.com/intel-lab-lkp/linux/commits/Gui-Dong-Han/tty-fix-atomicity-violation-in-n_tty_read/20240112-205942
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/tty.git tty-testing
patch link: https://lore.kernel.org/all/20240112125801.2650-1-2045gemini@gmail.com/
patch subject: [PATCH] tty: fix atomicity violation in n_tty_read
in testcase: boot
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+---------------------------------------------+------------+------------+
| | 0c84bea0ca | 5c6ca526d5 |
+---------------------------------------------+------------+------------+
| boot_failures | 0 | 6 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 6 |
| Oops:#[##] | 0 | 6 |
| RIP:_raw_spin_lock_irq | 0 | 6 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 6 |
+---------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202401161610.edf0ac63-oliver.sang@intel.com
[ 53.979086][ T401] BUG: kernel NULL pointer dereference, address: 00000000000001d0
[ 53.989877][ T401] #PF: supervisor write access in kernel mode
[ 53.998103][ T401] #PF: error_code(0x0002) - not-present page
[ 54.006595][ T401] PGD 800000011f423067 P4D 800000011f423067 PUD 303527067 PMD 0
[ 54.017130][ T401] Oops: 0002 [#1] SMP PTI
[ 54.022798][ T401] CPU: 1 PID: 401 Comm: getty Not tainted 6.7.0-rc5-00199-g5c6ca526d56e #1
[ 54.032166][ T401] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 54.046197][ T401] RIP: 0010:_raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 54.054135][ T401] Code: cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e8 1d 01 00 00 90 c3 cc cc
All code
========
0: cc int3
1: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
8: 00
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: f3 0f 1e fa endbr64
1d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
22: fa cli
23: 31 c0 xor %eax,%eax
25: ba 01 00 00 00 mov $0x1,%edx
2a:* f0 0f b1 17 lock cmpxchg %edx,(%rdi) <-- trapping instruction
2e: 75 05 jne 0x35
30: c3 retq
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: 89 c6 mov %eax,%esi
37: e8 1d 01 00 00 callq 0x159
3c: 90 nop
3d: c3 retq
3e: cc int3
3f: cc int3
Code starting with the faulting instruction
===========================================
0: f0 0f b1 17 lock cmpxchg %edx,(%rdi)
4: 75 05 jne 0xb
6: c3 retq
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: 89 c6 mov %eax,%esi
d: e8 1d 01 00 00 callq 0x12f
12: 90 nop
13: c3 retq
14: cc int3
15: cc int3
[ 54.079836][ T401] RSP: 0018:ffffab01406cbcd8 EFLAGS: 00010046
[ 54.088222][ T401] RAX: 0000000000000000 RBX: ffffab01406cbdc8 RCX: 0000000000000000
[ 54.098106][ T401] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 00000000000001d0
[ 54.109098][ T401] RBP: ffffab01406e9000 R08: ffff9dfa447a2210 R09: ffff9dfa447a2210
[ 54.119762][ T401] R10: ffff9dfa447a2210 R11: 0000000000000000 R12: 0000000000000000
[ 54.130902][ T401] R13: 7fffffffffffffff R14: ffff9dfa447a2000 R15: 0000000000000000
[ 54.141603][ T401] FS: 0000000000000000(0000) GS:ffff9dfd2fd00000(0063) knlGS:00000000f7e1f900
[ 54.153625][ T401] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 54.162764][ T401] CR2: 00000000000001d0 CR3: 0000000144742000 CR4: 00000000000006f0
[ 54.171900][ T401] Call Trace:
[ 54.182172][ T401] <TASK>
[ 54.186095][ T401] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)
[ 54.191409][ T401] ? page_fault_oops (arch/x86/mm/fault.c:707)
[ 54.197798][ T401] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:72 arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561)
[ 54.204312][ T401] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 54.211244][ T401] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 54.211300][ T401] n_tty_read (drivers/tty/n_tty.c:2226)
[ 54.216906][ T401] ? __pfx_woken_wake_function (kernel/sched/wait.c:439)
[ 54.233693][ T401] tty_read (drivers/tty/tty_io.c:862 drivers/tty/tty_io.c:937)
[ 54.239403][ T401] vfs_read (include/linux/fs.h:2014 fs/read_write.c:389 fs/read_write.c:470)
[ 54.244978][ T401] ksys_read (fs/read_write.c:613)
[ 54.249805][ T401] __do_fast_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:321)
[ 54.255574][ T401] do_fast_syscall_32 (arch/x86/entry/common.c:346)
[ 54.255607][ T401] entry_SYSENTER_compat_after_hwframe (arch/x86/entry/entry_64_compat.S:121)
[ 54.255641][ T401] RIP: 0023:0xf7fce589
[ 54.255671][ T401] Code: 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
All code
========
0: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
...
20: 00 51 52 add %dl,0x52(%rcx)
23: 55 push %rbp
24:* 89 e5 mov %esp,%ebp <-- trapping instruction
26: 0f 34 sysenter
28: cd 80 int $0x80
2a: 5d pop %rbp
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 retq
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
39: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
Code starting with the faulting instruction
===========================================
0: 5d pop %rbp
1: 5a pop %rdx
2: 59 pop %rcx
3: c3 retq
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
f: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240116/202401161610.edf0ac63-oliver.sang@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2024-01-16 8:29 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-12 12:58 [PATCH] tty: fix atomicity violation in n_tty_read Gui-Dong Han
2024-01-12 13:48 ` Greg KH
2024-01-12 16:59 ` Gui-Dong Han
2024-01-14 19:43 ` Theodore Ts'o
2024-01-16 8:29 ` kernel test robot [this message]
2024-01-16 10:14 ` Ilpo Järvinen
2024-02-01 9:02 ` This is classified as spam [was: [PATCH] tty: fix atomicity violation in n_tty_read] Jiri Slaby
2024-02-01 14:23 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202401161610.edf0ac63-oliver.sang@intel.com \
--to=oliver.sang@intel.com \
--cc=2045gemini@gmail.com \
--cc=baijiaju1990@outlook.com \
--cc=gregkh@linuxfoundation.org \
--cc=jirislaby@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-serial@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.