From: kernel test robot <oliver.sang@intel.com>
To: Peter Zijlstra <peterz@infradead.org>
Cc: <oe-lkp@lists.linux.dev>, <lkp@intel.com>,
<linux-kernel@vger.kernel.org>, Kees Cook <keescook@chromium.org>,
Sami Tolvanen <samitolvanen@google.com>, <oliver.sang@intel.com>
Subject: [linus:master] [x86/cfi] 9831c6253a: BUG:kernel_NULL_pointer_dereference,address
Date: Mon, 14 Aug 2023 16:03:43 +0800 [thread overview]
Message-ID: <202308141050.5a684da8-oliver.sang@intel.com> (raw)
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 9831c6253ace48051189f6d18a15f658f94babc2 ("x86/cfi: Extend ENDBR sealing to kCFI")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
[test failed on linus/master 190bf7b14b0cf3df19c059061be032bd8994a597]
[test failed on linux-next/master 21ef7b1e17d039053edaeaf41142423810572741]
in testcase: boot
compiler: clang-16
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+---------------------------------------------+------------+------------+
| | be0fffa5ca | 9831c6253a |
+---------------------------------------------+------------+------------+
| boot_successes | 24 | 0 |
| boot_failures | 0 | 24 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 24 |
| Oops:#[##] | 0 | 24 |
| RIP:ip_vs_control_init | 0 | 24 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 24 |
+---------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202308141050.5a684da8-oliver.sang@intel.com
[ 12.691264][ T1] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 12.691864][ T1] #PF: supervisor write access in kernel mode
[ 12.691864][ T1] #PF: error_code(0x0002) - not-present page
[ 12.691864][ T1] PGD 0 P4D 0
[ 12.691864][ T1] Oops: 0002 [#1] PREEMPT SMP
[ 12.691864][ T1] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G T 6.5.0-rc1-00003-g9831c6253ace #1 bd2f260f97826618a72d724b7d0f852f1c6afa47
[ 12.691864][ T1] RIP: 0010:ip_vs_control_init (net/netfilter/ipvs/ip_vs_ctl.c:?)
[ 12.691864][ T1] Code: f6 e8 79 d9 d8 fd ba 00 08 00 00 48 c7 c7 30 da a2 ac 31 f6 e8 66 d9 d8 fd 48 c7 c7 e0 8b bc aa e8 da 3a ab fd 89 c1 c1 f9 1f <21> 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f b7
All code
========
0: f6 e8 imul %al
2: 79 d9 jns 0xffffffffffffffdd
4: d8 fd fdivr %st(5),%st
6: ba 00 08 00 00 mov $0x800,%edx
b: 48 c7 c7 30 da a2 ac mov $0xffffffffaca2da30,%rdi
12: 31 f6 xor %esi,%esi
14: e8 66 d9 d8 fd callq 0xfffffffffdd8d97f
19: 48 c7 c7 e0 8b bc aa mov $0xffffffffaabc8be0,%rdi
20: e8 da 3a ab fd callq 0xfffffffffdab3aff
25: 89 c1 mov %eax,%ecx
27: c1 f9 1f sar $0x1f,%ecx
2a:* 21 00 and %eax,(%rax) <-- trapping instruction
2c: 00 00 add %al,(%rax)
2e: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
34: 90 nop
35: 90 nop
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: 66 0f 1f 00 nopw (%rax)
3e: 0f .byte 0xf
3f: b7 .byte 0xb7
Code starting with the faulting instruction
===========================================
0: 21 00 and %eax,(%rax)
2: 00 00 add %al,(%rax)
4: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 66 0f 1f 00 nopw (%rax)
14: 0f .byte 0xf
15: b7 .byte 0xb7
[ 12.691864][ T1] RSP: 0000:ffffc90000013ba8 EFLAGS: 00010246
[ 12.691864][ T1] RAX: 0000000000000000 RBX: ffffffffab5ef700 RCX: 0000000000000000
[ 12.691864][ T1] RDX: 0000000000000000 RSI: ffff88842fc22f88 RDI: 00000000000001ff
[ 12.691864][ T1] RBP: ffffc90000013ee0 R08: fffffffffffa2fe1 R09: ffff88810226c000
[ 12.691864][ T1] R10: 0000000000000000 R11: ffffffffa9176710 R12: ffffffffaa4936e0
[ 12.691864][ T1] R13: 0000000000000000 R14: ffffffffab7388c4 R15: 0000000000000000
[ 12.691864][ T1] FS: 0000000000000000(0000) GS:ffff88842fc00000(0000) knlGS:0000000000000000
[ 12.691864][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 12.691864][ T1] CR2: 0000000000000000 CR3: 0000000058ea8000 CR4: 00000000000406a0
[ 12.691864][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 12.691864][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 12.691864][ T1] Call Trace:
[ 12.691864][ T1] <TASK>
[ 12.691864][ T1] ? __die_body (arch/x86/kernel/dumpstack.c:421)
[ 12.691864][ T1] ? page_fault_oops (arch/x86/mm/fault.c:703)
[ 12.691864][ T1] ? __rtnl_unlock (net/core/rtnetlink.c:139)
[ 12.691864][ T1] ? exc_page_fault (arch/x86/include/asm/paravirt.h:689 arch/x86/include/asm/irqflags.h:127 arch/x86/mm/fault.c:1494 arch/x86/mm/fault.c:1542)
[ 12.691864][ T1] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 12.691864][ T1] ? __cfi_ip_vs_init (net/netfilter/ipvs/ip_vs_core.c:2387)
[ 12.691864][ T1] ? __cfi_ip_vs_dst_event (net/netfilter/ipvs/ip_vs_ctl.c:1767)
[ 12.691864][ T1] ? ip_vs_control_init (net/netfilter/ipvs/ip_vs_ctl.c:?)
[ 12.691864][ T1] ? ip_vs_control_init (net/netfilter/ipvs/ip_vs_ctl.c:?)
[ 12.691864][ T1] ip_vs_init (net/netfilter/ipvs/ip_vs_core.c:2391)
[ 12.691864][ T1] ? __cfi_ip_vs_init (net/netfilter/ipvs/ip_vs_core.c:2387)
[ 12.691864][ T1] do_one_initcall (init/main.c:1232)
[ 12.691864][ T1] do_initcall_level (init/main.c:1293)
[ 12.691864][ T1] do_initcalls (init/main.c:1307)
[ 12.691864][ T1] kernel_init_freeable (init/main.c:1550)
[ 12.691864][ T1] ? __cfi_kernel_init (init/main.c:1429)
[ 12.691864][ T1] kernel_init (init/main.c:1439)
[ 12.691864][ T1] ret_from_fork (arch/x86/entry/entry_64.S:314)
[ 12.691864][ T1] </TASK>
[ 12.691864][ T1] Modules linked in:
[ 12.691864][ T1] CR2: 0000000000000000
[ 12.691864][ T1] ---[ end trace 0000000000000000 ]---
[ 12.691864][ T1] RIP: 0010:ip_vs_control_init (net/netfilter/ipvs/ip_vs_ctl.c:?)
[ 12.691864][ T1] Code: f6 e8 79 d9 d8 fd ba 00 08 00 00 48 c7 c7 30 da a2 ac 31 f6 e8 66 d9 d8 fd 48 c7 c7 e0 8b bc aa e8 da 3a ab fd 89 c1 c1 f9 1f <21> 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f b7
All code
========
0: f6 e8 imul %al
2: 79 d9 jns 0xffffffffffffffdd
4: d8 fd fdivr %st(5),%st
6: ba 00 08 00 00 mov $0x800,%edx
b: 48 c7 c7 30 da a2 ac mov $0xffffffffaca2da30,%rdi
12: 31 f6 xor %esi,%esi
14: e8 66 d9 d8 fd callq 0xfffffffffdd8d97f
19: 48 c7 c7 e0 8b bc aa mov $0xffffffffaabc8be0,%rdi
20: e8 da 3a ab fd callq 0xfffffffffdab3aff
25: 89 c1 mov %eax,%ecx
27: c1 f9 1f sar $0x1f,%ecx
2a:* 21 00 and %eax,(%rax) <-- trapping instruction
2c: 00 00 add %al,(%rax)
2e: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
34: 90 nop
35: 90 nop
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: 66 0f 1f 00 nopw (%rax)
3e: 0f .byte 0xf
3f: b7 .byte 0xb7
Code starting with the faulting instruction
===========================================
0: 21 00 and %eax,(%rax)
2: 00 00 add %al,(%rax)
4: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 66 0f 1f 00 nopw (%rax)
14: 0f .byte 0xf
15: b7 .byte 0xb7
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20230814/202308141050.5a684da8-oliver.sang@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2023-08-14 8:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202308141050.5a684da8-oliver.sang@intel.com \
--to=oliver.sang@intel.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=peterz@infradead.org \
--cc=samitolvanen@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox