Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 6243580a0dc1a7043af67b983a94e4c927fb4e75 ("block: remove
__sync_blockdev")
git://git.infradead.org/users/hch/block.git block-cleanups
in testcase: trinity
version: trinity-x86_64-03f10b67-1_20210507
with following parameters:
number: 99999
group: group-03
test-description: Trinity is a linux system call fuzz tester.
test-url:
http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | ea7101d5d2 | 6243580a0d |
+---------------------------------------------+------------+------------+
| boot_successes | 18 | 0 |
| boot_failures | 0 | 19 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 19 |
| Oops:#[##] | 0 | 19 |
| RIP:sync_blockdev_nowait | 0 | 19 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 19 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang(a)intel.com>
[ 10.022716] BUG: kernel NULL pointer dereference, address: 0000000000000028
[ 10.026733] #PF: supervisor read access in kernel mode
[ 10.029727] #PF: error_code(0x0000) - not-present page
[ 10.032785] PGD 0 P4D 0
[ 10.034379] Oops: 0000 [#1] SMP PTI
[ 10.036642] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc4-00004-g6243580a0dc1
#1
[ 10.041104] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
04/01/2014
[ 10.045800] RIP: 0010:sync_blockdev_nowait (kbuild/src/consumer/fs/block_dev.c:524)
[ 10.048683] Code: 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84
00 00 00 00 00 0f 1f 44 00 00 48 85 ff 74 03 31 c0 c3 <48> 8b 04 25 28 00 00 00 48
8b 78 30 e9 22 36 ed ff 66 66 2e 0f 1f
All code
========
0: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
7: 00
8: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
f: 00 00 00 00
13: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
1a: 00 00 00
1d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
22: 48 85 ff test %rdi,%rdi
25: 74 03 je 0x2a
27: 31 c0 xor %eax,%eax
29: c3 retq
2a:* 48 8b 04 25 28 00 00 mov 0x28,%rax <-- trapping instruction
31: 00
32: 48 8b 78 30 mov 0x30(%rax),%rdi
36: e9 22 36 ed ff jmpq 0xffffffffffed365d
3b: 66 data16
3c: 66 data16
3d: 2e cs
3e: 0f .byte 0xf
3f: 1f (bad)
Code starting with the faulting instruction
===========================================
0: 48 8b 04 25 28 00 00 mov 0x28,%rax
7: 00
8: 48 8b 78 30 mov 0x30(%rax),%rdi
c: e9 22 36 ed ff jmpq 0xffffffffffed3633
11: 66 data16
12: 66 data16
13: 2e cs
14: 0f .byte 0xf
15: 1f (bad)
[ 10.061540] RSP: 0018:ffffb0b740013e48 EFLAGS: 00010246
[ 10.064533] RAX: 0000000000000000 RBX: ffffa0e74d0aa800 RCX: 0000000000000000
[ 10.068509] RDX: 0000000000000002 RSI: 0000000000007b66 RDI: 0000000000000000
[ 10.072527] RBP: ffffffffa0c49e80 R08: ffffffffa20f6760 R09: 0000000000000000
[ 10.080566] R10: ffffffffa17fb8a0 R11: ffffa0e70cc02db0 R12: ffffa0e74d0aa800
[ 10.088688] R13: 0000000000000000 R14: ffffa0e70cb4f7d8 R15: 0000000000000000
[ 10.092408] FS: 0000000000000000(0000) GS:ffffa0ea2fd00000(0000)
knlGS:0000000000000000
[ 10.097056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 10.100508] CR2: 0000000000000028 CR3: 0000000421c0a000 CR4: 00000000000006e0
[ 10.104599] Call Trace:
[ 10.108571] sync_filesystem (kbuild/src/consumer/fs/sync.c:56)
[ 10.110976] generic_shutdown_super (kbuild/src/consumer/fs/super.c:449)
[ 10.113773] kill_anon_super (kbuild/src/consumer/fs/super.c:1044
kbuild/src/consumer/fs/super.c:1058)
[ 10.116046] proc_kill_sb (kbuild/src/consumer/fs/proc/root.c:276)
[ 10.118231] deactivate_locked_super (kbuild/src/consumer/fs/super.c:342)
[ 10.120925] cleanup_mnt (kbuild/src/consumer/fs/namespace.c:137
kbuild/src/consumer/fs/namespace.c:1137)
[ 10.123031] mntput_no_expire (kbuild/src/consumer/fs/namespace.c:1222)
[ 10.125440] ? rest_init (kbuild/src/consumer/init/main.c:1444)
[ 10.127590] do_sysctl_args (kbuild/src/consumer/fs/proc/proc_sysctl.c:1862)
[ 10.129635] kernel_init (kbuild/src/consumer/init/main.c:1469)
[ 10.131622] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300)
[ 10.133883] Modules linked in:
[ 10.135878] CR2: 0000000000000028
[ 10.137634] ---[ end trace bd7aa22bcbea0ca1 ]---
[ 10.140417] RIP: 0010:sync_blockdev_nowait (kbuild/src/consumer/fs/block_dev.c:524)
[ 10.143396] Code: 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84
00 00 00 00 00 0f 1f 44 00 00 48 85 ff 74 03 31 c0 c3 <48> 8b 04 25 28 00 00 00 48
8b 78 30 e9 22 36 ed ff 66 66 2e 0f 1f
All code
========
0: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
7: 00
8: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
f: 00 00 00 00
13: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
1a: 00 00 00
1d: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
22: 48 85 ff test %rdi,%rdi
25: 74 03 je 0x2a
27: 31 c0 xor %eax,%eax
29: c3 retq
2a:* 48 8b 04 25 28 00 00 mov 0x28,%rax <-- trapping instruction
31: 00
32: 48 8b 78 30 mov 0x30(%rax),%rdi
36: e9 22 36 ed ff jmpq 0xffffffffffed365d
3b: 66 data16
3c: 66 data16
3d: 2e cs
3e: 0f .byte 0xf
3f: 1f (bad)
Code starting with the faulting instruction
===========================================
0: 48 8b 04 25 28 00 00 mov 0x28,%rax
7: 00
8: 48 8b 78 30 mov 0x30(%rax),%rdi
c: e9 22 36 ed ff jmpq 0xffffffffffed3633
11: 66 data16
12: 66 data16
13: 2e cs
14: 0f .byte 0xf
15: 1f (bad)
To reproduce:
# build kernel
cd linux
cp config-5.13.0-rc4-00004-g6243580a0dc1 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone
https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation
Thanks,
Oliver Sang