Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1298971 > unrolled thread

[memdup_user_nul] kernel BUG at mm/slab.c:2735!

Started byFengguang Wu <fengguang.wu@intel.com>
First post2015-12-29 13:40 +0100
Last post2015-12-29 16:00 +0100
Articles 3 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [memdup_user_nul] kernel BUG at mm/slab.c:2735! Fengguang Wu <fengguang.wu@intel.com> - 2015-12-29 13:40 +0100
    Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735! Al Viro <viro@ZenIV.linux.org.uk> - 2015-12-29 15:40 +0100
      Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735! Al Viro <viro@ZenIV.linux.org.uk> - 2015-12-29 16:00 +0100

#1298971 — [memdup_user_nul] kernel BUG at mm/slab.c:2735!

FromFengguang Wu <fengguang.wu@intel.com>
Date2015-12-29 13:40 +0100
Subject[memdup_user_nul] kernel BUG at mm/slab.c:2735!
Message-ID<qL1Jg-xv-3@gated-at.bofh.it>
Hi Al,

It looks this patch has various impacts. Here are some more bug messages.

https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git work.misc

commit c7af9d5728bed29ef614324e67e066896d087c8f
Author:     Al Viro <viro@zeniv.linux.org.uk>
AuthorDate: Thu Dec 24 00:13:10 2015 -0500
Commit:     Al Viro <viro@zeniv.linux.org.uk>
CommitDate: Thu Dec 24 10:52:16 2015 -0500

    kernel/*: switch to memdup_user_nul()
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

+------------------------------------------+------------+------------+------------+
|                                          | c4af5f8aed | c7af9d5728 | e39121f54a |
+------------------------------------------+------------+------------+------------+
| boot_successes                           | 63         | 12         | 9          |
| boot_failures                            | 0          | 10         | 10         |
| kernel_BUG_at_mm/slab.c                  | 0          | 10         | 10         |
| invalid_opcode:#[##]                     | 0          | 10         | 10         |
| RIP:cache_free_debugcheck                | 0          | 10         | 10         |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 10         | 10         |
| backtrace:vfs_write                      | 0          | 10         | 10         |
| backtrace:SyS_write                      | 0          | 10         | 10         |
+------------------------------------------+------------+------------+------------+

[   12.900517] init: Failed to create pty - disabling logging for job
[   12.901337] init: Temporary process spawn error: No space left on device
[   12.982980] ------------[ cut here ]------------
[   12.983551] kernel BUG at mm/slab.c:2735!
[   12.984240] invalid opcode: 0000 [#1] 
[   12.984705] CPU: 0 PID: 219 Comm: sysctl Not tainted 4.4.0-rc4-00029-gc7af9d5 #1
[   12.985577] task: ffff8800118de640 ti: ffff8800118e0000 task.ti: ffff8800118e0000
[   12.986459] RIP: 0010:[<ffffffff81265a6e>]  [<ffffffff81265a6e>] cache_free_debugcheck+0x27e/0x450
[   12.987524] RSP: 0018:ffff8800118e3cb8  EFLAGS: 00010002
[   12.988148] RAX: ffff8800123ab200 RBX: ffff8800123ab208 RCX: 0000000000000004
[   12.988985] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff840c97b0
[   12.989824] RBP: ffff8800118e3cf8 R08: ffff88001024c480 R09: 0000000000000007
[   12.990658] R10: 0000000000000002 R11: ffff8800118e3d78 R12: ffff880010000140
[   12.991489] R13: 0000000000000008 R14: ffffea00003fcd68 R15: 0000000000000003
[   12.992322] FS:  00007fc8ff1bc700(0000) GS:ffffffff83e2b000(0000) knlGS:0000000000000000
[   12.993264] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   12.993926] CR2: 00007fc8ff1be000 CR3: 0000000011800000 CR4: 00000000000006b0
[   12.994751] Stack:
[   12.994992]  0000000000000000 ffff8800100011f8 ffff8800123ab200 0000000000000282
[   12.995898]  ffff8800123ab208 ffff880011493020 ffffffff81135b6d ffff880010000140
[   12.996803]  ffff8800118e3d30 ffffffff81268ceb 0000000000000000 0000000000000000
[   12.997708] Call Trace:
[   12.998003]  [<ffffffff81135b6d>] ? __do_proc_dointvec+0x37d/0x510
[   12.998724]  [<ffffffff81268ceb>] kfree+0x19b/0x2d0
[   12.999293]  [<ffffffff81135b6d>] __do_proc_dointvec+0x37d/0x510
[   12.999986]  [<ffffffff81135e18>] proc_dointvec+0x38/0x40
[   13.000614]  [<ffffffff811345e0>] ? resource_list_free+0x50/0x50
[   13.001313]  [<ffffffff813273c6>] proc_sys_call_handler+0x126/0x160
[   13.002035]  [<ffffffff81327414>] proc_sys_write+0x14/0x20
[   13.002673]  [<ffffffff812867a0>] __vfs_write+0x40/0x190
[   13.003291]  [<ffffffff8128b480>] ? __sb_start_write+0xe0/0x170
[   13.003972]  [<ffffffff81286c25>] vfs_write+0x1c5/0x320
[   13.004580]  [<ffffffff81286ef2>] SyS_write+0x62/0x110
[   13.005175]  [<ffffffff82bb5873>] entry_SYSCALL_64_fastpath+0x16/0x7a
[   13.005932] Code: 0f 95 c7 31 d2 45 0f b6 ff 44 89 fe 49 83 c7 02 e8 18 b5 f7 ff 48 8b 45 d0 4a 83 04 fd 28 f3 2c 84 01 48 39 c3 0f 84 d4 00 00 00 <0f> 0b 48 b8 00 00 00 00 00 78 00 00 48 01 d8 e9 90 fe ff ff 48 
[   13.008992] RIP  [<ffffffff81265a6e>] cache_free_debugcheck+0x27e/0x450
[   13.009778]  RSP <ffff8800118e3cb8>
[   13.010190] ---[ end trace 9689f67a5733e394 ]---
[   13.010734] Kernel panic - not syncing: Fatal exception

git bisect start e39121f54a77d2b1536cd2924347b9b106ddfbea 4ef7675344d687a0ef5b0d7c0cee12da005870c0 --
git bisect  bad d147a8ed3ab35f67adb2de64ec50c31265782b24  # 15:36      0-      6  Merge 'linux-review/SF-Markus-Elfring/gpio-ucb1400-Delete-an-unnecessary-variable-initialisation-in-ucb1400_gpio_probe/20151226-025155' into devel-spot-201512261453
git bisect  bad d6fda4209fcf205c9401cce1948b8570218a3b6d  # 15:44      0-      2  Merge 'linux-review/Martin-Blumenstingl/net-phy-at803x-Don-t-set-gbit-features-for-the-AR8030-phy/20151226-083323' into devel-spot-201512261453
git bisect good 6df2275ce5a3901a015a28cc9f20d297f2bbebd6  # 15:58     22+      2  Merge 'linux-review/Zhi-zhou-Zhang/arm64-entry-S-add-missing-trace_hardirqs_off/20151226-140037' into devel-spot-201512261453
git bisect  bad f396b9fc5242d2c04440a85b4ad70ebc982f2b3f  # 16:05      0-      5  Merge 'vfs/work.misc' into devel-spot-201512261453
git bisect good 57e3715cfa3fb01581555934d7191f8eabf740f4  # 16:23     22+      0  typo in fs/namei.c comment
git bisect good b808b1d632f6915e4d6b1badb927b2c970ad11bb  # 16:42     22+      0  don't open-code generic_file_llseek_size()
git bisect good af26a3456b8549149544fc5bad6b7c364653e787  # 16:52     22+      0  selinuxfs: switch to memdup_user_nul()
git bisect good c4af5f8aed82ef30f6cf91bc3478b52c61cecd18  # 17:06     22+      0  cciss: switch to memdup_user_nul()
git bisect  bad c7af9d5728bed29ef614324e67e066896d087c8f  # 17:14      0-      9  kernel/*: switch to memdup_user_nul()
# first bad commit: [c7af9d5728bed29ef614324e67e066896d087c8f] kernel/*: switch to memdup_user_nul()
git bisect good c4af5f8aed82ef30f6cf91bc3478b52c61cecd18  # 17:18     61+      0  cciss: switch to memdup_user_nul()
# extra tests with DEBUG_INFO
git bisect  bad c7af9d5728bed29ef614324e67e066896d087c8f  # 17:24      0-      1  kernel/*: switch to memdup_user_nul()
# extra tests on HEAD of linux-devel/devel-spot-201512261453
git bisect  bad e39121f54a77d2b1536cd2924347b9b106ddfbea  # 17:25      0-     10  0day head guard for 'devel-spot-201512261453'
# extra tests on tree/branch vfs/work.misc
git bisect  bad 15d8d69accf88da38aac73dd873ce56fd39b358a  # 17:30      0-     10  saner calling conventions for copy_mount_options()
# extra tests with first bad commit reverted
git bisect good 241dc6cc888af8cc59a6e1c3ddd4ee2e0da6d00d  # 17:39     66+      0  Revert "kernel/*: switch to memdup_user_nul()"
# extra tests on tree/branch linus/master
git bisect good 8db7b3c54401d83a4dc370a59b8692854000ea03  # 17:55     60+      2  Merge branch 'parisc-4.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
# extra tests on tree/branch linux-next/master


This script may reproduce the error.

----------------------------------------------------------------------------
#!/bin/bash

kernel=$1
initrd=quantal-core-x86_64.cgz

wget --no-clobber https://github.com/fengguang/reproduce-kernel-bug/raw/master/initrd/$initrd

kvm=(
	qemu-system-x86_64
	-enable-kvm
	-cpu kvm64
	-kernel $kernel
	-initrd $initrd
	-m 300
	-smp 2
	-device e1000,netdev=net0
	-netdev user,id=net0
	-boot order=nc
	-no-reboot
	-watchdog i6300esb
	-rtc base=localtime
	-serial stdio
	-display none
	-monitor null 
)

append=(
	hung_task_panic=1
	earlyprintk=ttyS0,115200
	systemd.log_level=err
	debug
	apic=debug
	sysrq_always_enabled
	rcupdate.rcu_cpu_stall_timeout=100
	panic=-1
	softlockup_panic=1
	nmi_watchdog=panic
	oops=panic
	load_ramdisk=2
	prompt_ramdisk=0
	console=ttyS0,115200
	console=tty0
	vga=normal
	root=/dev/ram0
	rw
	drbd.minor_count=8
)

"${kvm[@]}" --append "${append[*]}"
----------------------------------------------------------------------------

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/lkp                          Intel Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1299022

FromAl Viro <viro@ZenIV.linux.org.uk>
Date2015-12-29 15:40 +0100
Message-ID<qL3Bo-1LE-17@gated-at.bofh.it>
In reply to#1298971
On Tue, Dec 29, 2015 at 08:38:43PM +0800, Fengguang Wu wrote:
> Hi Al,
> 
> It looks this patch has various impacts. Here are some more bug messages.
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git work.misc
> 
> commit c7af9d5728bed29ef614324e67e066896d087c8f

The version in vfs.git has been ad8e00e50cbda2ce3831a4badc239ad014eec69 for
a couple of days already...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1299029

FromAl Viro <viro@ZenIV.linux.org.uk>
Date2015-12-29 16:00 +0100
Message-ID<qL3UK-1Sp-13@gated-at.bofh.it>
In reply to#1299022
On Tue, Dec 29, 2015 at 02:39:47PM +0000, Al Viro wrote:
> On Tue, Dec 29, 2015 at 08:38:43PM +0800, Fengguang Wu wrote:
> > Hi Al,
> > 
> > It looks this patch has various impacts. Here are some more bug messages.
> > 
> > https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git work.misc
> > 
> > commit c7af9d5728bed29ef614324e67e066896d087c8f
> 
> The version in vfs.git has been ad8e00e50cbda2ce3831a4badc239ad014eec69 for
> a couple of days already...

FWIW, the difference (and the source of those bugs) is that the earlier
variant had missed the fact that value of kbuf gets modified between the
allocation and freeing, so it ended up doing kfree() on the tail of kmalloced
buffer.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web