lkml.org 
[lkml]   [2014]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf_fuzzer compiled for x32 causes reboot
On Fri, 21 Feb 2014, Vince Weaver wrote:

> On Fri, 21 Feb 2014, Vince Weaver wrote:
>
> > So I'm not sure who exactly to report this to. Some perf people CC'd as
> > I trigger it while using the perf_fuzzer.
> >
> > This is with 3.14-rc3 on a core2 machine, although I've had the reboots
> > happen throughout at least 3.14-rc*
> >
> > I'm having a hard time coming up with a reproducible test case. Using the
> > random seed that caused the below will cause the perf_fuzzer to segfault
> > but not reboot.
> >
> > The log isn't very helpful, it reboots so fast that the oops doesn't
> > finish printing and the serial log just moves to the bootloader...
> >
> > [ 4466.804123] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
> > [ 4466.808014] IP: [<ffffffff81111783>] cache_reap+0x5e/0x1c5
> > [ 4466.808014] PGD 0
> > [ 4466.808014] Oops: 0000 [#1] GNU GRUB version 2.00-17
>
> Maybe related, this is on an x32-compiled binary.
>
> When trying to reproduce the perf_fuzzer myseriously segfaults on what
> appears to be perfectly valid mmap'd perf ring-buffers.
>
> (running under gdb)
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x0041efbb in __memset_sse2 ()
>
> => 0x0041efbb <+2203>: movdqa %xmm0,(%rdi)
>
> rdi 0xf7f61000 4160098304
>
> f7f61000-f7f72000 rw-s 00000000 00:08 4475 anon_inode:[perf_event]
>
> So I'm not sure if somehow something is wrong with the page mapping, that
> makes a valid write fail and sometimes (possibly due to address space
> randomization) reboot the system?

also strange, when I look at the core dumps it always shows the bad memory
address happening at the beginning of an mmap page as expected for the
ip listed, but the segfault listed in the kernel happens at some
completely unrelated address that isn't even page aligned and shouldn't be
possible based on the gdb/coredump results?

[ 1560.313863] perf_fuzzer[2826]: segfault at 503283ff ip 000000000041efbb
sp 00000000ffd367d8 error 6 in perf_fuzzer[400000+d1000]
[ 1704.673245] perf_fuzzer[2835]: segfault at 503283ff ip 000000000041efbb
sp 00000000ff972be8 error 6 in perf_fuzzer[400000+d1000]
[ 2978.101276] perf_fuzzer[2841]: segfault at 503283ff ip 000000000041efbb
sp 00000000ff92ba68 error 6 in perf_fuzzer[400000+d1000]
[ 4907.185366] perf_fuzzer[2868]: segfault at 503283ff ip 000000000041efbb
sp 00000000ffadcd28 error 6 in perf_fuzzer[400000+d1000]
[ 9570.793746] perf_fuzzer[6183]: segfault at 4d0bf28e ip 000000000041efbb
sp 00000000ff83f688 error 6 in perf_fuzzer[400000+d1000]
[ 9743.888431] perf_fuzzer[6187]: segfault at 91734d5 ip 000000000041efbb
sp 00000000ffb4e288 error 6 in perf_fuzzer[400000+d1000]

Vince


\
 
 \ /
  Last update: 2014-02-22 00:21    [W:0.085 / U:0.696 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site