Messages in this thread | | | Date | Tue, 11 Oct 2022 02:03:02 +0100 | Subject | Re: BUG: corrupted list in io_poll_task_func | From | Pavel Begunkov <> |
| |
On 10/10/22 13:41, Wei Chen wrote: > Dear Linux Developer, > > Recently when using our tool to fuzz kernel, the following crash was triggered: > > HEAD commit: c5eb0a61238d Linux 5.18-rc6 > git tree: upstream > compiler: clang 12.0.0 > console output: > https://drive.google.com/file/d/1Obzlp9wrLFx9BogwmOHhmnQqyMYa2z_k/view?usp=sharing > kernel config: https://drive.google.com/file/d/12fNP5UArsFqTi2jjGomWuCk5evtgU0Gu/view?usp=sharing
It's hard to tell anything as it's rc6 and we have a couple of poll fixes backported to stable 5.18. Would be great if you tell whether you see it with a stable kernel. Also a repro would help if it finds it. Thanks
> Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: Wei Chen <harperchen1110@gmail.com> > > list_del corruption. prev->next should be ffff88810ec0ae30, but was > ffff888114119218. (prev=ffff888114119218) > ------------[ cut here ]------------ > kernel BUG at lib/list_debug.c:53! > invalid opcode: 0000 [#1] PREEMPT SMP > CPU: 0 PID: 20805 Comm: iou-sqp-20802 Not tainted 5.18.0-rc6 #10 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > 1.13.0-1ubuntu1.1 04/01/2014 > RIP: 0010:__list_del_entry_valid+0xa7/0xc0 > Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f > 0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b > 48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01 > RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046 > RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900 > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 > RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000 > R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218 > R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30 > FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0 > DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 > PKRU: 55555554 > Call Trace: > <TASK> > io_poll_task_func+0x1ca/0x4f0 > tctx_task_work+0x808/0xae0 > task_work_run+0x8e/0x110 > get_signal+0x13c6/0x1520 > io_sq_thread+0x382/0xbd0 > ret_from_fork+0x1f/0x30 > </TASK> > Modules linked in: > Dumping ftrace buffer: > (ftrace buffer empty) > ---[ end trace 0000000000000000 ]--- > RIP: 0010:__list_del_entry_valid+0xa7/0xc0 > Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f > 0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b > 48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01 > RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046 > RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900 > RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 > RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000 > R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218 > R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30 > FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0 > DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 > PKRU: 55555554 > > Best, > Wei
-- Pavel Begunkov
| |