Messages in this thread | | | Date | Sun, 27 Aug 2023 13:56:14 +0530 | From | Tasmiya Nalatwad <> | Subject | [linux-next][mainline/master] [IPR] [Function could be = "__mutex_lock_slowpath(lock)"]OOPs kernel crash while performing IPR test |
| |
Greetings,
[linux-next][mainline/master] [IPR] [Function could be = "__mutex_lock_slowpath(lock)"]OOPs kernel crash while performing IPR test
--- Traces ---
--- Traces --- [65818.211823] Kernel attempted to read user page (380) - exploit attempt? (uid: 0) [65818.211836] BUG: Kernel NULL pointer dereference on read at 0x00000380 [65818.211840] Faulting instruction address: 0xc000000000f5f2e4 [65818.211844] Oops: Kernel access of bad area, sig: 11 [#1] [65818.211846] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries [65818.211850] Modules linked in: rpadlpar_io rpaphp nfnetlink xsk_diag bonding tls rfkill sunrpc ses enclosure scsi_transport_sas vmx_crypto pseries_rng binfmt_misc ip_tables ext4 mbcache jbd2 dm_service_time sd_mod t10_pi crc64_rocksoft crc64 sg ibmvfc scsi_transport_fc ibmveth ipr dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse [65818.211879] CPU: 16 PID: 613 Comm: kworker/16:3 Kdump: loaded Not tainted 6.5.0-rc7-next-20230824-auto #1 [65818.211883] Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1030.30 (NH1030_062) hv:phyp pSeries [65818.211887] Workqueue: events sg_remove_sfp_usercontext [sg] [65818.211894] NIP: c000000000f5f2e4 LR: c000000000f5f2d8 CTR: c00000000032df70 [65818.211897] REGS: c0000000081c7a10 TRAP: 0300 Not tainted (6.5.0-rc7-next-20230824-auto) [65818.211900] MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28000882 XER: 20040000 [65818.211909] CFAR: c000000000f5b0a4 DAR: 0000000000000380 DSISR: 40000000 IRQMASK: 0 [65818.211909] GPR00: c000000000f5f2d8 c0000000081c7cb0 c000000001451300 0000000000000000 [65818.211909] GPR04: 00000000000000c0 00000000c0000000 c000000006c5a298 98a2c506000000c0 [65818.211909] GPR08: c00000006408ab00 c0000000022a3515 0000000000000000 c008000000327d60 [65818.211909] GPR12: c00000000032df70 c000000c1bc93f00 c000000000197cc8 c000000008797500 [65818.211909] GPR16: 0000000000000000 0000000000000000 0000000000000000 c000000003071ab0 [65818.211909] GPR20: c000000003494c05 c000000c11340040 0000000000000000 c0000000b9bb4030 [65818.211909] GPR24: c0000000b9bb4000 c00000005e8627c0 0000000000000000 c000000c19b91e00 [65818.211909] GPR28: c0000000b9bb5328 c00000005e8627c0 0000000000000380 0000000000000380 [65818.211946] NIP [c000000000f5f2e4] mutex_lock+0x34/0x90 [65818.211953] LR [c000000000f5f2d8] mutex_lock+0x28/0x90 [65818.211957] Call Trace: [65818.211959] [c0000000081c7cb0] [c000000000f5f2d8] mutex_lock+0x28/0x90 (unreliable) [65818.211966] [c0000000081c7ce0] [c00000000032df9c] blk_trace_remove+0x2c/0x80 [65818.211971] [c0000000081c7d10] [c0080000003205fc] sg_device_destroy+0x44/0x110 [sg] [65818.211976] [c0000000081c7d90] [c008000000322988] sg_remove_sfp_usercontext+0x1d0/0x2c0 [sg] [65818.211981] [c0000000081c7e40] [c000000000188010] process_scheduled_works+0x230/0x4f0 [65818.211987] [c0000000081c7f10] [c00000000018b044] worker_thread+0x1e4/0x500 [65818.211992] [c0000000081c7f90] [c000000000197df8] kthread+0x138/0x140 [65818.211996] [c0000000081c7fe0] [c00000000000df98] start_kernel_thread+0x14/0x18 [65818.212000] Code: 38422050 7c0802a6 60000000 7c0802a6 fbe1fff8 7c7f1b78 f8010010 f821ffd1 4bffbd95 60000000 39400000 e90d0908 <7d20f8a8> 7c295000 40c20010 7d00f9ad [65818.212013] ---[ end trace 0000000000000000 ]---
Tried running gdb on the vmlinux code using faulting address. Looks like the bug is initiated from the function "__mutex_lock_slowpath(lock);"
[root@localhost ]# gdb vmlinux -ex "disassemble /m 0xc000000000f5f2e4" GNU gdb (GDB) Red Hat Enterprise Linux 8.2-15.el8 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "ppc64le-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>.
For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from vmlinux...done. Dump of assembler code for function mutex_lock: 282 { 0xc000000000f5f2b0 <+0>: addis r2,r12,79 0xc000000000f5f2b4 <+4>: addi r2,r2,8272 0xc000000000f5f2b8 <+8>: mflr r0 0xc000000000f5f2bc <+12>: bl 0xc0000000000807d4 <mcount>
283 might_sleep(); 0xc000000000f5f2c0 <+16>: mflr r0 0xc000000000f5f2c4 <+20>: std r31,-8(r1) 0xc000000000f5f2c8 <+24>: mr r31,r3 0xc000000000f5f2cc <+28>: std r0,16(r1) 0xc000000000f5f2d0 <+32>: stdu r1,-48(r1) 0xc000000000f5f2d4 <+36>: bl 0xc000000000f5b068 <__cond_resched+8> 0xc000000000f5f2d8 <+40>: nop
284 285 if (!__mutex_trylock_fast(lock)) 286 __mutex_lock_slowpath(lock); 0xc000000000f5f304 <+84>: addi r1,r1,48 0xc000000000f5f308 <+88>: mr r3,r31 0xc000000000f5f30c <+92>: ld r0,16(r1) --Type <RET> for more, q to quit, c to continue without paging--c 0xc000000000f5f310 <+96>: ld r31,-8(r1) 0xc000000000f5f314 <+100>: mtlr r0 0xc000000000f5f318 <+104>: b 0xc000000000f5f298 <__mutex_lock_slowpath+8> 0xc000000000f5f31c <+108>: nop 0xc000000000f5f320 <+112>: addi r1,r1,48 0xc000000000f5f324 <+116>: ld r0,16(r1) 0xc000000000f5f328 <+120>: ld r31,-8(r1) 0xc000000000f5f32c <+124>: mtlr r0 0xc000000000f5f330 <+128>: blr 0xc000000000f5f334: nop 0xc000000000f5f338: nop 0xc000000000f5f33c: nop
End of assembler dump.
[root@localhost ]# grep -irn "mutex_lock_slowpath(lock)" kernel/locking/mutex.c:286:
-- Regards, Tasmiya Nalatwad IBM Linux Technology Center
| |