2017-09-23 22:38:35

by Fengguang Wu

[permalink] [raw]
Subject: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Greetings,

0day kernel testing robot got the below dmesg and the first bad commit is

https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu

commit 9f4835fb965d8eea7e608d0cb62c246c804dec90
Author: Eric Biggers <[email protected]>
AuthorDate: Fri Sep 22 10:41:55 2017 -0700
Commit: Ingo Molnar <[email protected]>
CommitDate: Sat Sep 23 11:02:00 2017 +0200

x86/fpu: Tighten validation of user-supplied xstate_header

Move validation of user-supplied xstate_headers into a helper function
and call it from both the ptrace and sigreturn syscall paths. The new
function also considers it to be an error if *any* reserved bits are
set, whereas before we were just clearing most of them.

This should reduce the chance of bugs that fail to correctly validate
user-supplied XSAVE areas. It also will expose any broken userspace
programs that set the other reserved bits; this is desirable because
such programs will lose compatibility with future CPUs and kernels if
those bits are ever used for anything. (There shouldn't be any such
programs, and in fact in the case where the compacted format is in use
we were already validating xfeatures. But you never know...)

Signed-off-by: Eric Biggers <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Reviewed-by: Rik van Riel <[email protected]>
Acked-by: Dave Hansen <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Fenghua Yu <[email protected]>
Cc: Kevin Hao <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Michael Halcrow <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Wanpeng Li <[email protected]>
Cc: Yu-cheng Yu <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

29ed270cd3 x86/fpu: Don't let userspace set bogus xcomp_bv
9f4835fb96 x86/fpu: Tighten validation of user-supplied xstate_header
8d3e268d89 x86/fpu: Rename fpu__activate_fpstate_read/write() to fpu__read/write()
e7c6e36753 Merge branch 'x86/urgent'
+-----------------------------------------------------------+------------+------------+------------+------------+
| | 29ed270cd3 | 9f4835fb96 | 8d3e268d89 | e7c6e36753 |
+-----------------------------------------------------------+------------+------------+------------+------------+
| boot_successes | 35 | 2 | 6 | 0 |
| boot_failures | 0 | 13 | 13 | 11 |
| Kernel_panic-not_syncing:Attempted_to_kill_init!exitcode= | 0 | 13 | 13 | 11 |
+-----------------------------------------------------------+------------+------------+------------+------------+

[ 1.610349]
[ 1.611017] ======================================================
[ 1.611575] WARNING: possible circular locking dependency detected
[ 1.612125] 4.14.0-rc1-00218-g9f4835f #1 Not tainted
[ 1.612762] ------------------------------------------------------
[ 1.613483] kworker/0:1/13 is trying to acquire lock:
[ 1.613483] (ww_class_mutex){+.+.}, at: [<81151595>] test_abba_work+0xea/0x571
[ 1.613483]
[ 1.613483] but now in release context of a crosslock acquired at the following:
[ 1.613483] ((complete)&abba.b_ready){+.+.}, at: [<83104c1c>] wait_for_completion+0x25/0x35
[ 1.613483]
[ 1.613483] which lock already depends on the new lock.
[ 1.613483]
[ 1.613483] the existing dependency chain (in reverse order) is:
[ 1.613483]
[ 1.613483] -> #1 ((complete)&abba.b_ready){+.+.}:
[ 1.613483] validate_chain+0xf47/0x1171

# HH:MM RESULT GOOD BAD GOOD_BUT_DIRTY DIRTY_NOT_BAD
git bisect start f8fce8fa419bb00ed5a5d6e91abe6dbed75f5842 2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e --
git bisect good 330ac28434f18e4dfc62985e9d2ed5119c224781 # 23:44 G 11 0 0 0 Merge 'rdma/k.o/net-next-base' into devel-spot-201709232001
git bisect good 2cf018879b36a0d3681086cfc1c08c6cc9bef52a # 00:58 G 11 0 0 0 Merge 'linux-review/Thiebaud-Weksteen/Call-GetEventLog-before-ExitBootServices/20170923-004848' into devel-spot-201709232001
git bisect good 422c87daea34f0298708f6afdf4591e5a0f9b9ea # 01:13 G 10 0 0 0 Merge 'linux-review/Colin-King/video-fbdev-radeon-make-const-array-post_divs-static-reduces-object-code-size/20170922-203140' into devel-spot-201709232001
git bisect good 3303d4863ae6dd72e2481abfd247e127933a5631 # 01:31 G 11 0 0 0 Merge 'ceph-client/testing' into devel-spot-201709232001
git bisect bad 5310cfb68118cd2970a7e8b6d4693c23c2535564 # 01:50 B 0 3 15 0 Merge 'anholt/bcm2835-soc-next-v2' into devel-spot-201709232001
git bisect bad c346b48b4f79509e371f96aafb72f40f60810571 # 02:13 B 0 3 15 0 Merge 'tip/WIP.x86/fpu' into devel-spot-201709232001
git bisect good 1a4a586e67792afc4b3a070ce64e0aa7b1cd5bc0 # 02:40 G 11 0 0 0 x86/fpu: Remove 'kbuf' parameter from the copy_user_to_xstate() API
git bisect good 9e7deb522d8fa604f687b61dcd4c13358df9c753 # 03:34 G 11 0 0 0 x86/fpu: Decouple fpregs_activate()/fpregs_deactivate() from fpu->fpregs_active
git bisect good e9758265c677494bb8c532520cb950b14cf8709a # 03:55 G 11 0 0 0 x86/fpu: Fix boolreturn.cocci warnings
git bisect good 29ed270cd32335003f65dae9a6981c7819f3467c # 04:11 G 11 0 0 0 x86/fpu: Don't let userspace set bogus xcomp_bv
git bisect bad 9f4835fb965d8eea7e608d0cb62c246c804dec90 # 04:27 B 0 11 23 0 x86/fpu: Tighten validation of user-supplied xstate_header
# first bad commit: [9f4835fb965d8eea7e608d0cb62c246c804dec90] x86/fpu: Tighten validation of user-supplied xstate_header
git bisect good 29ed270cd32335003f65dae9a6981c7819f3467c # 04:34 G 31 0 0 0 x86/fpu: Don't let userspace set bogus xcomp_bv
# extra tests with CONFIG_DEBUG_INFO_REDUCED
git bisect bad 9f4835fb965d8eea7e608d0cb62c246c804dec90 # 04:51 B 0 11 23 0 x86/fpu: Tighten validation of user-supplied xstate_header
# extra tests on HEAD of linux-devel/devel-spot-201709232001
git bisect bad f8fce8fa419bb00ed5a5d6e91abe6dbed75f5842 # 04:51 B 0 31 51 4 0day head guard for 'devel-spot-201709232001'
# extra tests on tree/branch tip/WIP.x86/fpu
git bisect bad 8d3e268d89523abba613763da67c7eb47a744ad7 # 05:41 B 0 10 22 0 x86/fpu: Rename fpu__activate_fpstate_read/write() to fpu__read/write()
# extra tests with first bad commit reverted
git bisect good ab2a8bbacf8d609fb05ea05464eb6a00747a9459 # 06:05 G 11 0 0 0 Revert "x86/fpu: Tighten validation of user-supplied xstate_header"
# extra tests on tree/branch tip/master
git bisect bad e7c6e36753316c8dee2a7fe939db0c3046c5f357 # 06:36 B 0 11 23 0 Merge branch 'x86/urgent'

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/lkp Intel Corporation


Attachments:
(No filename) (7.32 kB)
dmesg-openwrt-lkp-nhm-dp2-10:20170924042638:i386-randconfig-b0-09232213:4.14.0-rc1-00218-g9f4835f:1.gz (24.30 kB)
reproduce-openwrt-lkp-nhm-dp2-10:20170924042638:i386-randconfig-b0-09232213:4.14.0-rc1-00218-g9f4835f:1 (877.00 B)
config-4.14.0-rc1-00218-g9f4835f (99.94 kB)
Download all attachments

2017-09-24 10:01:02

by Ingo Molnar

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b


* kernel test robot <[email protected]> wrote:

> Greetings,
>
> 0day kernel testing robot got the below dmesg and the first bad commit is
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu
>
> commit 9f4835fb965d8eea7e608d0cb62c246c804dec90
> Author: Eric Biggers <[email protected]>
> AuthorDate: Fri Sep 22 10:41:55 2017 -0700
> Commit: Ingo Molnar <[email protected]>
> CommitDate: Sat Sep 23 11:02:00 2017 +0200
>
> x86/fpu: Tighten validation of user-supplied xstate_header

So unfortunately the crash log was not extracted properly by the bot, so we only
know the subject line:

Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

One possibility would be for this memcpy() in copy_kernel_to_xstate() to cause the
crash:

memcpy(&hdr, kbuf + offset, size);

where 'size' increased from:


size = sizeof(xfeatures);

which was 8 bytes, to:

size = sizeof(hdr);

which is 64 bytes.

What guarantees that 'kbuf + offset + size-1' is still within the kbuf buffer?
AFAICS 'kbuf' gets validated with fpu_user_xstate_size.

... I might be barking up the wrong tree, but I don't see this guaranteed, at
least not in any obvious way.

In hindsight, I think we need to split up this commit:

x86/fpu: Tighten validation of user-supplied xstate_header

Into at least 5-6 parts (!), as it's way too large and risky.

Here is the split-up I'd suggest:

1)

Introduce the new validate_xstate_header() function - without actually using it.

2)

Change xstateregs_set() to use validate_xstate_header() and change the behavior of
reserved bits. Since this impacts the ABI we better have this as a standalone,
bisectable patch.

3)

Change sanitize_restored_xstate() to use the new validate_xstate_header().

4)

Change copy_kernel_to_xstate() to introduce the new on-kernel-stack header copy,
but don't yet update the rest of the code, just initialize 'xfeatures' from the
header copy and leave the rest unchanged.

5)

Fix copy_kernel_to_xstate() to now use the header properly, pass it to
validate_xstate_header() and get rid of the 'xfeatures' local variable, etc.

6)

Also, while this change looks correct but it's unrelated and spurious:

- if (boot_cpu_has(X86_FEATURE_XSAVES)) {
+ if (using_compacted_format()) {

and using_compacted_format() is a stupidly global function that adds overhead
unnecessarily:

int using_compacted_format(void)
{
return boot_cpu_has(X86_FEATURE_XSAVES);
}

It should be a static inline instead.

Thanks,

Ingo

2017-09-24 11:11:22

by Ingo Molnar

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b


* kernel test robot <[email protected]> wrote:

> Greetings,
>
> 0day kernel testing robot got the below dmesg and the first bad commit is
>
> https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu
>
> commit 9f4835fb965d8eea7e608d0cb62c246c804dec90
> Author: Eric Biggers <[email protected]>
> AuthorDate: Fri Sep 22 10:41:55 2017 -0700
> Commit: Ingo Molnar <[email protected]>
> CommitDate: Sat Sep 23 11:02:00 2017 +0200
>
> x86/fpu: Tighten validation of user-supplied xstate_header

Would it be possible to re-start this bisection, now that I've split up the commit
into 10 more obvious patches?

My guess is that it's one of these two that is the bad commit:

3deb4cca945b: x86/fpu: Copy the full header in copy_user_to_xstate()
cfbd048cce44: x86/fpu: Copy the full state_header in copy_kernel_to_xstate()

... but it could be some of the others as well.

Thanks,

Ingo

2017-09-25 02:20:25

by Fengguang Wu

[permalink] [raw]
Subject: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Hi Ingo,

On your request I'm resending the report here, with attached dmesg,
kconfig and reproduce script.

I'll go on to test your split up commits, too.

https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu

commit 9f4835fb965d8eea7e608d0cb62c246c804dec90
Author: Eric Biggers <[email protected]>
AuthorDate: Fri Sep 22 10:41:55 2017 -0700
Commit: Ingo Molnar <[email protected]>
CommitDate: Sat Sep 23 11:02:00 2017 +0200

x86/fpu: Tighten validation of user-supplied xstate_header

Move validation of user-supplied xstate_headers into a helper function
and call it from both the ptrace and sigreturn syscall paths. The new
function also considers it to be an error if *any* reserved bits are
set, whereas before we were just clearing most of them.

This should reduce the chance of bugs that fail to correctly validate
user-supplied XSAVE areas. It also will expose any broken userspace
programs that set the other reserved bits; this is desirable because
such programs will lose compatibility with future CPUs and kernels if
those bits are ever used for anything. (There shouldn't be any such
programs, and in fact in the case where the compacted format is in use
we were already validating xfeatures. But you never know...)

Signed-off-by: Eric Biggers <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Reviewed-by: Rik van Riel <[email protected]>
Acked-by: Dave Hansen <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Fenghua Yu <[email protected]>
Cc: Kevin Hao <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Michael Halcrow <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Wanpeng Li <[email protected]>
Cc: Yu-cheng Yu <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

29ed270cd3 x86/fpu: Don't let userspace set bogus xcomp_bv
9f4835fb96 x86/fpu: Tighten validation of user-supplied xstate_header
8d3e268d89 x86/fpu: Rename fpu__activate_fpstate_read/write() to fpu__read/write()
e7c6e36753 Merge branch 'x86/urgent'
+-----------------------------------------------------------+------------+------------+------------+------------+
| | 29ed270cd3 | 9f4835fb96 | 8d3e268d89 | e7c6e36753 |
+-----------------------------------------------------------+------------+------------+------------+------------+
| boot_successes | 35 | 2 | 6 | 0 |
| boot_failures | 0 | 13 | 13 | 11 |
| Kernel_panic-not_syncing:Attempted_to_kill_init!exitcode= | 0 | 13 | 13 | 11 |
+-----------------------------------------------------------+------------+------------+------------+------------+

procd: Console is alive
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 23.975862] init[1] bad frame in sigreturn frame:7fad9e6c ip:77f3bbc6 sp:7fada3fc orax:ffffffff in libuClibc-0.9.33.2.so[77f31000+4f000]
[ 23.977287] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 23.977287]
[ 23.978120] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc1-00218-g9f4835f #1
[ 23.978770] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
[ 23.979681] Call Trace:
[ 23.980087] dump_stack+0x40/0x5e
[ 23.980558] panic+0x1c5/0x58c
[ 23.980963] forget_original_parent+0x1ee/0x843
[ 23.981363] do_exit+0x1087/0x17c6
[ 23.981668] do_group_exit+0x1d1/0x1d1
[ 23.982017] get_signal+0x1294/0x12ca
[ 23.982345] do_signal+0x2c/0x55b
[ 23.982643] ? force_sig_info+0x1bd/0x1d5
[ 23.983079] ? force_sig+0x22/0x32
[ 23.983563] ? signal_fault+0x14b/0x161
[ 23.984168] ? exit_to_usermode_loop+0x2f/0x2ae
[ 23.984748] ? trace_hardirqs_on_caller+0x2d/0x384
[ 23.985170] exit_to_usermode_loop+0xf7/0x2ae
[ 23.985554] do_int80_syscall_32+0x4e8/0x4fe
[ 23.985937] entry_INT80_32+0x2f/0x2f
[ 23.986264] EIP: 0x77f3bbc6
[ 23.986515] EFLAGS: 00000246 CPU: 0
[ 23.986851] EAX: 00000000 EBX: 00000003 ECX: 77fb9554 EDX: 0000000a
[ 23.987385] ESI: ffffffff EDI: 7fada55c EBP: 7fada468 ESP: 7fada3fc
[ 23.987925] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 007b
[ 23.988462] Kernel Offset: disabled
# HH:MM RESULT GOOD BAD GOOD_BUT_DIRTY DIRTY_NOT_BAD
git bisect start f8fce8fa419bb00ed5a5d6e91abe6dbed75f5842 2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e --
git bisect good 330ac28434f18e4dfc62985e9d2ed5119c224781 # 23:44 G 11 0 0 0 Merge 'rdma/k.o/net-next-base' into devel-spot-201709232001
git bisect good 2cf018879b36a0d3681086cfc1c08c6cc9bef52a # 00:58 G 11 0 0 0 Merge 'linux-review/Thiebaud-Weksteen/Call-GetEventLog-before-ExitBootServices/20170923-004848' into devel-spot-201709232001
git bisect good 422c87daea34f0298708f6afdf4591e5a0f9b9ea # 01:13 G 10 0 0 0 Merge 'linux-review/Colin-King/video-fbdev-radeon-make-const-array-post_divs-static-reduces-object-code-size/20170922-203140' into devel-spot-201709232001
git bisect good 3303d4863ae6dd72e2481abfd247e127933a5631 # 01:31 G 11 0 0 0 Merge 'ceph-client/testing' into devel-spot-201709232001
git bisect bad 5310cfb68118cd2970a7e8b6d4693c23c2535564 # 01:50 B 0 3 15 0 Merge 'anholt/bcm2835-soc-next-v2' into devel-spot-201709232001
git bisect bad c346b48b4f79509e371f96aafb72f40f60810571 # 02:13 B 0 3 15 0 Merge 'tip/WIP.x86/fpu' into devel-spot-201709232001
git bisect good 1a4a586e67792afc4b3a070ce64e0aa7b1cd5bc0 # 02:40 G 11 0 0 0 x86/fpu: Remove 'kbuf' parameter from the copy_user_to_xstate() API
git bisect good 9e7deb522d8fa604f687b61dcd4c13358df9c753 # 03:34 G 11 0 0 0 x86/fpu: Decouple fpregs_activate()/fpregs_deactivate() from fpu->fpregs_active
git bisect good e9758265c677494bb8c532520cb950b14cf8709a # 03:55 G 11 0 0 0 x86/fpu: Fix boolreturn.cocci warnings
git bisect good 29ed270cd32335003f65dae9a6981c7819f3467c # 04:11 G 11 0 0 0 x86/fpu: Don't let userspace set bogus xcomp_bv
git bisect bad 9f4835fb965d8eea7e608d0cb62c246c804dec90 # 04:27 B 0 11 23 0 x86/fpu: Tighten validation of user-supplied xstate_header
# first bad commit: [9f4835fb965d8eea7e608d0cb62c246c804dec90] x86/fpu: Tighten validation of user-supplied xstate_header
git bisect good 29ed270cd32335003f65dae9a6981c7819f3467c # 04:34 G 31 0 0 0 x86/fpu: Don't let userspace set bogus xcomp_bv
# extra tests with CONFIG_DEBUG_INFO_REDUCED
git bisect bad 9f4835fb965d8eea7e608d0cb62c246c804dec90 # 04:51 B 0 11 23 0 x86/fpu: Tighten validation of user-supplied xstate_header
# extra tests on HEAD of linux-devel/devel-spot-201709232001
git bisect bad f8fce8fa419bb00ed5a5d6e91abe6dbed75f5842 # 04:51 B 0 31 51 4 0day head guard for 'devel-spot-201709232001'
# extra tests on tree/branch tip/WIP.x86/fpu
git bisect bad 8d3e268d89523abba613763da67c7eb47a744ad7 # 05:41 B 0 10 22 0 x86/fpu: Rename fpu__activate_fpstate_read/write() to fpu__read/write()
# extra tests with first bad commit reverted
git bisect good ab2a8bbacf8d609fb05ea05464eb6a00747a9459 # 06:05 G 11 0 0 0 Revert "x86/fpu: Tighten validation of user-supplied xstate_header"
# extra tests on tree/branch tip/master
git bisect bad e7c6e36753316c8dee2a7fe939db0c3046c5f357 # 06:36 B 0 11 23 0 Merge branch 'x86/urgent'

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/lkp Intel Corporation


Attachments:
(No filename) (8.11 kB)
dmesg-openwrt-lkp-nhm-dp2-10:20170924042638:i386-randconfig-b0-09232213:4.14.0-rc1-00218-g9f4835f:1.gz (24.30 kB)
reproduce-openwrt-lkp-nhm-dp2-10:20170924042638:i386-randconfig-b0-09232213:4.14.0-rc1-00218-g9f4835f:1 (877.00 B)
config-4.14.0-rc1-00218-g9f4835f (99.94 kB)
Download all attachments

2017-09-25 13:10:46

by Wu Fengguang

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

On Mon, Sep 25, 2017 at 10:20:13AM +0800, kernel test robot wrote:
>Hi Ingo,
>
>On your request I'm resending the report here, with attached dmesg,
>kconfig and reproduce script.
>
>I'll go on to test your split up commits, too.
>
>https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu

It looks 6fc19a42 ("x86/fpu: Use validate_xstate_header() to validate
the xstate_header in sanitize_restored_xstate()") is the first bad commit.

Attached are the dmesg files for 6fc19a42 and its parent commit.

The panic message is,

[ 28.093528] Freeing unused kernel memory: 1656K
[ 28.094182] Write protecting the kernel text: 33872k
[ 28.094922] Write protecting the kernel read-only data: 12160k
[ 28.095441] NX-protecting the kernel data: 23472k
[ 28.130213] init[1] bad frame in sigreturn frame:7fdddcec ip:77f5a1b2 sp:7fdde254 orax:ffffffff in ld-2.15.so[77f59000+20000]
[ 28.131803] init[1] bad frame in sigreturn frame:7fddd62c ip:77f5a1b0 sp:7fdddb94 orax:ffffffff in ld-2.15.so[77f59000+20000]
[ 28.133169] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 28.133169]
[ 28.133979] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc1-00228-g6fc19a4 #1
[ 28.134601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014
[ 28.135659] Call Trace:
[ 28.136070] dump_stack+0x40/0x5e
[ 28.136594] panic+0x1c5/0x58c
[ 28.137072] forget_original_parent+0x1ee/0x843
[ 28.137514] do_exit+0x1087/0x17c6
[ 28.137813] do_group_exit+0x1d1/0x1d1
[ 28.138220] get_signal+0x1294/0x12ca
[ 28.138546] do_signal+0x2c/0x55b
[ 28.138842] ? force_sig_info+0x1bd/0x1d5
[ 28.139219] ? force_sig+0x22/0x32
[ 28.139519] ? signal_fault+0x14b/0x161
[ 28.139853] ? exit_to_usermode_loop+0x2f/0x2ae
[ 28.140255] ? trace_hardirqs_on_caller+0x2d/0x384
[ 28.140671] exit_to_usermode_loop+0xf7/0x2ae
[ 28.141058] do_int80_syscall_32+0x4e8/0x4fe
[ 28.141432] entry_INT80_32+0x2f/0x2f
[ 28.141829] EIP: 0x77f5a1b0
[ 28.142093] EFLAGS: 00000246 CPU: 0
[ 28.142401] EAX: 00000000 EBX: 0000009c ECX: 00000000 EDX: 00000000
[ 28.142943] ESI: 0000000b EDI: 004ae4c8 EBP: 7fdddce8 ESP: 7fdddb94
[ 28.143482] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 007b
[ 28.143959] Kernel Offset: disabled

Thanks,
Fengguang


Attachments:
(No filename) (2.28 kB)
dmesg-quantal-vp-10:20170925202102:i386-randconfig-b0-09232213:4.14.0-rc1-00228-g6fc19a4:1 (86.41 kB)
dmesg-quantal-vp-62:20170925203459:i386-randconfig-b0-09232213:4.14.0-rc1-00227-gcc4be4e:1 (101.55 kB)
Download all attachments

2017-09-25 14:55:15

by Ingo Molnar

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b


* Fengguang Wu <[email protected]> wrote:

> On Mon, Sep 25, 2017 at 10:20:13AM +0800, kernel test robot wrote:
> > Hi Ingo,
> >
> > On your request I'm resending the report here, with attached dmesg,
> > kconfig and reproduce script.
> >
> > I'll go on to test your split up commits, too.
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu
>
> It looks 6fc19a42 ("x86/fpu: Use validate_xstate_header() to validate
> the xstate_header in sanitize_restored_xstate()") is the first bad commit.

Thank you! Could you check that the latest tip:master or tip:WIP.x86/fpu
(9cff7344187e) fixes this crash?

Thanks,

Ingo

2017-09-26 00:19:54

by Wu Fengguang

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

On Mon, Sep 25, 2017 at 04:55:09PM +0200, Ingo Molnar wrote:
>
>* Fengguang Wu <[email protected]> wrote:
>
>> On Mon, Sep 25, 2017 at 10:20:13AM +0800, kernel test robot wrote:
>> > Hi Ingo,
>> >
>> > On your request I'm resending the report here, with attached dmesg,
>> > kconfig and reproduce script.
>> >
>> > I'll go on to test your split up commits, too.
>> >
>> > https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu
>>
>> It looks 6fc19a42 ("x86/fpu: Use validate_xstate_header() to validate
>> the xstate_header in sanitize_restored_xstate()") is the first bad commit.
>
>Thank you! Could you check that the latest tip:master or tip:WIP.x86/fpu
>(9cff7344187e) fixes this crash?

Yes, both of them are free from that crash. :)

Regards,
Fengguang

2017-09-26 06:25:10

by Ingo Molnar

[permalink] [raw]
Subject: Re: 9f4835fb96 ("x86/fpu: Tighten validation of user-supplied .."): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

* Fengguang Wu <[email protected]> wrote:

> On Mon, Sep 25, 2017 at 04:55:09PM +0200, Ingo Molnar wrote:
> >
> > * Fengguang Wu <[email protected]> wrote:
> >
> > > On Mon, Sep 25, 2017 at 10:20:13AM +0800, kernel test robot wrote:
> > > > Hi Ingo,
> > > >
> > > > On your request I'm resending the report here, with attached dmesg,
> > > > kconfig and reproduce script.
> > > >
> > > > I'll go on to test your split up commits, too.
> > > >
> > > > https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git WIP.x86/fpu
> > >
> > > It looks 6fc19a42 ("x86/fpu: Use validate_xstate_header() to validate
> > > the xstate_header in sanitize_restored_xstate()") is the first bad commit.
> >
> > Thank you! Could you check that the latest tip:master or tip:WIP.x86/fpu
> > (9cff7344187e) fixes this crash?
>
> Yes, both of them are free from that crash. :)

Great, thanks!

Ingo