Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 6f70bae3cffed4f3b1a4e9f94b8505e114a40223 ("io_uring: ensure io-wq context is always destroyed for tasks")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
in testcase: trinity
version: trinity-static-x86_64-x86_64-1c734c75-1_2020-01-06
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+-------------------------------------------+------------+------------+
| | e4595c30ec | 6f70bae3cf |
+-------------------------------------------+------------+------------+
| boot_successes | 10 | 0 |
| boot_failures | 0 | 6 |
| BUG:KASAN:use-after-free_in__lock_acquire | 0 | 6 |
| INFO:trying_to_register_non-static_key | 0 | 6 |
+-------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <[email protected]>
[ 86.069634] BUG: KASAN: use-after-free in __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1))
[ 86.070069] Read of size 8 at addr ffff88810feb0710 by task trinity-c3/790
[ 86.070508]
[ 86.070613] CPU: 0 PID: 790 Comm: trinity-c3 Not tainted 5.11.0-07414-g6f70bae3cffe #1
[ 86.071119] Call Trace:
[ 86.071284] ? dump_stack (kbuild/src/consumer/lib/dump_stack.c:79 kbuild/src/consumer/lib/dump_stack.c:130)
[ 86.071523] ? print_address_description+0x26/0x3d8
[ 86.071910] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1))
[ 86.072176] ? kasan_report (kbuild/src/consumer/mm/kasan/report.c:397 kbuild/src/consumer/mm/kasan/report.c:413)
[ 86.072430] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1))
[ 86.072695] ? __asan_load8 (kbuild/src/consumer/mm/kasan/generic.c:179 kbuild/src/consumer/mm/kasan/generic.c:252)
[ 86.072943] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4770 (discriminator 1))
[ 86.073208] ? lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:437 kbuild/src/consumer/kernel/locking/lockdep.c:5512)
[ 86.073463] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.073731] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:5478)
[ 86.074006] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006)
[ 86.074352] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278)
[ 86.074591] ? rcu_read_lock_held (kbuild/src/consumer/kernel/rcu/update.c:120)
[ 86.074869] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006)
[ 86.075217] ? _raw_spin_lock_irqsave (kbuild/src/consumer/include/linux/spinlock_api_smp.h:117 kbuild/src/consumer/kernel/locking/spinlock.c:159)
[ 86.075518] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.075780] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.076043] ? ttwu_do_wakeup+0x42/0x42
[ 86.076338] ? wake_up_process (kbuild/src/consumer/kernel/sched/core.c:3535)
[ 86.076601] ? io_wq_destroy (kbuild/src/consumer/fs/io-wq.c:1000)
[ 86.076857] ? __io_uring_files_cancel (kbuild/src/consumer/fs/io_uring.c:8809)
[ 86.077178] ? __io_uring_free (kbuild/src/consumer/fs/io_uring.c:8794)
[ 86.077436] ? read_cred_subscribers (kbuild/src/consumer/arch/x86/include/asm/atomic.h:29 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:28 kbuild/src/consumer/kernel/cred.c:75)
[ 86.077741] ? __validate_process_creds (kbuild/src/consumer/kernel/cred.c:793 (discriminator 1) kbuild/src/consumer/kernel/cred.c:855 (discriminator 1))
[ 86.078058] ? do_exit (kbuild/src/consumer/include/linux/io_uring.h:47 kbuild/src/consumer/kernel/exit.c:780)
[ 86.078284] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278)
[ 86.078522] ? forget_original_parent (kbuild/src/consumer/kernel/exit.c:728)
[ 86.078829] ? do_group_exit (kbuild/src/consumer/kernel/exit.c:932)
[ 86.079087] ? __do_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931)
[ 86.079368] ? __x64_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931)
[ 86.079654] ? do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:46)
[ 86.079903] ? entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112)
[ 86.080244]
[ 86.080349] Allocated by task 0:
[ 86.080563] (stack is not available)
[ 86.080796]
[ 86.080900] Freed by task 11:
[ 86.081097] arch_stack_walk (kbuild/src/consumer/arch/x86/kernel/stacktrace.c:25)
[ 86.081345] stack_trace_save (kbuild/src/consumer/kernel/stacktrace.c:113)
[ 86.081599] kasan_save_stack (kbuild/src/consumer/mm/kasan/common.c:38)
[ 86.081863] kasan_set_track (kbuild/src/consumer/mm/kasan/common.c:46)
[ 86.082109] kasan_set_free_info (kbuild/src/consumer/mm/kasan/generic.c:358)
[ 86.082380] ____kasan_slab_free (kbuild/src/consumer/mm/kasan/common.c:364)
[ 86.082661] __kasan_slab_free (kbuild/src/consumer/mm/kasan/common.c:369)
[ 86.082919] slab_free_freelist_hook (kbuild/src/consumer/mm/slub.c:1580)
[ 86.083224] kmem_cache_free (kbuild/src/consumer/mm/slub.c:3143 kbuild/src/consumer/mm/slub.c:3159)
[ 86.083478] free_task_struct (kbuild/src/consumer/kernel/fork.c:175)
[ 86.083733] free_task (kbuild/src/consumer/kernel/fork.c:465)
[ 86.083948] __put_task_struct (kbuild/src/consumer/kernel/fork.c:742)
[ 86.084218] put_task_struct (kbuild/src/consumer/include/linux/sched/task.h:111)
[ 86.084465] delayed_put_task_struct (kbuild/src/consumer/kernel/exit.c:173)
[ 86.084767] rcu_process_callbacks (kbuild/src/consumer/kernel/rcu/tiny.c:98 kbuild/src/consumer/kernel/rcu/tiny.c:130)
[ 86.085058] __do_softirq (kbuild/src/consumer/kernel/softirq.c:343)
[ 86.085300]
[ 86.085404] The buggy address belongs to the object at ffff88810feb0000
[ 86.085404] which belongs to the cache task_struct of size 10368
[ 86.086212] The buggy address is located 1808 bytes inside of
[ 86.086212] 10368-byte region [ffff88810feb0000, ffff88810feb2880)
[ 86.086968] The buggy address belongs to the page:
[ 86.087278] page:00000000a6c89120 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10feb0
[ 86.087879] head:00000000a6c89120 order:3 compound_mapcount:0 compound_pincount:0
[ 86.088357] flags: 0x4000000000010200(slab|head)
[ 86.088662] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100100dc0
[ 86.089156] raw: 0000000000000000 0000000000030003 00000001ffffffff 0000000000000000
[ 86.089650] page dumped because: kasan: bad access detected
[ 86.090018]
[ 86.090123] Memory state around the buggy address:
[ 86.090433] ffff88810feb0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.090896] ffff88810feb0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.091358] >ffff88810feb0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.091820] ^
[ 86.092066] ffff88810feb0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.092528] ffff88810feb0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 86.092989] ==================================================================
[ 86.093449] Disabling lock debugging due to kernel taint
[ 86.093801] INFO: trying to register non-static key.
[ 86.094123] the code is fine but needs lockdep annotation.
[ 86.094473] turning off the locking correctness validator.
[ 86.094825] CPU: 0 PID: 790 Comm: trinity-c3 Tainted: G B 5.11.0-07414-g6f70bae3cffe #1
[ 86.095418] Call Trace:
[ 86.095583] ? dump_stack (kbuild/src/consumer/lib/dump_stack.c:79 kbuild/src/consumer/lib/dump_stack.c:130)
[ 86.095817] ? register_lock_class (kbuild/src/consumer/kernel/locking/lockdep.c:936 kbuild/src/consumer/kernel/locking/lockdep.c:1247)
[ 86.096110] ? _raw_spin_unlock_irqrestore (kbuild/src/consumer/include/linux/spinlock_api_smp.h:159 kbuild/src/consumer/kernel/locking/spinlock.c:191)
[ 86.096434] ? is_dynamic_key (kbuild/src/consumer/kernel/locking/lockdep.c:1235)
[ 86.096699] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:4779)
[ 86.096962] ? lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:437 kbuild/src/consumer/kernel/locking/lockdep.c:5512)
[ 86.097214] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.097472] ? __lock_acquire (kbuild/src/consumer/kernel/locking/lockdep.c:5478)
[ 86.097756] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006)
[ 86.098099] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278)
[ 86.098336] ? rcu_read_lock_held (kbuild/src/consumer/kernel/rcu/update.c:120)
[ 86.098610] ? __cpuhp_state_remove_instance (kbuild/src/consumer/kernel/cpu.c:2006)
[ 86.098953] ? _raw_spin_lock_irqsave (kbuild/src/consumer/include/linux/spinlock_api_smp.h:117 kbuild/src/consumer/kernel/locking/spinlock.c:159)
[ 86.099250] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.099508] ? try_to_wake_up (kbuild/src/consumer/kernel/sched/core.c:3349)
[ 86.099767] ? ttwu_do_wakeup+0x42/0x42
[ 86.100058] ? wake_up_process (kbuild/src/consumer/kernel/sched/core.c:3535)
[ 86.100320] ? io_wq_destroy (kbuild/src/consumer/fs/io-wq.c:1000)
[ 86.100572] ? __io_uring_files_cancel (kbuild/src/consumer/fs/io_uring.c:8809)
[ 86.100883] ? __io_uring_free (kbuild/src/consumer/fs/io_uring.c:8794)
[ 86.101141] ? read_cred_subscribers (kbuild/src/consumer/arch/x86/include/asm/atomic.h:29 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:28 kbuild/src/consumer/kernel/cred.c:75)
[ 86.101432] ? __validate_process_creds (kbuild/src/consumer/kernel/cred.c:793 (discriminator 1) kbuild/src/consumer/kernel/cred.c:855 (discriminator 1))
[ 86.101777] ? do_exit (kbuild/src/consumer/include/linux/io_uring.h:47 kbuild/src/consumer/kernel/exit.c:780)
[ 86.102003] ? lock_is_held (kbuild/src/consumer/include/linux/lockdep.h:278)
[ 86.102240] ? forget_original_parent (kbuild/src/consumer/kernel/exit.c:728)
[ 86.102549] ? do_group_exit (kbuild/src/consumer/kernel/exit.c:932)
[ 86.102808] ? __do_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931)
[ 86.103091] ? __x64_sys_exit_group (kbuild/src/consumer/kernel/exit.c:931)
[ 86.103376] ? do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:46)
[ 86.103625] ? entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112)
[ 89.183692] caif:caif_disconnect_client(): nothing to disconnect
[ 89.185869] caif:caif_disconnect_client(): nothing to disconnect
[ 89.186518] caif:caif_disconnect_client(): nothing to disconnect
[ 89.187438] caif:caif_disconnect_client(): nothing to disconnect
[ 89.188112] caif:caif_disconnect_client(): nothing to disconnect
[ 89.188737] caif:caif_disconnect_client(): nothing to disconnect
[ 89.189737] caif:caif_disconnect_client(): nothing to disconnect
[ 89.190413] caif:caif_disconnect_client(): nothing to disconnect
[ 89.191422] caif:caif_disconnect_client(): nothing to disconnect
[ 89.192109] caif:caif_disconnect_client(): nothing to disconnect
[ 89.192742] caif:caif_disconnect_client(): nothing to disconnect
[ 89.193745] caif:caif_disconnect_client(): nothing to disconnect
Kboot worker: lkp-worker05
Elapsed time: 120
kvm=(
qemu-system-x86_64
-enable-kvm
-cpu SandyBridge
-kernel $kernel
-initrd initrd-vm-snb-146.cgz
-m 8192
-smp 2
-device e1000,netdev=net0
-netdev user,id=net0,hostfwd=tcp::32032-:22
-boot order=nc
-no-reboot
-watchdog i6300esb
-watchdog-action debug
-rtc base=localtime
-serial stdio
-display none
-monitor null
)
append=(
ip=::::vm-snb-146::dhcp
root=/dev/ram0
user=lkp
job=/job-script
ARCH=x86_64
kconfig=x86_64-randconfig-a011-20210223
branch=linux-next/master
commit=6f70bae3cffed4f3b1a4e9f94b8505e114a40223
BOOT_IMAGE=/pkg/linux/x86_64-randconfig-a011-20210223/gcc-9/6f70bae3cffed4f3b1a4e9f94b8505e114a40223/vmlinuz-5.11.0-07414-g6f70bae3cffe
vmalloc=512M
max_uptime=2100
RESULT_ROOT=/result/trinity/300s/vm-snb/yocto-x86_64-minimal-20190520.cgz/x86_64-randconfig-a011-20210223/gcc-9/6f70bae3cffed4f3b1a4e9f94b8505e114a40223/3
result_service=tmpfs
selinux=0
debug
apic=debug
sysrq_always_enabled
rcupdate.rcu_cpu_stall_timeout=100
net.ifnames=0
printk.devkmsg=on
panic=-1
softlockup_panic=1
nmi_watchdog=panic
oops=panic
load_ramdisk=2
prompt_ramdisk=0
drbd.minor_count=8
systemd.log_level=err
ignore_loglevel
To reproduce:
# build kernel
cd linux
cp config-5.11.0-07414-g6f70bae3cffe .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
Oliver Sang
On 2/24/21 10:38 PM, kernel test robot wrote:
>
> Greeting,
>
> FYI, we noticed the following commit (built with gcc-9):
>
> commit: 6f70bae3cffed4f3b1a4e9f94b8505e114a40223 ("io_uring: ensure io-wq context is always destroyed for tasks")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
This one has been fixed.
--
Jens Axboe