Running a Clang (9.0.1) build kernel with UBSAN generated a few warnings during boot,
[ 0.000000] UBSAN: null-ptr-deref in drivers/acpi/acpica/tbfadt.c:459:37
[ 0.000000] member access within null pointer of type 'struct acpi_table_fadt'
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc4-next-20200507 #2
[ 0.000000] Call trace:
[ 0.000000] dump_backtrace+0x0/0x22c
[ 0.000000] show_stack+0x28/0x34
[ 0.000000] dump_stack+0x104/0x194
[ 0.000000] handle_null_ptr_deref+0xdc/0x10c
[ 0.000000] __ubsan_handle_type_mismatch_v1+0x64/0x78
[ 0.000000] acpi_tb_create_local_fadt+0x104/0x6ec
[ 0.000000] acpi_tb_parse_fadt+0xa0/0x1a0
[ 0.000000] acpi_tb_parse_root_table+0x284/0x2ac
[ 0.000000] acpi_initialize_tables+0xb4/0xd0
[ 0.000000] acpi_table_init+0x68/0x88
[ 0.000000] acpi_boot_table_init+0x108/0x1a0
[ 0.000000] setup_arch+0xec/0x1f4
[ 0.000000] start_kernel+0x94/0x56c
[ 0.000000] UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6
[ 0.000000] member access within null pointer of type 'struct acpi_madt_generic_interrupt'
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc4-next-20200507 #2
[ 0.000000] Call trace:
[ 0.000000] dump_backtrace+0x0/0x22c
[ 0.000000] show_stack+0x28/0x34
[ 0.000000] dump_stack+0x104/0x194
[ 0.000000] handle_null_ptr_deref+0xdc/0x10c
[ 0.000000] __ubsan_handle_type_mismatch_v1+0x64/0x78
[ 0.000000] acpi_parse_gic_cpu_interface+0x40/0xa8
[ 0.000000] acpi_parse_entries_array+0x1d4/0x2e8
[ 0.000000] acpi_table_parse_entries_array+0x11c/0x138
[ 0.000000] acpi_table_parse_madt+0x84/0xb0
[ 0.000000] acpi_parse_and_init_cpus+0x24/0x80
[ 0.000000] smp_init_cpus+0x38/0x17c
[ 0.000000] setup_arch+0x140/0x1f4
[ 0.000000] start_kernel+0x94/0x56c
[ 255.388250] UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
[ 255.394898] member access within null pointer of type 'struct xfs_kobj'
[ 255.402346] CPU: 230 PID: 2364 Comm: modprobe Tainted: G L 5.7.0-rc4-next-20200507 #2
[ 255.412191] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
[ 255.422641] Call trace:
[ 255.425811] dump_backtrace+0x0/0x22c
[ 255.430188] show_stack+0x28/0x34
[ 255.434225] dump_stack+0x104/0x194
[ 255.438441] handle_null_ptr_deref+0xdc/0x10c
[ 255.443511] __ubsan_handle_type_mismatch_v1+0x64/0x78
[ 255.450016] init_module+0x130/0x1d4 [xfs]
[ 255.454831] do_one_initcall+0x6c/0x144
[ 255.459383] do_init_module+0x100/0x388
[ 255.463931] load_module+0x2518/0x2b9c
[ 255.468404] __se_sys_finit_module+0x144/0x150
[ 255.473560] __arm64_sys_finit_module+0x54/0x88
[ 255.478804] do_el0_svc+0x128/0x1dc
[ 255.483010] el0_sync_handler+0xd0/0x268
[ 255.487655] el0_sync+0x164/0x180
[ 255.491782] ================================================================================
[ 255.769799] ================================================================================
[ 255.779164] UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
[ 255.785816] member access within null pointer of type 'struct xfs_kobj'
[ 255.793268] CPU: 132 PID: 2363 Comm: mount Tainted: G L 5.7.0-rc4-next-20200507 #2
[ 255.802854] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
[ 255.813306] Call trace:
[ 255.816471] dump_backtrace+0x0/0x22c
[ 255.820849] show_stack+0x28/0x34
[ 255.824882] dump_stack+0x104/0x194
[ 255.829090] handle_null_ptr_deref+0xdc/0x10c
[ 255.834163] __ubsan_handle_type_mismatch_v1+0x64/0x78
[ 255.840665] xfs_mountfs+0x310/0xc64 [xfs]
[ 255.846071] xfs_fc_fill_super+0x5cc/0x75c [xfs]
[ 255.851411] get_tree_bdev+0x24c/0x328
[ 255.856463] xfs_fc_get_tree+0x24/0x30 [xfs]
[ 255.861453] vfs_get_tree+0x54/0x158
[ 255.865754] do_mount+0x80c/0xaf0
[ 255.869786] __arm64_sys_mount+0xe0/0x18c
[ 255.874510] do_el0_svc+0x128/0x1dc
[ 255.878720] el0_sync_handler+0xd0/0x268
[ 255.883357] el0_sync+0x164/0x180
On Thu, May 7, 2020 at 6:42 AM Qian Cai <[email protected]> wrote:
>
> Running a Clang (9.0.1) build kernel with UBSAN generated a few warnings during boot,
Very cool, these reports are so nice! They hand you everything on a
silver platter. Thanks for testing/sending! Let's take a look.
>
> [ 0.000000] UBSAN: null-ptr-deref in drivers/acpi/acpica/tbfadt.c:459:37
> [ 0.000000] member access within null pointer of type 'struct acpi_table_fadt'
> [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc4-next-20200507 #2
> [ 0.000000] Call trace:
> [ 0.000000] dump_backtrace+0x0/0x22c
> [ 0.000000] show_stack+0x28/0x34
> [ 0.000000] dump_stack+0x104/0x194
> [ 0.000000] handle_null_ptr_deref+0xdc/0x10c
> [ 0.000000] __ubsan_handle_type_mismatch_v1+0x64/0x78
> [ 0.000000] acpi_tb_create_local_fadt+0x104/0x6ec
ok so acpi_tb_create_local_fadt() dereferenced a `null pointer of type
'struct acpi_table_fadt'` in null-ptr-deref in
drivers/acpi/acpica/tbfadt.c:459.
That line number doesn't line up with linux-next; which tree was this?
That will probably help track these down faster.
> [ 0.000000] acpi_tb_parse_fadt+0xa0/0x1a0
> [ 0.000000] acpi_tb_parse_root_table+0x284/0x2ac
> [ 0.000000] acpi_initialize_tables+0xb4/0xd0
> [ 0.000000] acpi_table_init+0x68/0x88
> [ 0.000000] acpi_boot_table_init+0x108/0x1a0
> [ 0.000000] setup_arch+0xec/0x1f4
> [ 0.000000] start_kernel+0x94/0x56c
>
> [ 0.000000] UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6
> [ 0.000000] member access within null pointer of type 'struct acpi_madt_generic_interrupt'
> [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc4-next-20200507 #2
> [ 0.000000] Call trace:
> [ 0.000000] dump_backtrace+0x0/0x22c
> [ 0.000000] show_stack+0x28/0x34
> [ 0.000000] dump_stack+0x104/0x194
> [ 0.000000] handle_null_ptr_deref+0xdc/0x10c
> [ 0.000000] __ubsan_handle_type_mismatch_v1+0x64/0x78
> [ 0.000000] acpi_parse_gic_cpu_interface+0x40/0xa8
> [ 0.000000] acpi_parse_entries_array+0x1d4/0x2e8
> [ 0.000000] acpi_table_parse_entries_array+0x11c/0x138
> [ 0.000000] acpi_table_parse_madt+0x84/0xb0
> [ 0.000000] acpi_parse_and_init_cpus+0x24/0x80
> [ 0.000000] smp_init_cpus+0x38/0x17c
> [ 0.000000] setup_arch+0x140/0x1f4
> [ 0.000000] start_kernel+0x94/0x56c
>
> [ 255.388250] UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
> [ 255.394898] member access within null pointer of type 'struct xfs_kobj'
> [ 255.402346] CPU: 230 PID: 2364 Comm: modprobe Tainted: G L 5.7.0-rc4-next-20200507 #2
> [ 255.412191] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
> [ 255.422641] Call trace:
> [ 255.425811] dump_backtrace+0x0/0x22c
> [ 255.430188] show_stack+0x28/0x34
> [ 255.434225] dump_stack+0x104/0x194
> [ 255.438441] handle_null_ptr_deref+0xdc/0x10c
> [ 255.443511] __ubsan_handle_type_mismatch_v1+0x64/0x78
> [ 255.450016] init_module+0x130/0x1d4 [xfs]
> [ 255.454831] do_one_initcall+0x6c/0x144
> [ 255.459383] do_init_module+0x100/0x388
> [ 255.463931] load_module+0x2518/0x2b9c
> [ 255.468404] __se_sys_finit_module+0x144/0x150
> [ 255.473560] __arm64_sys_finit_module+0x54/0x88
> [ 255.478804] do_el0_svc+0x128/0x1dc
> [ 255.483010] el0_sync_handler+0xd0/0x268
> [ 255.487655] el0_sync+0x164/0x180
> [ 255.491782] ================================================================================
> [ 255.769799] ================================================================================
> [ 255.779164] UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
> [ 255.785816] member access within null pointer of type 'struct xfs_kobj'
> [ 255.793268] CPU: 132 PID: 2363 Comm: mount Tainted: G L 5.7.0-rc4-next-20200507 #2
> [ 255.802854] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
> [ 255.813306] Call trace:
> [ 255.816471] dump_backtrace+0x0/0x22c
> [ 255.820849] show_stack+0x28/0x34
> [ 255.824882] dump_stack+0x104/0x194
> [ 255.829090] handle_null_ptr_deref+0xdc/0x10c
> [ 255.834163] __ubsan_handle_type_mismatch_v1+0x64/0x78
> [ 255.840665] xfs_mountfs+0x310/0xc64 [xfs]
> [ 255.846071] xfs_fc_fill_super+0x5cc/0x75c [xfs]
> [ 255.851411] get_tree_bdev+0x24c/0x328
> [ 255.856463] xfs_fc_get_tree+0x24/0x30 [xfs]
> [ 255.861453] vfs_get_tree+0x54/0x158
> [ 255.865754] do_mount+0x80c/0xaf0
> [ 255.869786] __arm64_sys_mount+0xe0/0x18c
> [ 255.874510] do_el0_svc+0x128/0x1dc
> [ 255.878720] el0_sync_handler+0xd0/0x268
> [ 255.883357] el0_sync+0x164/0x180
--
Thanks,
~Nick Desaulniers
> On May 7, 2020, at 2:30 PM, Nick Desaulniers <[email protected]> wrote:
>
> On Thu, May 7, 2020 at 6:42 AM Qian Cai <[email protected]> wrote:
>>
>> Running a Clang (9.0.1) build kernel with UBSAN generated a few warnings during boot,
>
> Very cool, these reports are so nice! They hand you everything on a
> silver platter. Thanks for testing/sending! Let's take a look.
>
>>
>> [ 0.000000] UBSAN: null-ptr-deref in drivers/acpi/acpica/tbfadt.c:459:37
>> [ 0.000000] member access within null pointer of type 'struct acpi_table_fadt'
>> [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc4-next-20200507 #2
>> [ 0.000000] Call trace:
>> [ 0.000000] dump_backtrace+0x0/0x22c
>> [ 0.000000] show_stack+0x28/0x34
>> [ 0.000000] dump_stack+0x104/0x194
>> [ 0.000000] handle_null_ptr_deref+0xdc/0x10c
>> [ 0.000000] __ubsan_handle_type_mismatch_v1+0x64/0x78
>> [ 0.000000] acpi_tb_create_local_fadt+0x104/0x6ec
>
> ok so acpi_tb_create_local_fadt() dereferenced a `null pointer of type
> 'struct acpi_table_fadt'` in null-ptr-deref in
> drivers/acpi/acpica/tbfadt.c:459.
>
> That line number doesn't line up with linux-next; which tree was this?
> That will probably help track these down faster.
It is linux-next indeed as in the signature.
next-20200507
# ./scripts/faddr2line vmlinux acpi_tb_create_local_fadt+0x104/0x6ec
acpi_tb_create_local_fadt+0x104/0x6ec:
acpi_tb_convert_fadt at drivers/acpi/acpica/tbfadt.c:459
(inlined by) acpi_tb_create_local_fadt at drivers/acpi/acpica/tbfadt.c:388
This line,
if (acpi_gbl_FADT.header.length <= ACPI_FADT_V2_SIZE) {
acpi_gbl_FADT was defined in,
.//include/acpi/acpixf.h:266:ACPI_GLOBAL(struct acpi_table_fadt, acpi_gbl_FADT);
#ifdef DEFINE_ACPI_GLOBALS
#define ACPI_GLOBAL(type,name) \
extern type name; \
type name
#define ACPI_INIT_GLOBAL(type,name,value) \
type name=value
#else
#ifndef ACPI_GLOBAL
#define ACPI_GLOBAL(type,name) \
extern type name
#endif
#ifndef ACPI_INIT_GLOBAL
#define ACPI_INIT_GLOBAL(type,name,value) \
extern type name
#endif
#endif
I looks like DEFINE_ACPI_GLOBALS should be set in drivers/acpi/acpica/utglobal.c.