Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Vince Weaver <vincent.weaver@maine.edu>
Date:   Thu, 8 Nov 2018 10:46:53 -0500 (EST)
To:     linux-kernel@vger.kernel.org
cc:     Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Jiri Olsa <jolsa@redhat.com>,
        Namhyung Kim <namhyung@kernel.org>
Subject: perf: perf_fuzzer triggers NULL pointer dereference
Message-ID: <alpine.DEB.2.21.1811081041070.7406@macbook-air>
User-Agent: Alpine 2.21 (DEB 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


I was able to trigger this oops with the perf_fuzzer with current git.

I can reliably trigger this on my Haswell machine.

I haven't done any analysis yet, I might not have time to today, but I 
wanted to report it in case the cause was obvious to someone else.

Vince


*** perf_fuzzer 0.32-rc0 *** by Vince Weaver

	Linux version 4.20.0-rc1+ x86_64
	Processor: Intel 6/60/3

	Stopping after 30000
	Watchdog enabled with timeout 60s
	Will auto-exit if signal storm detected
	Seeding RNG from time 1541627285

	To reproduce, try:
		echo 1 > /proc/sys/kernel/nmi_watchdog
		echo 0 > /proc/sys/kernel/perf_event_paranoid
		echo 1250 > /proc/sys/kernel/perf_event_max_sample_rate
		./perf_fuzzer -s 30000 -r 1541627285

	Fuzzing the following syscalls: mmap perf_event_open close read write ioctl fork prctl poll 
	Also attempting the following: signal-handler-on-overflow busy-instruction-loop accessing-perf-proc-and-sys-files trashing-the-mmap-page 

	Pid=14868, sleeping 1s

==================================================
Starting fuzzing at 2018-11-07 16:48:06
==================================================
Cannot open /sys/kernel/tracing/kprobe_events
Iteration 10000, 125098 syscalls in 4.90 s (25.525 k syscalls/s)
	Open attempts: 117090  Successful: 951  Currently open: 47
		EPERM : 11
		ENOENT : 598
		E2BIG : 10074
		EBADF : 7879
		EACCES : 4691
		UNKNOWN 19 : 1
		EINVAL : 92824
		EOPNOTSUPP : 61
		Trinity Type (Normal 163/29305)(Sampling 17/29139)(Global 719/29405)(Random 52/29241)
		Type (Hardware 224/16272)(software 346/15851)(tracepoint 63/15585)(Cache 58/14732)(cpu 230/15625)(breakpoint 9/15556)(kprobe 0/948)(msr 7/940)(power 0/1021)(uncore_imc 0/924)(uncore_cbox_0 3/911)(uncore_cbox_1 3/957)(uncore_cbox_2 2/914)(uncore_cbox_3 2/860)(uncore_arb 3/873)(cstate_core 1/902)(cstate_pkg 0/1016)(i915 0/942)(#18 0/16)(>19 0/12245)
	Close:	904/904 Successful
	Read:	795/881 Successful
	Write:	0/934 Successful
	Ioctl:	328/952 Successful: (ENABLE 84/84)(DISABLE 76/76)(REFRESH 4/74)(RESET 68/68)(PERIOD 9/69)(SET_OUTPUT 14/66)(SET_FILTER 0/78)(ID 69/69)(SET_BPF 0/70)(PAUSE_OUTPUT 4/60)(QUERY_BPF 0/67)(MOD_ATTR 0/55)(#12 0/0)(#13 0/0)(#14 0/0)(>14 0/116)
	Mmap:	442/1113 Successful: (MMAP 442/1113)(TRASH 111/160)(READ 98/100)(UNMAP 438/1010)(AUX 0/119)(AUX_READ 0/0)
	Prctl:	952/952 Successful
	Fork:	421/421 Successful
	Poll:	889/905 Successful
	Access:	113/876 Successful
	Overflows: 0  Recursive: 0
	SIGIOs due to RT signal queue full: 0
[91760.326510] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[91760.334876] PGD 0 P4D 0 
[91760.337596] Oops: 0000 [#1] SMP PTI
[91760.341332] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G        W         4.20.0-rc1+ #119
[91760.349816] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
[91760.357723] RIP: 0010:perf_prepare_sample+0x82/0x4a0
[91760.363065] Code: 06 4c 89 ea 4c 89 e6 e8 3c 54 ff ff 40 f6 c5 01 0f 85 28 01 00 00 40 f6 c5 20 74 1c 48 85 ed 0f 89 04 01 00 00 49 8b 44 24 70 <48> 8b 00 8d 04 c5 08 00 00 00 66 01 43 06 f7 c5 00 04 00 00 74 41
[91760.383164] RSP: 0000:ffff88011ab83b80 EFLAGS: 00010086
[91760.388753] RAX: 0000000000000000 RBX: ffff88011ab83bd8 RCX: 000000000000001f
[91760.396373] RDX: 0000000000000000 RSI: 0000000025bbfcb9 RDI: 0000000000000000
[91760.404062] RBP: 80000000000b8165 R08: 0000000000000002 R09: 00000000000215c0
[91760.411678] R10: 00011b422ed4649b R11: 0000000000000000 R12: ffff88011ab83cc0
[91760.419287] R13: ffff8800a8c8c800 R14: ffff88011ab83c18 R15: ffffe8ffffd86300
[91760.426933] FS:  0000000000000000(0000) GS:ffff88011ab80000(0000) knlGS:0000000000000000
[91760.435616] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[91760.441735] CR2: 0000000000000000 CR3: 000000000200c002 CR4: 00000000001606e0
[91760.449369] DR0: 000000a4a7ffb768 DR1: 0000000000000000 DR2: 0000000000000000
[91760.457005] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[91760.464641] Call Trace:
[91760.467265]  <IRQ>
[91760.469427]  intel_pmu_drain_bts_buffer+0x151/0x220
[91760.474650]  ? intel_get_event_constraints+0x219/0x360
[91760.480145]  ? perf_assign_events+0xe2/0x2a0
[91760.484732]  ? select_idle_sibling+0x22/0x3a0
[91760.489403]  ? __update_load_avg_se+0x1ec/0x270
[91760.494244]  ? enqueue_task_fair+0x377/0xdd0
[91760.498832]  ? cpumask_next_and+0x19/0x20
[91760.503105]  ? load_balance+0x134/0x950
[91760.507239]  ? check_preempt_curr+0x7a/0x90
[91760.511683]  ? ttwu_do_wakeup+0x19/0x140
[91760.515877]  x86_pmu_stop+0x3b/0x90
[91760.519606]  x86_pmu_del+0x57/0x160
[91760.523343]  event_sched_out.isra.106+0x81/0x170
[91760.528288]  group_sched_out.part.108+0x51/0xc0
[91760.533151]  __perf_event_disable+0x7f/0x160
[91760.537736]  event_function+0x8c/0xd0
[91760.541671]  remote_function+0x3c/0x50
[91760.545666]  flush_smp_call_function_queue+0x35/0xe0
[91760.550979]  smp_call_function_single_interrupt+0x3a/0xd0
[91760.556802]  call_function_single_interrupt+0xf/0x20
[91760.562107]  </IRQ>
[91760.564369] RIP: 0010:cpuidle_enter_state+0xb9/0x330
[91760.569671] Code: e8 ac a4 a7 ff 80 7c 24 0b 00 74 17 9c 58 0f 1f 44 00 00 f6 c4 02 0f 85 4c 02 00 00 31 ff e8 6e 30 ad ff fb 66 0f 1f 44 00 00 <85> ed 0f 88 1a 02 00 00 48 b8 ff ff ff ff f3 01 00 00 48 2b 1c 24
[91760.589707] RSP: 0000:ffffc900006ebea0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff04
[91760.597785] RAX: ffff88011aba1dc0 RBX: 000053749daa0731 RCX: 000000000000001f
[91760.605431] RDX: 000053749daa0731 RSI: 0000000025bbfcb9 RDI: 0000000000000000
[91760.613057] RBP: 0000000000000005 R08: 0000000000000002 R09: 00000000000215c0
[91760.620691] R10: 00011b422ed2ea3e R11: ffff88011aba0d84 R12: ffffffff820caa58
[91760.628311] R13: ffffe8ffffd93370 R14: 0000000000000005 R15: 0000000000000000
[91760.635981]  do_idle+0x208/0x240
[91760.639429]  cpu_startup_entry+0x19/0x20
[91760.643591]  start_secondary+0x195/0x1d0
[91760.647786]  secondary_startup_64+0xa4/0xb0
[91760.652249] Modules linked in: intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_realtek kvm snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core irqbypass i915 snd_hwdep crct10dif_pclmul iosf_mbi drm_kms_helper tpm_tis tpm_tis_core drm snd_pcm crc32_pclmul mei_me ghash_clmulni_intel i2c_algo_bit tpm snd_timer aesni_intel rng_core evdev video mei snd wmi_bmof sg aes_x86_64 pcspkr iTCO_wdt iTCO_vendor_support soundcore wmi pcc_cpufreq crypto_simd button cryptd glue_helper binfmt_misc ip_tables x_tables autofs4 sr_mod sd_mod cdrom ahci libahci xhci_pci ehci_pci libata xhci_hcd ehci_hcd scsi_mod usbcore lpc_ich e1000e crc32c_intel i2c_i801 mfd_core usb_common fan thermal
[91760.721157] CR2: 0000000000000000
[91760.724710] ---[ end trace d94a9891f848ef0a ]---
[91760.729652] RIP: 0010:perf_prepare_sample+0x82/0x4a0
[91760.734963] Code: 06 4c 89 ea 4c 89 e6 e8 3c 54 ff ff 40 f6 c5 01 0f 85 28 01 00 00 40 f6 c5 20 74 1c 48 85 ed 0f 89 04 01 00 00 49 8b 44 24 70 <48> 8b 00 8d 04 c5 08 00 00 00 66 01 43 06 f7 c5 00 04 00 00 74 41
[91760.755044] RSP: 0000:ffff88011ab83b80 EFLAGS: 00010086
[91760.760641] RAX: 0000000000000000 RBX: ffff88011ab83bd8 RCX: 000000000000001f
[91760.768294] RDX: 0000000000000000 RSI: 0000000025bbfcb9 RDI: 0000000000000000
[91760.775906] RBP: 80000000000b8165 R08: 0000000000000002 R09: 00000000000215c0
[91760.783514] R10: 00011b422ed4649b R11: 0000000000000000 R12: ffff88011ab83cc0
[91760.791134] R13: ffff8800a8c8c800 R14: ffff88011ab83c18 R15: ffffe8ffffd86300
[91760.798742] FS:  0000000000000000(0000) GS:ffff88011ab80000(0000) knlGS:0000000000000000
[91760.807383] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[91760.813560] CR2: 0000000000000000 CR3: 000000000200c002 CR4: 00000000001606e0
[91760.821197] DR0: 000000a4a7ffb768 DR1: 0000000000000000 DR2: 0000000000000000
[91760.828806] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[91760.836434] Kernel panic - not syncing: Fatal exception in interrupt
[91760.843232] Kernel Offset: disabled
[91760.846971] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
[91760.855081] ------------[ cut here ]------------
[91760.860023] sched: Unexpected reschedule of offline CPU#5!
[91760.865928] WARNING: CPU: 6 PID: 0 at arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x34/0x40
[91760.875711] Modules linked in: intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel snd_hda_codec_realtek kvm snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core irqbypass i915 snd_hwdep crct10dif_pclmul iosf_mbi drm_kms_helper tpm_tis tpm_tis_core drm snd_pcm crc32_pclmul mei_me ghash_clmulni_intel i2c_algo_bit tpm snd_timer aesni_intel rng_core evdev video mei snd wmi_bmof sg aes_x86_64 pcspkr iTCO_wdt iTCO_vendor_support soundcore wmi pcc_cpufreq crypto_simd button cryptd glue_helper binfmt_misc ip_tables x_tables autofs4 sr_mod sd_mod cdrom ahci libahci xhci_pci ehci_pci libata xhci_hcd ehci_hcd scsi_mod usbcore lpc_ich e1000e crc32c_intel i2c_i801 mfd_core usb_common fan thermal
[91760.944533] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G      D W         4.20.0-rc1+ #119
[91760.953006] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
[91760.960923] RIP: 0010:native_smp_send_reschedule+0x34/0x40
[91760.966790] Code: 05 41 b1 0d 01 73 15 48 8b 05 f8 2e e8 00 be fd 00 00 00 48 8b 40 30 e9 0a 95 9a 00 89 fe 48 c7 c7 a0 10 e4 81 e8 a6 94 02 00 <0f> 0b c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 c5 df 5d
[91760.986832] RSP: 0000:ffff88011ab835e0 EFLAGS: 00010082
[91760.992431] RAX: 0000000000000000 RBX: ffff88011ab61dc0 RCX: 0000000000000006
[91761.000060] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff88011ab965f0
[91761.007706] RBP: ffff8801153ae140 R08: 0000000000000005 R09: 000000000000000f
[91761.015340] R10: 0000000000000000 R11: ffffffff8263d76d R12: ffff8801153ae7f8
[91761.022932] R13: ffff88011ab83630 R14: 0000000000000046 R15: 0000000000021dc0
[91761.030592] FS:  0000000000000000(0000) GS:ffff88011ab80000(0000) knlGS:0000000000000000
[91761.039243] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[91761.045385] CR2: 0000000000000000 CR3: 000000000200c002 CR4: 00000000001606e0
[91761.053014] DR0: 000000a4a7ffb768 DR1: 0000000000000000 DR2: 0000000000000000
[91761.060623] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[91761.068230] Call Trace:
[91761.070851]  <IRQ>
[91761.073008]  check_preempt_curr+0x7a/0x90
[91761.077317]  ttwu_do_wakeup+0x19/0x140
[91761.081320]  try_to_wake_up+0x1d2/0x470
[91761.085394]  ? enqueue_task_fair+0x377/0xdd0
[91761.089958]  __wake_up_common+0x70/0x130
[91761.094147]  ep_poll_callback+0xcb/0x2b0
[91761.098347]  __wake_up_common+0x70/0x130
[91761.102561]  __wake_up_common_lock+0x7c/0xc0
[91761.107146]  ? tick_sched_do_timer+0x60/0x60
[91761.111695]  irq_work_run_list+0x4d/0x70
[91761.115900]  update_process_times+0x4a/0x60
[91761.120388]  tick_sched_handle+0x22/0x60
[91761.124577]  tick_sched_timer+0x37/0x70
[91761.128693]  __hrtimer_run_queues+0x10c/0x280
[91761.133327]  hrtimer_interrupt+0x100/0x220
[91761.137705]  smp_apic_timer_interrupt+0x6a/0x140
[91761.142644]  apic_timer_interrupt+0xf/0x20
[91761.147022] RIP: 0010:panic+0x21b/0x261
[91761.151111] Code: eb a6 83 3d 9d 3a 5b 01 00 74 05 e8 fe 57 02 00 48 c7 c6 c0 4f 63 82 48 c7 c7 88 8c e4 81 e8 c9 fe 05 00 fb 66 0f 1f 44 00 00 <31> db e8 8d e4 0b 00 4c 39 eb 7c 1d 41 83 f4 01 48 8b 05 5d 3a 5b
[91761.171166] RSP: 0000:ffff88011ab839e0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
[91761.179277] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000006
[91761.186897] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff88011ab965f0
[91761.194514] RBP: ffff88011ab83a50 R08: 0000000000000005 R09: 000000000000000f
[91761.202142] R10: 0000000000000000 R11: ffffffff8263d76d R12: 0000000000000000
[91761.209759] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000001
[91761.217385]  ? apic_timer_interrupt+0xa/0x20
[91761.221937]  oops_end.cold.10+0xc/0x18
[91761.225940]  no_context+0x1bb/0x380
[91761.229666]  page_fault+0x1e/0x30
[91761.233219] RIP: 0010:perf_prepare_sample+0x82/0x4a0
[91761.238515] Code: 06 4c 89 ea 4c 89 e6 e8 3c 54 ff ff 40 f6 c5 01 0f 85 28 01 00 00 40 f6 c5 20 74 1c 48 85 ed 0f 89 04 01 00 00 49 8b 44 24 70 <48> 8b 00 8d 04 c5 08 00 00 00 66 01 43 06 f7 c5 00 04 00 00 74 41
[91761.258559] RSP: 0000:ffff88011ab83b80 EFLAGS: 00010086
[91761.264134] RAX: 0000000000000000 RBX: ffff88011ab83bd8 RCX: 000000000000001f
[91761.271745] RDX: 0000000000000000 RSI: 0000000025bbfcb9 RDI: 0000000000000000
[91761.279370] RBP: 80000000000b8165 R08: 0000000000000002 R09: 00000000000215c0
[91761.286987] R10: 00011b422ed4649b R11: 0000000000000000 R12: ffff88011ab83cc0
[91761.294625] R13: ffff8800a8c8c800 R14: ffff88011ab83c18 R15: ffffe8ffffd86300
[91761.302277]  intel_pmu_drain_bts_buffer+0x151/0x220
[91761.307513]  ? intel_get_event_constraints+0x219/0x360
[91761.313016]  ? perf_assign_events+0xe2/0x2a0
[91761.317598]  ? select_idle_sibling+0x22/0x3a0
[91761.322245]  ? __update_load_avg_se+0x1ec/0x270
[91761.327074]  ? enqueue_task_fair+0x377/0xdd0
[91761.331641]  ? cpumask_next_and+0x19/0x20
[91761.335910]  ? load_balance+0x134/0x950
[91761.340013]  ? check_preempt_curr+0x7a/0x90
[91761.344484]  ? ttwu_do_wakeup+0x19/0x140
[91761.348686]  x86_pmu_stop+0x3b/0x90
[91761.352448]  x86_pmu_del+0x57/0x160
[91761.356208]  event_sched_out.isra.106+0x81/0x170
[91761.361183]  group_sched_out.part.108+0x51/0xc0
[91761.366020]  __perf_event_disable+0x7f/0x160
[91761.370615]  event_function+0x8c/0xd0
[91761.374540]  remote_function+0x3c/0x50
[91761.378553]  flush_smp_call_function_queue+0x35/0xe0
[91761.383855]  smp_call_function_single_interrupt+0x3a/0xd0
[91761.389627]  call_function_single_interrupt+0xf/0x20
[91761.394932]  </IRQ>
[91761.397176] RIP: 0010:cpuidle_enter_state+0xb9/0x330
[91761.402471] Code: e8 ac a4 a7 ff 80 7c 24 0b 00 74 17 9c 58 0f 1f 44 00 00 f6 c4 02 0f 85 4c 02 00 00 31 ff e8 6e 30 ad ff fb 66 0f 1f 44 00 00 <85> ed 0f 88 1a 02 00 00 48 b8 ff ff ff ff f3 01 00 00 48 2b 1c 24
[91761.422518] RSP: 0000:ffffc900006ebea0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff04
[91761.430619] RAX: ffff88011aba1dc0 RBX: 000053749daa0731 RCX: 000000000000001f
[91761.438211] RDX: 000053749daa0731 RSI: 0000000025bbfcb9 RDI: 0000000000000000
[91761.445865] RBP: 0000000000000005 R08: 0000000000000002 R09: 00000000000215c0
[91761.453492] R10: 00011b422ed2ea3e R11: ffff88011aba0d84 R12: ffffffff820caa58
[91761.461094] R13: ffffe8ffffd93370 R14: 0000000000000005 R15: 0000000000000000
[91761.468736]  do_idle+0x208/0x240
[91761.472189]  cpu_startup_entry+0x19/0x20
[91761.476392]  start_secondary+0x195/0x1d0
[91761.480576]  secondary_startup_64+0xa4/0xb0
[91761.485050] ---[ end trace d94a9891f848ef0b ]---