Received-SPF: pass (google.com: domain of linux-kernel+bounces-27127-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Tue, 16 Jan 2024 16:29:35 +0800
From: kernel test robot <oliver.sang@intel.com>
To: Gui-Dong Han <2045gemini@gmail.com>
CC: <oe-lkp@lists.linux.dev>, <lkp@intel.com>, <linux-kernel@vger.kernel.org>,
	<linux-serial@vger.kernel.org>, <gregkh@linuxfoundation.org>,
	<jirislaby@kernel.org>, <baijiaju1990@outlook.com>, Gui-Dong Han
	<2045gemini@gmail.com>, <stable@vger.kernel.org>, <oliver.sang@intel.com>
Subject: Re: [PATCH] tty: fix atomicity violation in n_tty_read
Message-ID: <202401161610.edf0ac63-oliver.sang@intel.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20240112125801.2650-1-2045gemini@gmail.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?oDFjQnDCNIZ6osIgkJmI7U91OMqzwdHMKvQW9vmn0AJxZL+XuBj+L334vyCI?=
 =?us-ascii?Q?4w23817fyuvr8uxCgxgIDSUjyhptsJ/4xBeG1L1h8JcZcdrilCWD3YZTqDQX?=
 =?us-ascii?Q?2zTmPf4nPrwFhUCmN7DPuHG/x9KvftvYRGLfxs+6ZGcuH6DLLd81bY6dbIvP?=
 =?us-ascii?Q?JR8LQOAH9/WhNs4fC4npSV+lbU5Iq/uhhoN6pug20bDvwm52X6fxCYwKnhiw?=
 =?us-ascii?Q?6g5SfguDU+fldcgrEJMBOxMIvv1cilPASkVqEWgDcS3+XmPFs718SGRRxEe7?=
 =?us-ascii?Q?zOroVZhAsgV/9I0qVwzsKj0igD3UMbQSxWG3Slq0jyxC2ykAUb7SWdAjRA5g?=
 =?us-ascii?Q?PADU8cQ53Edgv94zMZWbMEM8WUrXdT5E61vk9Ix82IcmBj7FT4g39uX2u01R?=
 =?us-ascii?Q?DkB1yVLJbOzAFMnEfkkH7CdSGs7+KmvfC8ygHHfZh3HawxaUmHPrcIwLpT4X?=
 =?us-ascii?Q?85LNr/NQa9+ZM4E6O9bZHAmAyT0NnwVBrhB5zM5S2d4SlParwEK3q7qa8mkt?=
 =?us-ascii?Q?A6YML5W3023PO2zn7IH2Si0qTlggIhRZ4Ohh4+bx2N1WJTrE1tZs8MwR0ADM?=
 =?us-ascii?Q?rHxweeswBbttaoiSDYZLnS57rHZFHkL6CnOKV+alNg7H8BZGwYsblj6NIRjz?=
 =?us-ascii?Q?ZSVp+79/luwZTy52ilqBeLs8QznCsDSdDQtWt52u8cHfQEMa+FEh7+zGfngK?=
 =?us-ascii?Q?rwAFhxmCRblG/Nb5Ukto09AdmdXh7CXZzQwwF0ZEke1pZQWA6UBXIIjVyrPp?=
 =?us-ascii?Q?LjDlMwy1PlUJezcPJ2lgq7o3f5PvUgaNUwViUfDXm40eaTHhAWchUVPB4DaR?=
 =?us-ascii?Q?L9UN2HfFBshcCnVaydtZ7A2RosKaUlDnvP+eiXvNZeSFhMi5j1YuX6RsReDQ?=
 =?us-ascii?Q?4MSd11GqrHbC63noyvahZBAbxsDniGnI09I/zIOTn4BoWu0xhfvceotDjcsf?=
 =?us-ascii?Q?Aq0tLy74MA2+/GoBEdHFoGvth9DHrPCew/KZwyobyGa5SiaUlQ0LZjYwpyYp?=
 =?us-ascii?Q?ytNBSJUBYkKiNk6hkXUBhsHl1KEAmaGPctkAqkssHpIVrDngNdpPC34vHdcQ?=
 =?us-ascii?Q?2BeQ85G+d9gNl/nXNHhJsfsaLYPgPSGHxAdze0q6aaasbAC3S9g0dyGcIJXT?=
 =?us-ascii?Q?9JLhZ5oQQHTf5AixccIhdV/8iLO2Dd5GtUglkJjFQeHFb4m5l3p2EVTsa/cL?=
 =?us-ascii?Q?F5DwcP2zqI+IFtHnCXFoR4lhQ/Ji0J+IP8v4BoOmGiXg1PoCQ33qMaHaOpJU?=
 =?us-ascii?Q?pbU+SmXYbwNEDyoUWMJi6wVTWZ5xS1AaTuafCv05dH5bN4VwuPDMcClGSpVO?=
 =?us-ascii?Q?PKywyBd9f5OvBES1dCa4zOuYevz7HJBfg1Eu3fJrWdaOGvF1xB3dLf+F8nQd?=
 =?us-ascii?Q?7lN7xUYVaNhnzwibemfHhEBr7tEhS81rBrO/3zcxCV2R/Y43q1tnDrm9w5lu?=
 =?us-ascii?Q?L454gOG7GUuku23vUMlzjOdQH0+nAMgbZ0rLkoSpm7aO5p0xmamYjFw3RCg8?=
 =?us-ascii?Q?BOmVdNNllfrF1ng99fDdsHrnnpNZSdWUzx3kzeExubAyHtD7QU27TYXL/WwB?=
 =?us-ascii?Q?tTJoLgpzWRHELs+IjTnbZds5jB1kbykdZc29x+LR18drCPqBW0lTMtEhMiAU?=
 =?us-ascii?Q?ow=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 2309fb7d-9db4-4b70-6c68-08dc166d4ab3
X-MS-Exchange-CrossTenant-AuthSource: LV3PR11MB8603.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Jan 2024 08:29:44.3771
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: wpr9VPdOhUlOKsWri4WRGN+oTmMMMmBcsxV1XOwgFtn92W/1S5k1sPvOFDR9jGfG0wxfV/H9WKOd8MuAznj+Iw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR11MB5689
X-OriginatorOrg: intel.com


Hello,

kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:

commit: 5c6ca526d56e87f85cf980c77f7470e76e5dd5f7 ("[PATCH] tty: fix atomicity violation in n_tty_read")
url: https://github.com/intel-lab-lkp/linux/commits/Gui-Dong-Han/tty-fix-atomicity-violation-in-n_tty_read/20240112-205942
base: https://git.kernel.org/cgit/linux/kernel/git/gregkh/tty.git tty-testing
patch link: https://lore.kernel.org/all/20240112125801.2650-1-2045gemini@gmail.com/
patch subject: [PATCH] tty: fix atomicity violation in n_tty_read

in testcase: boot

compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+---------------------------------------------+------------+------------+
|                                             | 0c84bea0ca | 5c6ca526d5 |
+---------------------------------------------+------------+------------+
| boot_failures                               | 0          | 6          |
| BUG:kernel_NULL_pointer_dereference,address | 0          | 6          |
| Oops:#[##]                                  | 0          | 6          |
| RIP:_raw_spin_lock_irq                      | 0          | 6          |
| Kernel_panic-not_syncing:Fatal_exception    | 0          | 6          |
+---------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202401161610.edf0ac63-oliver.sang@intel.com


[   53.979086][  T401] BUG: kernel NULL pointer dereference, address: 00000000000001d0
[   53.989877][  T401] #PF: supervisor write access in kernel mode
[   53.998103][  T401] #PF: error_code(0x0002) - not-present page
[   54.006595][  T401] PGD 800000011f423067 P4D 800000011f423067 PUD 303527067 PMD 0
[   54.017130][  T401] Oops: 0002 [#1] SMP PTI
[   54.022798][  T401] CPU: 1 PID: 401 Comm: getty Not tainted 6.7.0-rc5-00199-g5c6ca526d56e #1
[   54.032166][  T401] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 54.046197][ T401] RIP: 0010:_raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170) 
[ 54.054135][ T401] Code: cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 c3 cc cc cc cc 89 c6 e8 1d 01 00 00 90 c3 cc cc
All code
========
   0:	cc                   	int3   
   1:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
   8:	00 
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	f3 0f 1e fa          	endbr64 
  1d:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  22:	fa                   	cli    
  23:	31 c0                	xor    %eax,%eax
  25:	ba 01 00 00 00       	mov    $0x1,%edx
  2a:*	f0 0f b1 17          	lock cmpxchg %edx,(%rdi)		<-- trapping instruction
  2e:	75 05                	jne    0x35
  30:	c3                   	retq   
  31:	cc                   	int3   
  32:	cc                   	int3   
  33:	cc                   	int3   
  34:	cc                   	int3   
  35:	89 c6                	mov    %eax,%esi
  37:	e8 1d 01 00 00       	callq  0x159
  3c:	90                   	nop
  3d:	c3                   	retq   
  3e:	cc                   	int3   
  3f:	cc                   	int3   

Code starting with the faulting instruction
===========================================
   0:	f0 0f b1 17          	lock cmpxchg %edx,(%rdi)
   4:	75 05                	jne    0xb
   6:	c3                   	retq   
   7:	cc                   	int3   
   8:	cc                   	int3   
   9:	cc                   	int3   
   a:	cc                   	int3   
   b:	89 c6                	mov    %eax,%esi
   d:	e8 1d 01 00 00       	callq  0x12f
  12:	90                   	nop
  13:	c3                   	retq   
  14:	cc                   	int3   
  15:	cc                   	int3   
[   54.079836][  T401] RSP: 0018:ffffab01406cbcd8 EFLAGS: 00010046
[   54.088222][  T401] RAX: 0000000000000000 RBX: ffffab01406cbdc8 RCX: 0000000000000000
[   54.098106][  T401] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 00000000000001d0
[   54.109098][  T401] RBP: ffffab01406e9000 R08: ffff9dfa447a2210 R09: ffff9dfa447a2210
[   54.119762][  T401] R10: ffff9dfa447a2210 R11: 0000000000000000 R12: 0000000000000000
[   54.130902][  T401] R13: 7fffffffffffffff R14: ffff9dfa447a2000 R15: 0000000000000000
[   54.141603][  T401] FS:  0000000000000000(0000) GS:ffff9dfd2fd00000(0063) knlGS:00000000f7e1f900
[   54.153625][  T401] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   54.162764][  T401] CR2: 00000000000001d0 CR3: 0000000144742000 CR4: 00000000000006f0
[   54.171900][  T401] Call Trace:
[   54.182172][  T401]  <TASK>
[ 54.186095][ T401] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) 
[ 54.191409][ T401] ? page_fault_oops (arch/x86/mm/fault.c:707) 
[ 54.197798][ T401] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:72 arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561) 
[ 54.204312][ T401] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570) 
[ 54.211244][ T401] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:115 include/linux/atomic/atomic-arch-fallback.h:2164 include/linux/atomic/atomic-instrumented.h:1296 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170) 
[ 54.211300][ T401] n_tty_read (drivers/tty/n_tty.c:2226) 
[ 54.216906][ T401] ? __pfx_woken_wake_function (kernel/sched/wait.c:439) 
[ 54.233693][ T401] tty_read (drivers/tty/tty_io.c:862 drivers/tty/tty_io.c:937) 
[ 54.239403][ T401] vfs_read (include/linux/fs.h:2014 fs/read_write.c:389 fs/read_write.c:470) 
[ 54.244978][ T401] ksys_read (fs/read_write.c:613) 
[ 54.249805][ T401] __do_fast_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:321) 
[ 54.255574][ T401] do_fast_syscall_32 (arch/x86/entry/common.c:346) 
[ 54.255607][ T401] entry_SYSENTER_compat_after_hwframe (arch/x86/entry/entry_64_compat.S:121) 
[   54.255641][  T401] RIP: 0023:0xf7fce589
[ 54.255671][ T401] Code: 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
All code
========
   0:	03 74 d8 01          	add    0x1(%rax,%rbx,8),%esi
	...
  20:	00 51 52             	add    %dl,0x52(%rcx)
  23:	55                   	push   %rbp
  24:*	89 e5                	mov    %esp,%ebp		<-- trapping instruction
  26:	0f 34                	sysenter 
  28:	cd 80                	int    $0x80
  2a:	5d                   	pop    %rbp
  2b:	5a                   	pop    %rdx
  2c:	59                   	pop    %rcx
  2d:	c3                   	retq   
  2e:	90                   	nop
  2f:	90                   	nop
  30:	90                   	nop
  31:	90                   	nop
  32:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
  39:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi

Code starting with the faulting instruction
===========================================
   0:	5d                   	pop    %rbp
   1:	5a                   	pop    %rdx
   2:	59                   	pop    %rcx
   3:	c3                   	retq   
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
   f:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240116/202401161610.edf0ac63-oliver.sang@intel.com


-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki