Greeting,
Previous report:
https://lore.kernel.org/oe-lkp/[email protected]
FYI, we noticed BUG:kernel_NULL_pointer_dereference,address due to commit (built with gcc-11):
commit: 480c454ff64b734a35677ee4b239e32143a4235c ("mm: return an ERR_PTR from __filemap_get_folio")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master 24469a0e5052ba01a35a15f104717a82b7a4798b]
in testcase: trinity
version: trinity-x86_64-e63e4843-1_20220913
with following parameters:
runtime: 300s
group: group-04
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
[ 29.300153][ T6430] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 29.301410][ T6430] #PF: supervisor read access in kernel mode
[ 29.302279][ T6430] #PF: error_code(0x0000) - not-present page
[ 29.303165][ T6430] PGD 8000000137e5f067 P4D 8000000137e5f067 PUD 0
[ 29.304141][ T6430] Oops: 0000 [#1] SMP PTI
[ 29.304832][ T6430] CPU: 1 PID: 6430 Comm: trinity-c5 Not tainted 6.3.0-rc1-00172-g480c454ff64b #1
[ 29.306360][ T6430] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
[ 29.307817][ T6430] RIP: 0010:mincore_page+0x14/0x4f
[ 29.308668][ T6430] Code: c1 e0 05 48 c1 e8 0e 48 09 f8 c3 f3 0f 1e fa 0f 1f 44 00 00 0f 0b 0f 1f 44 00 00 41 54 e8 59 18 02 00 48 3d 00 f0 ff ff 77 32 <4c> 8b 20 48 89 c7 49 c1 ec 02 41 80 e4 01 74 00 8b 47 34 85 c0 75
[ 29.311267][ T6430] RSP: 0018:ffffc900003afce8 EFLAGS: 00010207
[ 29.312056][ T6430] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 29.313097][ T6430] RDX: ffff88813890a000 RSI: 0000000000000000 RDI: ffffc900003afc70
[ 29.314193][ T6430] RBP: 0000000000000072 R08: 0000000000000000 R09: ffffc900003afc70
[ 29.315330][ T6430] R10: ffffc900003afc70 R11: ffff88813817720c R12: 0000000000000001
[ 29.316501][ T6430] R13: ffff8881387dc540 R14: ffff88813890a000 R15: ffff88813890a000
[ 29.317718][ T6430] FS: 00007fda824ef600(0000) GS:ffff88842fd00000(0000) knlGS:0000000000000000
[ 29.318998][ T6430] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 29.319954][ T6430] CR2: 0000000000000000 CR3: 00000001388ea000 CR4: 00000000000406e0
[ 29.321139][ T6430] Call Trace:
[ 29.321711][ T6430] <TASK>
[ 29.322256][ T6430] __mincore_unmapped_range+0x63/0x88
[ 29.323069][ T6430] mincore_unmapped_range+0x1a/0x24
[ 29.323807][ T6430] walk_pmd_range+0xb3/0x29b
[ 29.324548][ T6430] ? bad_range+0xa7/0xc0
[ 29.325186][ T6430] walk_pud_range+0x17e/0x191
[ 29.325926][ T6430] walk_p4d_range+0x137/0x14b
[ 29.326652][ T6430] walk_pgd_range+0x135/0x148
[ 29.327350][ T6430] __walk_page_range+0x22/0x57
[ 29.328075][ T6430] ? find_vma+0x3d/0x57
[ 29.328737][ T6430] walk_page_range+0x11e/0x15c
[ 29.329445][ T6430] do_mincore+0xd3/0xec
[ 29.330136][ T6430] __do_sys_mincore+0x14f/0x1e0
[ 29.330842][ T6430] do_syscall_64+0x71/0x84
[ 29.331507][ T6430] entry_SYSCALL_64_after_hwframe+0x5e/0xc8
[ 29.332385][ T6430] RIP: 0033:0x7fda824219b9
[ 29.333119][ T6430] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a7 54 0c 00 f7 d8 64 89 01 48
[ 29.335819][ T6430] RSP: 002b:00007ffdf0ec0798 EFLAGS: 00000246 ORIG_RAX: 000000000000001b
[ 29.337173][ T6430] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fda824219b9
[ 29.338401][ T6430] RDX: 00007fda80308010 RSI: 00000000000fa000 RDI: 00007fda80b8e000
[ 29.339653][ T6430] RBP: 00007fda80d9c000 R08: 0000004201ac2375 R09: 0000000070707070
[ 29.353610][ T6430] R10: 0000000000008000 R11: 0000000000000246 R12: 000000000000001b
[ 29.354842][ T6430] R13: 00007fda824ef580 R14: 00007fda80d9c058 R15: 00007fda80d9c000
[ 29.356037][ T6430] </TASK>
[ 29.356558][ T6430] Modules linked in: can_bcm can_raw can cn scsi_transport_iscsi ipmi_msghandler sr_mod cdrom sg ata_generic fuse
[ 29.358253][ T6430] CR2: 0000000000000000
[ 29.358992][ T6430] ---[ end trace 0000000000000000 ]---
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-lkp/[email protected]
To reproduce:
# build kernel
cd linux
cp config-6.3.0-rc1-00172-g480c454ff64b .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
On Tue, 14 Mar 2023 10:10:42 +0800 kernel test robot <[email protected]> wrote:
> Greeting,
>
> Previous report:
> https://lore.kernel.org/oe-lkp/[email protected]
>
> FYI, we noticed BUG:kernel_NULL_pointer_dereference,address due to commit (built with gcc-11):
>
> commit: 480c454ff64b734a35677ee4b239e32143a4235c ("mm: return an ERR_PTR from __filemap_get_folio")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
>
> [test failed on linux-next/master 24469a0e5052ba01a35a15f104717a82b7a4798b]
>
> in testcase: trinity
> version: trinity-x86_64-e63e4843-1_20220913
> with following parameters:
>
> runtime: 300s
> group: group-04
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
>
> on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>
> caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
>
>
> [ 29.300153][ T6430] BUG: kernel NULL pointer dereference, address: 0000000000000000
Thanks, I expect this is fixed by
commit 151dff099e8e6d9c8efcc75ad0ad3b8eead58704
Author: Christoph Hellwig <[email protected]>
Date: Fri Mar 10 08:00:23 2023 +0100
mm-return-an-err_ptr-from-__filemap_get_folio-fix
fix null-pointer deref
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Christoph Hellwig <[email protected]>
Reported-by: Naoya Horiguchi <[email protected]>
Link: https://lkml.kernel.org/r/20230310043137.GA1624890@u2004
Cc: Andreas Gruenbacher <[email protected]>
Cc: Hugh Dickins <[email protected]>
Cc: Matthew Wilcox (Oracle) <[email protected]>
Cc: Ryusuke Konishi <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
diff --git a/mm/swap_state.c b/mm/swap_state.c
index c7160070b9da..b76a65ac28b3 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -390,6 +390,8 @@ struct folio *filemap_get_incore_folio(struct address_space *mapping,
struct swap_info_struct *si;
struct folio *folio = filemap_get_entry(mapping, index);
+ if (!folio)
+ return ERR_PTR(-ENOENT);
if (!xa_is_value(folio))
return folio;
if (!shmem_mapping(mapping))
On Mon, Mar 13, 2023 at 07:19:31PM -0700, Andrew Morton wrote:
> Thanks, I expect this is fixed by
Yes, that should take care of it.