* BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests @ 2021-04-11 3:08 Hao Sun 2021-04-11 8:10 ` Pavel Begunkov 0 siblings, 1 reply; 4+ messages in thread From: Hao Sun @ 2021-04-11 3:08 UTC (permalink / raw) To: axboe, io-uring; +Cc: asml.silence, linux-kernel [-- Attachment #1: Type: text/plain, Size: 5992 bytes --] Hi When using Healer(https://github.com/SunHao-0/healer/tree/dev) to fuzz the Linux kernel, I found a null-ptr-deref bug in io_uring_cancel_task_requests under fault injection condition, but I'm not sure about this. Sorry, I do not have a reproducing program for this bug. I hope that the stack trace information in the crash log can help you locate the problem. Here is the details: commit: 3b9cdafb5358eb9f3790de2f728f765fef100731 version: linux 5.11 git tree: upstream Full log can be found in the attachment. Fault injection log: FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x137/0x194 lib/dump_stack.c:120 fail_dump lib/fault-inject.c:52 [inline] should_fail+0x23e/0x250 lib/fault-inject.c:146 should_fail_usercopy+0x16/0x20 lib/fault-inject-usercopy.c:37 _copy_from_user+0x1c/0xd0 lib/usercopy.c:14 copy_from_user include/linux/uaccess.h:192 [inline] set_user_sigmask+0x4b/0x110 kernel/signal.c:3015 io_cqring_wait+0x2e3/0x8b0 fs/io_uring.c:7250 __do_sys_io_uring_enter fs/io_uring.c:9480 [inline] __se_sys_io_uring_enter+0x8fc/0xb70 fs/io_uring.c:9397 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9397 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x46a379 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f046fa19c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 000000000078c080 RCX: 000000000046a379 RDX: 00000000000066ab RSI: 0000000000000001 RDI: 0000000000000003 RBP: 00007f046fa19c90 R08: 0000000020000040 R09: 0000000000000008 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 Crash log: BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 49954067 P4D 49954067 PUD 45f92067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __io_uring_files_cancel+0x9b/0x200 fs/io_uring.c:9140 io_uring_files_cancel include/linux/io_uring.h:65 [inline] do_exit+0x1a8/0x16d0 kernel/exit.c:780 do_group_exit+0xc5/0x180 kernel/exit.c:922 get_signal+0xd90/0x1470 kernel/signal.c:2773 arch_do_signal_or_restart+0x2a/0x260 arch/x86/kernel/signal.c:811 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x109/0x1a0 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301 do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x46a379 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f046fa19cd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000078c080 RCX: 000000000046a379 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078c088 RBP: 000000000078c088 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c08c R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) CR2: 0000000000000040 ---[ end trace 613db1a25ecf6443 ]--- RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 [-- Attachment #2: log --] [-- Type: application/octet-stream, Size: 7264 bytes --] [ 80.194310][ T9161] FAULT_INJECTION: forcing a failure. [ 80.194310][ T9161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 80.200789][ T9161] CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 [ 80.202599][ T9161] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 80.205451][ T9161] Call Trace: [ 80.206172][ T9161] dump_stack+0x137/0x194 [ 80.207190][ T9161] should_fail+0x23e/0x250 [ 80.208268][ T9161] should_fail_usercopy+0x16/0x20 [ 80.209477][ T9161] _copy_from_user+0x1c/0xd0 [ 80.210467][ T9161] set_user_sigmask+0x4b/0x110 [ 80.211586][ T9161] io_cqring_wait+0x2e3/0x8b0 [ 80.212705][ T9161] ? _raw_spin_unlock_irqrestore+0x27/0x50 [ 80.214054][ T9161] ? io_req_defer+0x6d0/0x6d0 [ 80.215182][ T9161] __se_sys_io_uring_enter+0x8fc/0xb70 [ 80.216495][ T9161] ? __fget_light+0x219/0x260 [ 80.217580][ T9161] ? fput+0x2d/0x130 [ 80.218498][ T9161] __x64_sys_io_uring_enter+0x74/0x80 [ 80.219815][ T9161] do_syscall_64+0x39/0x80 [ 80.221102][ T9161] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 80.222560][ T9161] RIP: 0033:0x46a379 [ 80.226924][ T9161] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 80.231614][ T9161] RSP: 002b:00007f046fa19c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 80.233959][ T9161] RAX: ffffffffffffffda RBX: 000000000078c080 RCX: 000000000046a379 [ 80.239341][ T9161] RDX: 00000000000066ab RSI: 0000000000000001 RDI: 0000000000000003 [ 80.240801][ T9161] RBP: 00007f046fa19c90 R08: 0000000020000040 R09: 0000000000000008 [ 80.242296][ T9161] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 80.243988][ T9161] R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 [ 80.462925][ T9160] VFS: Close: file count is 0 [ 80.468297][ T9161] BUG: kernel NULL pointer dereference, address: 0000000000000040 [ 80.469991][ T9161] #PF: supervisor read access in kernel mode [ 80.471267][ T9161] #PF: error_code(0x0000) - not-present page [ 80.472459][ T9161] PGD 49954067 P4D 49954067 PUD 45f92067 PMD 0 [ 80.480597][ T9161] Oops: 0000 [#1] PREEMPT SMP [ 80.481581][ T9161] CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 [ 80.487977][ T9161] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 80.490775][ T9161] RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 [ 80.492145][ T9161] Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 [ 80.495817][ T9161] RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 [ 80.496852][ T9161] RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 [ 80.498150][ T9161] RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 [ 80.499303][ T9161] RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 [ 80.500467][ T9161] R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 [ 80.501773][ T9161] R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 [ 80.503083][ T9161] FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 [ 80.504670][ T9161] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.505896][ T9161] CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 [ 80.507373][ T9161] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 80.508895][ T9161] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 80.510264][ T9161] PKRU: 55555554 [ 80.510784][ T9161] Call Trace: [ 80.511258][ T9161] ? xa_find+0x10c/0x140 [ 80.512020][ T9161] __io_uring_files_cancel+0x9b/0x200 [ 80.512859][ T9161] ? _raw_spin_unlock_irqrestore+0x27/0x50 [ 80.513682][ T9161] do_exit+0x1a8/0x16d0 [ 80.514339][ T9161] ? do_futex+0xfc8/0x1c70 [ 80.514999][ T9161] do_group_exit+0xc5/0x180 [ 80.515927][ T9161] get_signal+0xd90/0x1470 [ 80.516868][ T9161] arch_do_signal_or_restart+0x2a/0x260 [ 80.518010][ T9161] ? __se_sys_futex+0x2a3/0x390 [ 80.518943][ T9161] exit_to_user_mode_prepare+0x109/0x1a0 [ 80.520072][ T9161] syscall_exit_to_user_mode+0x20/0x40 [ 80.521086][ T9161] do_syscall_64+0x45/0x80 [ 80.521713][ T9161] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 80.522597][ T9161] RIP: 0033:0x46a379 [ 80.523274][ T9161] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 80.526494][ T9161] RSP: 002b:00007f046fa19cd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 80.528079][ T9161] RAX: fffffffffffffe00 RBX: 000000000078c080 RCX: 000000000046a379 [ 80.529574][ T9161] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078c088 [ 80.531033][ T9161] RBP: 000000000078c088 R08: 0000000000000000 R09: 0000000000000000 [ 80.532198][ T9161] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c08c [ 80.533531][ T9161] R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 [ 80.535336][ T9161] Modules linked in: [ 80.536093][ T9161] Dumping ftrace buffer: [ 80.537032][ T9161] (ftrace buffer empty) [ 80.537886][ T9161] CR2: 0000000000000040 [ 80.538510][ T9161] ---[ end trace 613db1a25ecf6443 ]--- [ 80.539567][ T9161] RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 [ 80.540857][ T9161] Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 [ 80.544561][ T9161] RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 [ 80.545784][ T9161] RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 [ 80.547292][ T9161] RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 [ 80.548769][ T9161] RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 [ 80.550324][ T9161] R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 [ 80.551889][ T9161] R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 [ 80.553417][ T9161] FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 [ 80.555083][ T9161] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.556430][ T9161] CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 [ 80.557915][ T9161] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 80.561795][ T9161] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 80.563000][ T9161] PKRU: 55555554 [ 80.563589][ T9161] Kernel panic - not syncing: Fatal exception [ 80.564863][ T9161] Dumping ftrace buffer: [ 80.565515][ T9161] (ftrace buffer empty) [ 80.566182][ T9161] Kernel Offset: disabled [ 80.566826][ T9161] Rebooting in 1 seconds.. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests 2021-04-11 3:08 BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests Hao Sun @ 2021-04-11 8:10 ` Pavel Begunkov 2021-04-11 8:58 ` Hao Sun 0 siblings, 1 reply; 4+ messages in thread From: Pavel Begunkov @ 2021-04-11 8:10 UTC (permalink / raw) To: Hao Sun, axboe, io-uring; +Cc: linux-kernel On 11/04/2021 04:08, Hao Sun wrote: > Hi > > When using Healer(https://github.com/SunHao-0/healer/tree/dev) to fuzz > the Linux kernel, I found a null-ptr-deref bug in > io_uring_cancel_task_requests under fault injection condition, but I'm > not sure about this. > Sorry, I do not have a reproducing program for this bug. > I hope that the stack trace information in the crash log can help you > locate the problem. Thanks Hao. io_cqring_wait() fails should not anyhow affect cancellation, so the log doesn't make sense from first sight, something strange is going on. > > Here is the details: > commit: 3b9cdafb5358eb9f3790de2f728f765fef100731 > version: linux 5.11 > git tree: upstream > Full log can be found in the attachment. > cqwait() > Fault injection log: > FAULT_INJECTION: forcing a failure. > name fail_usercopy, interval 1, probability 0, space 0, times 0 > CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > Call Trace: > __dump_stack lib/dump_stack.c:79 [inline] > dump_stack+0x137/0x194 lib/dump_stack.c:120 > fail_dump lib/fault-inject.c:52 [inline] > should_fail+0x23e/0x250 lib/fault-inject.c:146 > should_fail_usercopy+0x16/0x20 lib/fault-inject-usercopy.c:37 > _copy_from_user+0x1c/0xd0 lib/usercopy.c:14 > copy_from_user include/linux/uaccess.h:192 [inline] > set_user_sigmask+0x4b/0x110 kernel/signal.c:3015 > io_cqring_wait+0x2e3/0x8b0 fs/io_uring.c:7250 > __do_sys_io_uring_enter fs/io_uring.c:9480 [inline] > __se_sys_io_uring_enter+0x8fc/0xb70 fs/io_uring.c:9397 > __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9397 > do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x46a379 > Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007f046fa19c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa > RAX: ffffffffffffffda RBX: 000000000078c080 RCX: 000000000046a379 > RDX: 00000000000066ab RSI: 0000000000000001 RDI: 0000000000000003 > RBP: 00007f046fa19c90 R08: 0000000020000040 R09: 0000000000000008 > R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 > R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 > > Crash log: > BUG: kernel NULL pointer dereference, address: 0000000000000040 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 49954067 P4D 49954067 PUD 45f92067 PMD 0 > Oops: 0000 [#1] PREEMPT SMP > CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 > Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b > 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b > 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 > RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 > RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 > RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 > RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 > R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 > R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 > FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > __io_uring_files_cancel+0x9b/0x200 fs/io_uring.c:9140 > io_uring_files_cancel include/linux/io_uring.h:65 [inline] > do_exit+0x1a8/0x16d0 kernel/exit.c:780 > do_group_exit+0xc5/0x180 kernel/exit.c:922 > get_signal+0xd90/0x1470 kernel/signal.c:2773 > arch_do_signal_or_restart+0x2a/0x260 arch/x86/kernel/signal.c:811 > handle_signal_work kernel/entry/common.c:147 [inline] > exit_to_user_mode_loop kernel/entry/common.c:171 [inline] > exit_to_user_mode_prepare+0x109/0x1a0 kernel/entry/common.c:208 > __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] > syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301 > do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 > entry_SYSCALL_64_after_hwframe+0x44/0xae > RIP: 0033:0x46a379 > Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007f046fa19cd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca > RAX: fffffffffffffe00 RBX: 000000000078c080 RCX: 000000000046a379 > RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078c088 > RBP: 000000000078c088 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c08c > R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 > Modules linked in: > Dumping ftrace buffer: > (ftrace buffer empty) > CR2: 0000000000000040 > ---[ end trace 613db1a25ecf6443 ]--- > RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 > Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b > 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b > 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 > RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 > RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 > RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 > RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 > R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 > R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 > FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > -- Pavel Begunkov ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests 2021-04-11 8:10 ` Pavel Begunkov @ 2021-04-11 8:58 ` Hao Sun 2021-04-11 9:09 ` Pavel Begunkov 0 siblings, 1 reply; 4+ messages in thread From: Hao Sun @ 2021-04-11 8:58 UTC (permalink / raw) To: Pavel Begunkov, axboe, io-uring; +Cc: linux-kernel Pavel Begunkov <[email protected]> 于2021年4月11日周日 下午4:14写道： > > On 11/04/2021 04:08, Hao Sun wrote: > > Hi > > > > When using Healer(https://github.com/SunHao-0/healer/tree/dev) to fuzz > > the Linux kernel, I found a null-ptr-deref bug in > > io_uring_cancel_task_requests under fault injection condition, but I'm > > not sure about this. > > Sorry, I do not have a reproducing program for this bug. > > I hope that the stack trace information in the crash log can help you > > locate the problem. > > Thanks Hao. io_cqring_wait() fails should not anyhow affect > cancellation, so the log doesn't make sense from first sight, > something strange is going on. > Is it possible that the failure of io_cqring_wait affects other operations with side effects between io_cqring_wait and cancellation, which eventually leads to the cancellation bug? I found the last call sequence (Syzlang format) executed by the fuzzer before triggering the bug. This may be helpful, but there is no guarantee that this is the direct cause of the bug. Possible guilty test case: r19 = syz_io_uring_setup(0x7211, &(0x7f0000000540)={0x6e3620b713f86b87,0xf615,0x2,0x1000,0x1a6,0xa26bc79d6b5315eb,0x0,[0x0,0x0,0x0],[0x813a698e7df9790f,0x1,0xb43ab5cc286248ee,0xe543f3b8cf765dd5,0x8005afeb090b0e62,0x1a29b15882d5d0b7,0xd7dc82c17c7ba1a7,0xab9d3c813ad3ae79,0x0,0x0],[0x1,0xd3a439e17ea7133c,0x4b845483eeeab284,0xf6fdf7f35d59044,0xf,0x99a9733bb1278a03,0xf8a69ea77c12e2b2,0x1,0x1,0x176ecee6d3c04836]}, &(0x7f0000000000/0x5000)=nil, &(0x7f0000000000/0x120000)=nil, &(0x7f00000005c0)=<r17=>0x0, &(0x7f0000000600)=<r18=>0x0) io_uring_enter(r19, 0x1, 0x66ab, 0x3, &(0x7f0000000040)={[0xfffe8c2bdda0afdd]}, 0x8) io_uring_register$IORING_UNREGISTER_EVENTFD(r19, 0x5, 0x0, 0x0) > > > > Here is the details: > > commit: 3b9cdafb5358eb9f3790de2f728f765fef100731 > > version: linux 5.11 > > git tree: upstream > > Full log can be found in the attachment. > > cqwait() > > Fault injection log: > > FAULT_INJECTION: forcing a failure. > > name fail_usercopy, interval 1, probability 0, space 0, times 0 > > CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > Call Trace: > > __dump_stack lib/dump_stack.c:79 [inline] > > dump_stack+0x137/0x194 lib/dump_stack.c:120 > > fail_dump lib/fault-inject.c:52 [inline] > > should_fail+0x23e/0x250 lib/fault-inject.c:146 > > should_fail_usercopy+0x16/0x20 lib/fault-inject-usercopy.c:37 > > _copy_from_user+0x1c/0xd0 lib/usercopy.c:14 > > copy_from_user include/linux/uaccess.h:192 [inline] > > set_user_sigmask+0x4b/0x110 kernel/signal.c:3015 > > io_cqring_wait+0x2e3/0x8b0 fs/io_uring.c:7250 > > __do_sys_io_uring_enter fs/io_uring.c:9480 [inline] > > __se_sys_io_uring_enter+0x8fc/0xb70 fs/io_uring.c:9397 > > __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9397 > > do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46 > > entry_SYSCALL_64_after_hwframe+0x44/0xae > > RIP: 0033:0x46a379 > > Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > > 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 > > RSP: 002b:00007f046fa19c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa > > RAX: ffffffffffffffda RBX: 000000000078c080 RCX: 000000000046a379 > > RDX: 00000000000066ab RSI: 0000000000000001 RDI: 0000000000000003 > > RBP: 00007f046fa19c90 R08: 0000000020000040 R09: 0000000000000008 > > R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 > > R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 > > > > Crash log: > > BUG: kernel NULL pointer dereference, address: 0000000000000040 > > #PF: supervisor read access in kernel mode > > #PF: error_code(0x0000) - not-present page > > PGD 49954067 P4D 49954067 PUD 45f92067 PMD 0 > > Oops: 0000 [#1] PREEMPT SMP > > CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > > rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 > > RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 > > Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b > > 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b > > 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 > > RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 > > RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 > > RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 > > RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 > > R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 > > R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 > > FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > PKRU: 55555554 > > Call Trace: > > __io_uring_files_cancel+0x9b/0x200 fs/io_uring.c:9140 > > io_uring_files_cancel include/linux/io_uring.h:65 [inline] > > do_exit+0x1a8/0x16d0 kernel/exit.c:780 > > do_group_exit+0xc5/0x180 kernel/exit.c:922 > > get_signal+0xd90/0x1470 kernel/signal.c:2773 > > arch_do_signal_or_restart+0x2a/0x260 arch/x86/kernel/signal.c:811 > > handle_signal_work kernel/entry/common.c:147 [inline] > > exit_to_user_mode_loop kernel/entry/common.c:171 [inline] > > exit_to_user_mode_prepare+0x109/0x1a0 kernel/entry/common.c:208 > > __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] > > syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301 > > do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 > > entry_SYSCALL_64_after_hwframe+0x44/0xae > > RIP: 0033:0x46a379 > > Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > > 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 > > RSP: 002b:00007f046fa19cd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca > > RAX: fffffffffffffe00 RBX: 000000000078c080 RCX: 000000000046a379 > > RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078c088 > > RBP: 000000000078c088 R08: 0000000000000000 R09: 0000000000000000 > > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c08c > > R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 > > Modules linked in: > > Dumping ftrace buffer: > > (ftrace buffer empty) > > CR2: 0000000000000040 > > ---[ end trace 613db1a25ecf6443 ]--- > > RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 > > Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b > > 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b > > 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 > > RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 > > RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 > > RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 > > RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 > > R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 > > R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 > > FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > > PKRU: 55555554 > > > > -- > Pavel Begunkov ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests 2021-04-11 8:58 ` Hao Sun @ 2021-04-11 9:09 ` Pavel Begunkov 0 siblings, 0 replies; 4+ messages in thread From: Pavel Begunkov @ 2021-04-11 9:09 UTC (permalink / raw) To: Hao Sun, axboe, io-uring; +Cc: linux-kernel On 11/04/2021 09:58, Hao Sun wrote: > Pavel Begunkov <[email protected]> 于2021年4月11日周日 下午4:14写道： >> >> On 11/04/2021 04:08, Hao Sun wrote: >>> Hi >>> >>> When using Healer(https://github.com/SunHao-0/healer/tree/dev) to fuzz >>> the Linux kernel, I found a null-ptr-deref bug in >>> io_uring_cancel_task_requests under fault injection condition, but I'm >>> not sure about this. >>> Sorry, I do not have a reproducing program for this bug. >>> I hope that the stack trace information in the crash log can help you >>> locate the problem. >> >> Thanks Hao. io_cqring_wait() fails should not anyhow affect >> cancellation, so the log doesn't make sense from first sight, >> something strange is going on. >> > Is it possible that the failure of io_cqring_wait affects other > operations with side effects between io_cqring_wait and cancellation, > which eventually leads to the cancellation bug? It shouldn't in theory, but need to a look deeper TL;DR; ctx->flags is NULL dereference, means that tctx->xa entry is invalid or file->private got corrupted/not set. Your kernel is old enough (5.11-ish), so it's a bit more safer in that regard and all manipulations with ->xa are pretty much made by the task itself, so should be synchronised. There are things like io_run_task_work() or overflow_flush() that are done in the cqring_wait(), but not much. It also grabs a file beforehand and puts afterwards, extra reference would lead to hangs not such failures. > I found the last call sequence (Syzlang format) executed by the fuzzer > before triggering the bug. > This may be helpful, but there is no guarantee that this is the direct > cause of the bug. appreciate that > > Possible guilty test case: > r19 = syz_io_uring_setup(0x7211, > &(0x7f0000000540)={0x6e3620b713f86b87,0xf615,0x2,0x1000,0x1a6,0xa26bc79d6b5315eb,0x0,[0x0,0x0,0x0],[0x813a698e7df9790f,0x1,0xb43ab5cc286248ee,0xe543f3b8cf765dd5,0x8005afeb090b0e62,0x1a29b15882d5d0b7,0xd7dc82c17c7ba1a7,0xab9d3c813ad3ae79,0x0,0x0],[0x1,0xd3a439e17ea7133c,0x4b845483eeeab284,0xf6fdf7f35d59044,0xf,0x99a9733bb1278a03,0xf8a69ea77c12e2b2,0x1,0x1,0x176ecee6d3c04836]}, > &(0x7f0000000000/0x5000)=nil, &(0x7f0000000000/0x120000)=nil, > &(0x7f00000005c0)=<r17=>0x0, &(0x7f0000000600)=<r18=>0x0) > io_uring_enter(r19, 0x1, 0x66ab, 0x3, > &(0x7f0000000040)={[0xfffe8c2bdda0afdd]}, 0x8) > io_uring_register$IORING_UNREGISTER_EVENTFD(r19, 0x5, 0x0, 0x0) > >>> >>> Here is the details: >>> commit: 3b9cdafb5358eb9f3790de2f728f765fef100731 >>> version: linux 5.11 >>> git tree: upstream >>> Full log can be found in the attachment. >>> cqwait() >>> Fault injection log: >>> FAULT_INJECTION: forcing a failure. >>> name fail_usercopy, interval 1, probability 0, space 0, times 0 >>> CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS >>> rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 >>> Call Trace: >>> __dump_stack lib/dump_stack.c:79 [inline] >>> dump_stack+0x137/0x194 lib/dump_stack.c:120 >>> fail_dump lib/fault-inject.c:52 [inline] >>> should_fail+0x23e/0x250 lib/fault-inject.c:146 >>> should_fail_usercopy+0x16/0x20 lib/fault-inject-usercopy.c:37 >>> _copy_from_user+0x1c/0xd0 lib/usercopy.c:14 >>> copy_from_user include/linux/uaccess.h:192 [inline] >>> set_user_sigmask+0x4b/0x110 kernel/signal.c:3015 >>> io_cqring_wait+0x2e3/0x8b0 fs/io_uring.c:7250 >>> __do_sys_io_uring_enter fs/io_uring.c:9480 [inline] >>> __se_sys_io_uring_enter+0x8fc/0xb70 fs/io_uring.c:9397 >>> __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9397 >>> do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46 >>> entry_SYSCALL_64_after_hwframe+0x44/0xae >>> RIP: 0033:0x46a379 >>> Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 >>> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d >>> 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 >>> RSP: 002b:00007f046fa19c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa >>> RAX: ffffffffffffffda RBX: 000000000078c080 RCX: 000000000046a379 >>> RDX: 00000000000066ab RSI: 0000000000000001 RDI: 0000000000000003 >>> RBP: 00007f046fa19c90 R08: 0000000020000040 R09: 0000000000000008 >>> R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 >>> R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 >>> >>> Crash log: >>> BUG: kernel NULL pointer dereference, address: 0000000000000040 >>> #PF: supervisor read access in kernel mode >>> #PF: error_code(0x0000) - not-present page >>> PGD 49954067 P4D 49954067 PUD 45f92067 PMD 0 >>> Oops: 0000 [#1] PREEMPT SMP >>> CPU: 1 PID: 9161 Comm: executor Not tainted 5.11.0+ #5 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS >>> rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 >>> RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 >>> Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b >>> 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b >>> 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 >>> RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 >>> RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 >>> RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 >>> RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 >>> R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 >>> R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 >>> FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 >>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >>> PKRU: 55555554 >>> Call Trace: >>> __io_uring_files_cancel+0x9b/0x200 fs/io_uring.c:9140 >>> io_uring_files_cancel include/linux/io_uring.h:65 [inline] >>> do_exit+0x1a8/0x16d0 kernel/exit.c:780 >>> do_group_exit+0xc5/0x180 kernel/exit.c:922 >>> get_signal+0xd90/0x1470 kernel/signal.c:2773 >>> arch_do_signal_or_restart+0x2a/0x260 arch/x86/kernel/signal.c:811 >>> handle_signal_work kernel/entry/common.c:147 [inline] >>> exit_to_user_mode_loop kernel/entry/common.c:171 [inline] >>> exit_to_user_mode_prepare+0x109/0x1a0 kernel/entry/common.c:208 >>> __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] >>> syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301 >>> do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 >>> entry_SYSCALL_64_after_hwframe+0x44/0xae >>> RIP: 0033:0x46a379 >>> Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 >>> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d >>> 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 >>> RSP: 002b:00007f046fa19cd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca >>> RAX: fffffffffffffe00 RBX: 000000000078c080 RCX: 000000000046a379 >>> RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078c088 >>> RBP: 000000000078c088 R08: 0000000000000000 R09: 0000000000000000 >>> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c08c >>> R13: 0000000000000000 R14: 000000000078c080 R15: 00007fff769deef0 >>> Modules linked in: >>> Dumping ftrace buffer: >>> (ftrace buffer empty) >>> CR2: 0000000000000040 >>> ---[ end trace 613db1a25ecf6443 ]--- >>> RIP: 0010:io_uring_cancel_task_requests+0x3f/0x990 fs/io_uring.c:9045 >>> Code: 48 8b 04 25 28 00 00 00 48 89 44 24 68 e8 89 e6 c5 ff 65 4c 8b >>> 34 25 00 6d 01 00 49 8d 7c 24 40 48 89 7c 24 30 e8 81 97 d6 ff <41> 8b >>> 5c 24 40 89 de 83 e6 02 31 ff e8 70 ea c5 ff 83 e3 02 48 89 >>> RSP: 0018:ffffc90002a97b48 EFLAGS: 00010246 >>> RAX: ffff88804b8e0d38 RBX: ffff88804b8ad700 RCX: 0000000000000764 >>> RDX: 0000000000000040 RSI: ffff8880409d5140 RDI: 0000000000000040 >>> RBP: ffff8880409d5140 R08: 0000000000000000 R09: 0000000000000043 >>> R10: 0001ffffffffffff R11: ffff88804b8e0280 R12: 0000000000000000 >>> R13: ffff8880409d5140 R14: ffff88804b8e0280 R15: ffff8880481c1800 >>> FS: 00007f046fa1a700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> CR2: 0000000000000040 CR3: 00000000479a5000 CR4: 0000000000750ee0 >>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >>> PKRU: 55555554 >>> >> >> -- >> Pavel Begunkov -- Pavel Begunkov ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-11 9:13 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2021-04-11 3:08 BUG: unable to handle kernel NULL pointer dereference in io_uring_cancel_task_requests Hao Sun 2021-04-11 8:10 ` Pavel Begunkov 2021-04-11 8:58 ` Hao Sun 2021-04-11 9:09 ` Pavel Begunkov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox