* BUG: corrupted list in io_poll_task_func
@ 2022-10-10 12:41 Wei Chen
2022-10-11 1:03 ` Pavel Begunkov
0 siblings, 1 reply; 2+ messages in thread
From: Wei Chen @ 2022-10-10 12:41 UTC (permalink / raw)
To: asml.silence, axboe, io-uring; +Cc: linux-kernel
Dear Linux Developer,
Recently when using our tool to fuzz kernel, the following crash was triggered:
HEAD commit: c5eb0a61238d Linux 5.18-rc6
git tree: upstream
compiler: clang 12.0.0
console output:
https://drive.google.com/file/d/1Obzlp9wrLFx9BogwmOHhmnQqyMYa2z_k/view?usp=sharing
kernel config: https://drive.google.com/file/d/12fNP5UArsFqTi2jjGomWuCk5evtgU0Gu/view?usp=sharing
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: Wei Chen <[email protected]>
list_del corruption. prev->next should be ffff88810ec0ae30, but was
ffff888114119218. (prev=ffff888114119218)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 20805 Comm: iou-sqp-20802 Not tainted 5.18.0-rc6 #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:__list_del_entry_valid+0xa7/0xc0
Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f
0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b
48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01
RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046
RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000
R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218
R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30
FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0
DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 55555554
Call Trace:
<TASK>
io_poll_task_func+0x1ca/0x4f0
tctx_task_work+0x808/0xae0
task_work_run+0x8e/0x110
get_signal+0x13c6/0x1520
io_sq_thread+0x382/0xbd0
ret_from_fork+0x1f/0x30
</TASK>
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid+0xa7/0xc0
Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f
0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b
48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01
RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046
RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000
R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218
R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30
FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0
DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
PKRU: 55555554
Best,
Wei
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: BUG: corrupted list in io_poll_task_func
2022-10-10 12:41 BUG: corrupted list in io_poll_task_func Wei Chen
@ 2022-10-11 1:03 ` Pavel Begunkov
0 siblings, 0 replies; 2+ messages in thread
From: Pavel Begunkov @ 2022-10-11 1:03 UTC (permalink / raw)
To: Wei Chen, axboe, io-uring; +Cc: linux-kernel
On 10/10/22 13:41, Wei Chen wrote:
> Dear Linux Developer,
>
> Recently when using our tool to fuzz kernel, the following crash was triggered:
>
> HEAD commit: c5eb0a61238d Linux 5.18-rc6
> git tree: upstream
> compiler: clang 12.0.0
> console output:
> https://drive.google.com/file/d/1Obzlp9wrLFx9BogwmOHhmnQqyMYa2z_k/view?usp=sharing
> kernel config: https://drive.google.com/file/d/12fNP5UArsFqTi2jjGomWuCk5evtgU0Gu/view?usp=sharing
It's hard to tell anything as it's rc6 and we have a couple of
poll fixes backported to stable 5.18. Would be great if you tell
whether you see it with a stable kernel. Also a repro would
help if it finds it. Thanks
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: Wei Chen <[email protected]>
>
> list_del corruption. prev->next should be ffff88810ec0ae30, but was
> ffff888114119218. (prev=ffff888114119218)
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:53!
> invalid opcode: 0000 [#1] PREEMPT SMP
> CPU: 0 PID: 20805 Comm: iou-sqp-20802 Not tainted 5.18.0-rc6 #10
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> RIP: 0010:__list_del_entry_valid+0xa7/0xc0
> Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f
> 0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b
> 48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01
> RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046
> RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000
> R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218
> R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30
> FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0
> DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> PKRU: 55555554
> Call Trace:
> <TASK>
> io_poll_task_func+0x1ca/0x4f0
> tctx_task_work+0x808/0xae0
> task_work_run+0x8e/0x110
> get_signal+0x13c6/0x1520
> io_sq_thread+0x382/0xbd0
> ret_from_fork+0x1f/0x30
> </TASK>
> Modules linked in:
> Dumping ftrace buffer:
> (ftrace buffer empty)
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:__list_del_entry_valid+0xa7/0xc0
> Code: 48 c7 c7 54 12 3f 83 4c 89 fe 48 89 da 31 c0 e8 89 e0 21 01 0f
> 0b 48 c7 c7 6f d7 48 83 4c 89 fe 4c 89 e1 31 c0 e8 73 e0 21 01 <0f> 0b
> 48 c7 c7 17 b4 42 83 4c 89 fe 4c 89 f1 31 c0 e8 5d e0 21 01
> RSP: 0018:ffffc900026dbb58 EFLAGS: 00010046
> RAX: 000000000000006d RBX: dead000000000122 RCX: 6101d1e720e71900
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: ffff88810ec0ae08 R08: ffffffff8115f303 R09: 0000000000000000
> R10: 0001ffffffffffff R11: 000188813bc1b460 R12: ffff888114119218
> R13: ffff88810ec0ae00 R14: ffff888114119218 R15: ffff88810ec0ae30
> FS: 00007f1e57534700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f1e574afdb8 CR3: 00000001394b3000 CR4: 0000000000750ef0
> DR0: 0000000020000140 DR1: 0000000020000440 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> PKRU: 55555554
>
> Best,
> Wei
--
Pavel Begunkov
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-11 1:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-10 12:41 BUG: corrupted list in io_poll_task_func Wei Chen
2022-10-11 1:03 ` Pavel Begunkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox