* WARNING in __kthread_create_on_node
@ 2024-03-14 14:23 cheung wall
2024-03-14 18:25 ` Andrew Morton
0 siblings, 1 reply; 2+ messages in thread
From: cheung wall @ 2024-03-14 14:23 UTC (permalink / raw)
To: Andrew Morton, linux-kernel
Hello,
when using Healer to fuzz the latest Linux Kernel, the following crash
was triggered on:
HEAD commit: e8f897f4afef0031fe618a8e94127a0934896aba (tag: v6.8)
git tree: upstream
console output: https://pastebin.com/raw/4dqjbmVn
kernel config: https://pastebin.com/raw/enVJCL3u
C reproducer: https://pastebin.com/raw/wdKP6g0V
Syzlang reproducer: https://pastebin.com/raw/wfptradq
If you fix this issue, please add the following tag to the commit:
Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>
----------------------------------------------------------
------------[ cut here ]------------
different return values (11 and 6) from vsnprintf("kmmpd-%.*s", ...)
WARNING: CPU: 0 PID: 18743 at lib/kasprintf.c:30
kvasprintf+0x14e/0x160 lib/kasprintf.c:30
Modules linked in:
CPU: 0 PID: 18743 Comm: syz-executor.0 Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:kvasprintf+0x14e/0x160 lib/kasprintf.c:30
Code: 5b 5d 41 5c 41 5d 41 5e 41 5f e9 e8 2f 2d 02 e8 08 54 43 ff 90
48 c7 c7 40 62 fe a1 4c 89 e9 44 89 e2 89 ee e8 d3 62 13 ff 90 <0f> 0b
90 90 eb 99 e8 27 96 12 02 0f 1f 80 00 00 00 00 90 90 90 90
RSP: 0018:ffff88810485f760 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 1ffff1102090beec RCX: ffffffff9eb67582
RDX: ffff888104dfe600 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 000000000000000b R08: 0000000000000001 R09: ffffed10235c5121
R10: 0000000000000000 R11: 000000002d2d2d2d R12: 0000000000000006
R13: ffffffffa1f42a20 R14: ffff888100b62900 R15: 000000000000000c
FS: 00007f8db8f7e640(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
loop2: detected capacity change from 0 to 512
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcd493ab98 CR3: 00000001063fe004 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
loop3: detected capacity change from 0 to 512
__kthread_create_on_node+0x17f/0x3c0 kernel/kthread.c:444
kthread_create_on_node+0xbf/0x100 kernel/kthread.c:512
loop1: detected capacity change from 0 to 512
ext4_multi_mount_protect+0x953/0xb10 fs/ext4/mmp.c:392
__ext4_fill_super fs/ext4/super.c:5363 [inline]
ext4_fill_super+0xa76d/0xc290 fs/ext4/super.c:5703
get_tree_bdev+0x35a/0x5d0 fs/super.c:1614
vfs_get_tree+0x8c/0x320 fs/super.c:1779
do_new_mount fs/namespace.c:3352 [inline]
path_mount+0x6b3/0x1db0 fs/namespace.c:3679
do_mount fs/namespace.c:3692 [inline]
__do_sys_mount fs/namespace.c:3898 [inline]
__se_sys_mount fs/namespace.c:3875 [inline]
__x64_sys_mount+0x286/0x310 fs/namespace.c:3875
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xb3/0x1b0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f8db9410dfe
Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00
00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8db8f7de38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000000004b4 RCX: 00007f8db9410dfe
RDX: 0000000020000040 RSI: 0000000020000500 RDI: 00007f8db8f7de90
RBP: 00007f8db8f7ded0 R08: 00007f8db8f7ded0 R09: 0000000000004500
R10: 0000000000004500 R11: 0000000000000246 R12: 0000000020000040
R13: 0000000020000500 R14: 00007f8db8f7de90 R15: 0000000020000540
</TASK>
---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: WARNING in __kthread_create_on_node
2024-03-14 14:23 WARNING in __kthread_create_on_node cheung wall
@ 2024-03-14 18:25 ` Andrew Morton
0 siblings, 0 replies; 2+ messages in thread
From: Andrew Morton @ 2024-03-14 18:25 UTC (permalink / raw)
To: cheung wall; +Cc: linux-kernel, linux-ext4
(cc linux-ext4)
Interesting.
On Thu, 14 Mar 2024 22:23:54 +0800 cheung wall <zzqq0103.hey@gmail.com> wrote:
> Hello,
>
> when using Healer to fuzz the latest Linux Kernel, the following crash
>
> was triggered on:
>
>
> HEAD commit: e8f897f4afef0031fe618a8e94127a0934896aba (tag: v6.8)
>
> git tree: upstream
>
> console output: https://pastebin.com/raw/4dqjbmVn
>
> kernel config: https://pastebin.com/raw/enVJCL3u
>
> C reproducer: https://pastebin.com/raw/wdKP6g0V
>
> Syzlang reproducer: https://pastebin.com/raw/wfptradq
>
> If you fix this issue, please add the following tag to the commit:
>
> Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>
>
> ----------------------------------------------------------
>
> ------------[ cut here ]------------
> different return values (11 and 6) from vsnprintf("kmmpd-%.*s", ...)
> WARNING: CPU: 0 PID: 18743 at lib/kasprintf.c:30
> kvasprintf+0x14e/0x160 lib/kasprintf.c:30
> Modules linked in:
> CPU: 0 PID: 18743 Comm: syz-executor.0 Not tainted 6.8.0 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:kvasprintf+0x14e/0x160 lib/kasprintf.c:30
> Code: 5b 5d 41 5c 41 5d 41 5e 41 5f e9 e8 2f 2d 02 e8 08 54 43 ff 90
> 48 c7 c7 40 62 fe a1 4c 89 e9 44 89 e2 89 ee e8 d3 62 13 ff 90 <0f> 0b
> 90 90 eb 99 e8 27 96 12 02 0f 1f 80 00 00 00 00 90 90 90 90
> RSP: 0018:ffff88810485f760 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: 1ffff1102090beec RCX: ffffffff9eb67582
> RDX: ffff888104dfe600 RSI: 0000000000000000 RDI: 0000000000000001
> RBP: 000000000000000b R08: 0000000000000001 R09: ffffed10235c5121
> R10: 0000000000000000 R11: 000000002d2d2d2d R12: 0000000000000006
> R13: ffffffffa1f42a20 R14: ffff888100b62900 R15: 000000000000000c
> FS: 00007f8db8f7e640(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000
> loop2: detected capacity change from 0 to 512
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffcd493ab98 CR3: 00000001063fe004 CR4: 0000000000770ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> loop3: detected capacity change from 0 to 512
> __kthread_create_on_node+0x17f/0x3c0 kernel/kthread.c:444
> kthread_create_on_node+0xbf/0x100 kernel/kthread.c:512
> loop1: detected capacity change from 0 to 512
> ext4_multi_mount_protect+0x953/0xb10 fs/ext4/mmp.c:392
> __ext4_fill_super fs/ext4/super.c:5363 [inline]
> ext4_fill_super+0xa76d/0xc290 fs/ext4/super.c:5703
> get_tree_bdev+0x35a/0x5d0 fs/super.c:1614
> vfs_get_tree+0x8c/0x320 fs/super.c:1779
> do_new_mount fs/namespace.c:3352 [inline]
> path_mount+0x6b3/0x1db0 fs/namespace.c:3679
> do_mount fs/namespace.c:3692 [inline]
> __do_sys_mount fs/namespace.c:3898 [inline]
> __se_sys_mount fs/namespace.c:3875 [inline]
> __x64_sys_mount+0x286/0x310 fs/namespace.c:3875
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xb3/0x1b0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x6f/0x77
> RIP: 0033:0x7f8db9410dfe
> Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00
> 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f8db8f7de38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00000000000004b4 RCX: 00007f8db9410dfe
> RDX: 0000000020000040 RSI: 0000000020000500 RDI: 00007f8db8f7de90
> RBP: 00007f8db8f7ded0 R08: 00007f8db8f7ded0 R09: 0000000000004500
> R10: 0000000000004500 R11: 0000000000000246 R12: 0000000020000040
> R13: 0000000020000500 R14: 00007f8db8f7de90 R15: 0000000020000540
> </TASK>
> ---[ end trace 0000000000000000 ]---
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-14 18:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-03-14 14:23 WARNING in __kthread_create_on_node cheung wall
2024-03-14 18:25 ` Andrew Morton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®