From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752732AbcFTGPJ (ORCPT ); Mon, 20 Jun 2016 02:15:09 -0400 Received: from mailout4.samsung.com ([203.254.224.34]:44234 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752219AbcFTGPE (ORCPT ); Mon, 20 Jun 2016 02:15:04 -0400 X-AuditID: cbfee68d-f79876d000001436-f0-576789a8d71b Date: Mon, 20 Jun 2016 06:14:00 +0000 (GMT) From: AMIT NAGAL Subject: tg_load_down NULL pointer dereference To: linux-kernel@vger.kernel.org, mingo@redhat.com, peterz@infradead.org Cc: ajeet.y@samsung.com, pankaj.m@samsung.com Reply-to: amit.nagal@samsung.com MIME-version: 1.0 X-MTR: 20160620060455539@amit.nagal Msgkey: 20160620060455539@amit.nagal X-EPLocale: en_US.windows-1252 X-Priority: 3 X-EPWebmail-Msg-Type: personal X-EPWebmail-Reply-Demand: 0 X-EPApproval-Locale: X-EPHeader: ML X-MLAttribute: X-RootMTR: 20160620060455539@amit.nagal X-ParentMTR: X-ArchiveUser: X-CPGSPASS: N X-ConfirmMail: N,general Content-type: text/plain; charset=windows-1252 MIME-version: 1.0 Message-id: <594315041.16511466403240766.JavaMail.weblogic@ep2mlwas08d> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprCKsWRmVeSWpSXmKPExsWyRsSkVndFZ3q4QdM/C4vLu+awOTB6fN4k F8AYJWKTkpqTWZZapG+HYCWIZBxdVFBwQ73i17d3jA2MF9S6GDk5hARUJS59mcfSxcjBISFg IjGhXx8kLCEgJnHh3nq2LkYuoJKljBITZ99jg6n5ulUWIj6HUeLRqVXsIA0sQHNevzkDZrMJ aElMnzafFcQWFtCTWL7oCjOILSIQLXFvzgGwOLOApUTjgV+MEDcoSNx+sAcszisgKHFy5hMW iCOUJd5c+sEMEVeRmLp3HxtEXE5iydTLTBA2r8SM9qcsMPFpX9cwQ9jSEudnbWCEeWbx98dQ cX6JY7d3QPUKSEw9cxCqRkNi4b52VgibT2LNwrcsMPW7Ti1nhtl1f8tcqF4Jia0tT6B+UZSY 0v2QHcI2kDiyaA6GX3gF3CWmHlnMBAo4CYEzHBIr301nmsCoNAtJ3Swks2YhmYWsZgEjyypG 0dSC5ILipPQiQ73ixNzi0rx0veT83E2MwFRx+t+z3h2Mtw9YH2JU52CUEi3NK05OzMtLTMpJ jc9NzEnLL8pNTVHi4bU4mxYuxJpYVlyZe4jRFBh9E5mlRJPzgekrryTe0NjMyMLUxNTYyNzS TEmcV1HqZ7CQQHpiSWp2ampBalF8UWlOavEhRiYOTqkGRjvPnywq+82n9L2sV5p5f46fS15/ mURG+mtl1Y3hp8Q59p5kSZ3wZ+kqtUn+HP5CL859FfFf88bcbN/O1R+/6Ysc/C70e34x87/H dT5VJhN1OK+q3RfjY97m9Pvgh7PrXv4K5T2Z4uw97duli5+6102U79wuwHq9+JrSfd7UEt2O Rvb1/sUefEosxRmJhlrMRcWJAOwMI04nAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrEKsWRmVeSWpSXmKPExsVy+t/tft0VnenhBu0zjCwu75rD5sDo8XmT XABjVIFNSmpOZllqkb6dTUZqYkpqkUJqXnJ+SmZeuq2Sd3C8c7ypmYGhrqGlhbmSQl5ibqqt kotPgK5bZg7QeCWFssScUqBQQGJxsRLQhKL80pJUhYz84hJbpWhDcyM9IwM9UyM9Q9NYK0MD AyNToJqEgoyjiwoKbqhX/Pr2jrGB8YJaFyMnh5CAqsSlL/NYuhg5OCQETCS+bpUFCUsIiElc uLeerYuRC6hkDqPEo1Or2EESLED1r9+cAbPZBLQkpk+bzwpiCwvoSSxfdIUZxBYRiJa4N+cA WJxZwFKi8cAvRohdChK3H+wBi/MKCEqcnPmEBWKZssSbSz+YIeIqElP37mODiMtJLJl6mQnC 5pWY0f6UBSY+7esaZghbWuL8rA2MMEcv/v4YKs4vcez2DqheAYmpZw5C1WhILNzXzgph80ms WfiWBaZ+16nlzDC77m+ZC9UrIbG15QnUL4oSU7ofskPYBhJHFs3B8AuvgLvE1COLmSYwys5C kpqFpH0WknZkNQsYWVYxiqYWJBcUJ6VXmOgVJ+YWl+al6yXn525iBCemZ0t2MDZcsD7EqM7B KCVamlecnJiXl5iUkxqfm5iTll+Um5qixMNrcTYtXIg1say4MvcQowrQqkcbVl9glGLJy89L VRLhtWtNDxfiTUmsrEotyo8vKs1JLT7EaAqM2InMUqLJ+cDUm1cSb2hsYm5qbGphYGhubqYk zhvwd12YkEB6YklqdmpqQWoRTB8TB6dUA+OdtmnGv4sYNy+5fqPlAp/WFofonDkzHsfcrtHn r1md+mSCRGRW7Y++9WeULH76zfF9+3yHcnXXMbdFTbaTn7483ZcaslOHUf2qVq7JgkitTdZ2 rBNXMCe+2Vq4eN+21UcuFFxT/5PjbRZ7YFnH13Sjat6Xq/gZz83TPNNRl35zrs/EhW1P89cr sRRnJBpqMRcVJwIAcjC5p4UDAAA= DLP-Filter: Pass X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id u5K6FGAs021567 Hi I am using Linux kernel version 3.10.28 (ARM platform) . I am getting NULL pointer dereference in tg_load_down() . At the time of error , tg->parent->cfs_rq value is 0 and tg->se value is 0x00000400 . ( refer to backtrace in 5) ). 1) Problematic statement is in line 5814 in tg_load_down() : line 5814 :: load = tg->parent->cfs_rq[cpu]->h_load; tg->parent->cfs_rq value is 0 (register r2) due to which null dereference error comes . line 5815 :: load *= tg->se[cpu]->load.weight; tg->se pointer value value is 0x00000400 (register r3) . (tg->se is computed early , refer disas below ). PC = 0x0xc00741b0 at the time of NULL dereference error . (gdb) list *(0xc00741b0) 0xc00741b0 is in tg_load_down (kernel/sched/fair.c:5814). 5809 long cpu = (long)data; 5810 5811 if (!tg->parent) { 5812 load = cpu_rq(cpu)->load.weight; 5813 } else { 5814 load = tg->parent->cfs_rq[cpu]->h_load; 5815 load *= tg->se[cpu]->load.weight; 5816 load /= tg->parent->cfs_rq[cpu]->load.weight + 1; 5817 } (gdb) disas tg_load_down Dump of assembler code for function tg_load_down: 0xc007418c <+0>: mov r12, sp 0xc0074190 <+4>: push {r11, r12, lr, pc} 0xc0074194 <+8>: sub r11, r12, #4 0xc0074198 <+12>: ldr r3, [r0, #80] ; 0x50 0xc007419c <+16>: cmp r3, #0 0xc00741a0 <+20>: beq 0xc00741e8 0xc00741a4 <+24>: ldr r2, [r3, #36] ; 0x24 0xc00741a8 <+28>: lsl lr, r1, #2 0xc00741ac <+32>: ldr r3, [r0, #32] 0xc00741b0 <+36>: ldr r12, [r2, r1, lsl #2] 2) tg_lock_group() first argument ( struct task_group *tg) is stored in r0 . Line 5811 : if (!tg->parent) { so first , tg->parent is stored in r3 . c0074198: e5903050 ldr r3, [r0, #80] ; 0x50 and tg->parent is checked for NULL . c007419c: e3530000 cmp r3, #0 Line 5814 : load = tg->parent->cfs_rq[cpu] c00741a4: e5932024 ldr r2, [r3, #36] ; 0x24 here tg->parent->cfs_rq is stored in r2 . Line 5815 : load *= tg->se[cpu] c00741ac: e5903020 ldr r3, [r0, #32] here tg->se is stored in r3 . both tg->parent->cfs_rq and tg->se are double pointers . however when we see r2 ( tg->parent->cfs_rq) and r3 (tg->se) values in register dumps at the time of kernel crash , they have these values as shown in backtrace below in 5). r2=00000000 r3 = 00000400 after this , ldr r12, [r2, r1, lsl #2] is executed which causes kernel crash with NULL pointer dereference error as r2 value is 0 3) rcu lock protection is already there while tg_load_down is executing . static void update_h_load(long cpu) { struct rq *rq = cpu_rq(cpu); unsigned long now = jiffies; if (rq->h_load_throttle == now) return; rq->h_load_throttle = now; rcu_read_lock(); walk_tg_tree(tg_load_down, tg_nop, (void *)cpu); rcu_read_unlock(); } 4)relevant Backtrace related to problem is as follows : pc : [ ( tg_load_down + 36 )] lr : [<00000008>] psr: a0070093 ip : dc4c3d08 fp : dc4c3d04 r10: c047e418 r9 : c007418c r8 : 00000000 r7 : c006f44c r6 : c069cb28 r5 : 00000002 r4 : d5d53a08 r3 : 00000400 r2 : 00000000 r1 : 00000002 r0 : d5d53a08 Function entered at [](tg_load_down) from [](walk_tg_tree_from + 48) Function entered at [](walk_tg_tree_from) from [< c007a694>](load_balance +668) 5) Is there any scenario by which tg->parent->cfs_rq be 0 (r2) and tg->se can get corrupted to value 00000400 (r3). Regards Amit Nagal