lkml.org 
[lkml]   [2017]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject4.9.30 NULL pointer dereference in __remove_shared_vm_struct
    Date
    Hi,

    I have hit this kernel bug twice with 4.9.30 while running trinity, any
    ideas? It's not easily reproducible.

    Perhaps I should enable some more debug options to see if they reveal
    anything...

    (note that I had different kernel builds, so the IP addresses are
    different in the logs below)


    $ scripts/faddr2line vmlinux __remove_shared_vm_struct+0x16/0x40
    __remove_shared_vm_struct+0x16/0x40:
    atomic_inc at arch/x86/include/asm/atomic.h:91
    (inlined by) __remove_shared_vm_struct at mm/mmap.c:137


    (gdb) disassemble __remove_shared_vm_struct
    Dump of assembler code for function __remove_shared_vm_struct:
    0xffffffff8218e7a0 <+0>: callq 0xffffffff825db650 <__fentry__>
    0xffffffff8218e7a5 <+5>: mov 0x50(%rdi),%rax
    0xffffffff8218e7a9 <+9>: push %rbp
    0xffffffff8218e7aa <+10>: mov %rsp,%rbp
    0xffffffff8218e7ad <+13>: test $0x8,%ah
    0xffffffff8218e7b0 <+16>: je 0xffffffff8218e7c1
    <__remove_shared_vm_struct+33>
    0xffffffff8218e7b2 <+18>: mov 0x20(%rsi),%rax
    0xffffffff8218e7b6 <+22>: lock incl 0x158(%rax)
    0xffffffff8218e7bd <+29>: mov 0x50(%rdi),%rax
    0xffffffff8218e7c1 <+33>: test $0x8,%al
    0xffffffff8218e7c3 <+35>: je 0xffffffff8218e7c9
    <__remove_shared_vm_struct+41>
    0xffffffff8218e7c5 <+37>: lock decl 0x1c(%rdx)
    0xffffffff8218e7c9 <+41>: lea 0x20(%rdx),%rsi
    0xffffffff8218e7cd <+45>: callq 0xffffffff82183460
    <vma_interval_tree_remove>
    0xffffffff8218e7d2 <+50>: pop %rbp
    0xffffffff8218e7d3 <+51>: retq




    [16076.230255] BUG: unable to handle kernel NULL pointer dereference at
    0000000000000158
    [16076.231566] IP: [<ffffffff8038e616>] __remove_shared_vm_struct+0x16/0x40
    [16076.232533] PGD 0
    [16076.233125] Oops: 0002 [#1] SMP
    [16076.233631] Modules linked in: fuse tun bridge hmac 8021q garp stp
    llc2 af_key llc rds xfrm_user xfrm_algo nfnetlink dccp_ipv6 sctp
    libcrc32c dccp_ipv4 dccp iptable_filter ip_tables x_tables isofs
    ata_piix autofs4
    [16076.236688] CPU: 10 PID: 10753 Comm: trinity-main Not tainted 4.9.30 #1
    [16076.238917] task: ffff880285b58000 task.stack: ffffc90108d4c000
    [16076.239741] RIP: 0010:[<ffffffff8038e616>] [<ffffffff8038e616>]
    __remove_shared_vm_struct+0x16/0x40
    [16076.241085] RSP: 0018:ffffc90108d4fd38 EFLAGS: 00010202
    [16076.241841] RAX: 0000000000000000 RBX: ffff8801568867e8 RCX:
    0000000000000000
    [16076.242807] RDX: ffff88032c7581d8 RSI: ffff88012af34a00 RDI:
    ffff8801568867e8
    [16076.243773] RBP: ffffc90108d4fd38 R08: ffff880156886b80 R09:
    00007fffcf5d4000
    [16076.244737] R10: 0000000000000000 R11: 0000000000000001 R12:
    ffff88012af34a00
    [16076.245698] R13: ffff88032c758200 R14: ffff88032c7581d8 R15:
    ffff8801568868a0
    [16076.246659] FS: 0000000000000000(0000) GS:ffff880333480000(0000)
    knlGS:0000000000000000
    [16076.247864] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [16076.248667] CR2: 0000000000000158 CR3: 0000000000c07000 CR4:
    00000000000006e0
    [16076.249634] DR0: 00007f54c4cae000 DR1: 00007ff1276c9000 DR2:
    0000000000000000
    [16076.250599] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000600
    [16076.251563] Stack:
    [16076.251942] ffffc90108d4fd68 ffffffff8038ef91 ffff8801568867e8
    0000000000400000
    [16076.253139] 0000000000000000 ffffc90108d4fdc0 ffffc90108d4fda8
    ffffffff80387893
    [16076.254335] 0000000000000000 0000000000000000 ffff8801d1126c00
    0000000000000000
    [16076.255528] Call Trace:
    [16076.255959] [<ffffffff8038ef91>] unlink_file_vma+0x41/0x60
    [16076.256746] [<ffffffff80387893>] free_pgtables+0x43/0x120
    [16076.257520] [<ffffffff80390b12>] exit_mmap+0xb2/0x150
    [16076.258258] [<ffffffff8025624b>] mmput+0x3b/0x100
    [16076.258953] [<ffffffff8025ddb5>] do_exit+0x255/0xb20
    [16076.259673] [<ffffffff802024b1>] ? syscall_trace_enter+0x1c1/0x2d0
    [16076.260538] [<ffffffff8025e703>] do_group_exit+0x43/0xb0
    [16076.261303] [<ffffffff8025e784>] SyS_exit_group+0x14/0x20
    [16076.262078] [<ffffffff80202bfe>] do_syscall_64+0x7e/0x1a0
    [16076.262852] [<ffffffff807d8f84>] entry_SYSCALL64_slow_path+0x25/0x25
    [16076.263736] Code: 3d 00 20 00 00 48 0f 47 c2 48 89 05 cd dc 95 00 31
    c0 c3 66 90 0f 1f 44 00 00 48 8b 47 50 55 48 89 e5 f6 c4 08 74 0f 48 8b
    46 20 <f0> ff 80 58 01 00 00 48 8b 47 50 a8 08 74 04 f0 ff 4a 1c 48 8d
    [16076.267481] RIP [<ffffffff8038e616>] __remove_shared_vm_struct+0x16/0x40
    [16076.268424] RSP <ffffc90108d4fd38>
    [16076.268973] CR2: 0000000000000158
    [16076.269844] ---[ end trace 98a1bbd8d9e50234 ]---
    [16076.270565] Fixing recursive fault but reboot is needed!





    [69086.066173] Out of memory: Kill process 2485 (trinity-c309) score 503
    or sacrifice child
    [69086.067383] Killed process 2485 (trinity-c309) total-vm:73816kB,
    anon-rss:7196kB, file-rss:3940kB, shmem-rss:17248kB
    [69086.071158] oom_reaper: reaped process 2485 (trinity-c309), now
    anon-rss:0kB, file-rss:0kB, shmem-rss:17248kB
    [69089.763240] scsi_nl_rcv_msg: discarding partial skb
    [69093.568099] scsi_nl_rcv_msg: discarding partial skb
    [69095.925546] BUG: unable to handle kernel NULL pointer dereference at
    0000000000000158
    [69095.926875] IP: [<ffffffff8218e7b6>] __remove_shared_vm_struct+0x16/0x40
    [69095.927836] PGD 0
    [69095.928411] Oops: 0002 [#1] SMP
    [69095.928934] Modules linked in: fuse tun 8021q xfrm_user garp
    dccp_ipv6 dccp_ipv4 dccp sctp bridge llc2 rds stp af_key llc xfrm_algo
    libcrc32c nfnetlink isofs iptable_filter ip_tables x_tables ata_piix autofs4
    [69095.931931] CPU: 5 PID: 21391 Comm: trinity-c387 Not tainted 4.9.30 #1
    [69095.934129] task: ffff88006a938000 task.stack: ffffc9007c624000
    [69095.934944] RIP: 0010:[<ffffffff8218e7b6>] [<ffffffff8218e7b6>]
    __remove_shared_vm_struct+0x16/0x40
    [69095.936276] RSP: 0018:ffffc9007c627b80 EFLAGS: 00010202
    [69095.937027] RAX: 0000000000000000 RBX: ffff8801e0be4f18 RCX:
    0000000000000000
    [69095.937982] RDX: ffff88022dc6c658 RSI: ffff88018d16c600 RDI:
    ffff8801e0be4f18
    [69095.938938] RBP: ffffc9007c627b80 R08: ffff880022c48508 R09:
    00007fff63b80000
    [69095.939893] R10: 0000000000000000 R11: 0000000000000001 R12:
    ffff88018d16c600
    [69095.940844] R13: ffff88022dc6c680 R14: ffff88022dc6c658 R15:
    ffff8801e0be4000
    [69095.941802] FS: 00007f5413555b40(0000) GS:ffff88023fd40000(0000)
    knlGS:0000000000000000
    [69095.942993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [69095.943791] CR2: 0000000000000158 CR3: 000000023f807000 CR4:
    00000000000006e0
    [69095.944747] DR0: 00007f5410a26000 DR1: 00007fa168c7d000 DR2:
    00007f3d12f06000
    [69095.945698] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000600
    [69095.946653] Stack:
    [69095.947030] ffffc9007c627bb0 ffffffff8218f131 ffff8801e0be4f18
    0000000000400000
    [69095.948221] 0000000000000000 ffffc9007c627c08 ffffc9007c627bf0
    ffffffff82187a33
    [69095.949410] 0000000000000000 0000000000000000 ffff88013e944400
    0000000000000000
    [69095.950600] Call Trace:
    [69095.951029] [<ffffffff8218f131>] unlink_file_vma+0x41/0x60
    [69095.951813] [<ffffffff82187a33>] free_pgtables+0x43/0x120
    [69095.952578] [<ffffffff82190cb2>] exit_mmap+0xb2/0x150
    [69095.953311] [<ffffffff820562eb>] mmput+0x3b/0x100
    [69095.954000] [<ffffffff8205de55>] do_exit+0x255/0xb20
    [69095.954715] [<ffffffff8205e7a3>] do_group_exit+0x43/0xb0
    [69095.955466] [<ffffffff82069f5e>] get_signal+0x29e/0x630
    [69095.956216] [<ffffffff8201a0b8>] do_signal+0x28/0x670
    [69095.956942] [<ffffffff8218a56f>] ? handle_mm_fault+0x8af/0xce0
    [69095.957756] [<ffffffff8214f0c9>] ? __perf_sw_event+0x59/0x90
    [69095.958548] [<ffffffff820fb270>] ? __audit_syscall_exit+0x230/0x2c0
    [69095.959410] [<ffffffff820022b0>] exit_to_usermode_loop+0x80/0xc0
    [69095.960243] [<ffffffff82002cc5>] do_syscall_64+0x145/0x1a0
    [69095.961023] [<ffffffff825d9fc4>] entry_SYSCALL64_slow_path+0x25/0x25
    [69095.961894] Code: 3d 00 20 00 00 48 0f 47 c2 48 89 05 6d db 95 00 31
    c0 c3 66 90 0f 1f 44 00 00 48 8b 47 50 55 48 89 e5 f6 c4 08 74 0f 48 8b
    46 20 <f0> ff 80 58 01 00 00 48 8b 47 50 a8 08 74 04 f0 ff 4a 1c 48 8d
    [69095.965626] RIP [<ffffffff8218e7b6>] __remove_shared_vm_struct+0x16/0x40
    [69095.966555] RSP <ffffc9007c627b80>
    [69095.977590] CR2: 0000000000000158
    [69095.978460] ---[ end trace fe244491d619cdbd ]---
    [69095.979178] Fixing recursive fault but reboot is needed!

    \
     
     \ /
      Last update: 2017-06-12 01:00    [W:3.179 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site