From: Qian Cai <cai@lca.pw>
To: Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>
Cc: kasan-dev@googlegroups.com,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
Linux-MM <linux-mm@kvack.org>
Subject: CONFIG_KASAN_SW_TAGS=y NULL pointer dereference at freelist_dereference()
Date: Wed, 6 Feb 2019 23:04:49 -0500 [thread overview]
Message-ID: <b1d210ae-3fc9-c77a-4010-40fb74a61727@lca.pw> (raw)
The kernel was compiled by clang-7.0.1 on a ThunderX2 server, and it fails to
boot. CONFIG_KASAN_GENERIC=y works fine.
deactivate_slab+0x84/0x6ac:
freelist_dereference at mm/slub.c:262
(inlined by) get_freepointer at mm/slub.c:268
(inlined by) deactivate_slab at mm/slub.c:2056
/* Returns the freelist pointer recorded at location ptr_addr. */
static inline void *freelist_dereference(const struct kmem_cache *s,
void *ptr_addr)
{
return freelist_ptr(s, (void *)*(unsigned long *)(ptr_addr),
(unsigned long)ptr_addr);
}
[ 0.000000] Memory: 3259968K/100594752K available (15548K kernel code, 12360K
rwdata, 4096K rodata, 25536K init, 27244K bss, 7444672K reserved, 0K cma-reserved)
[ 0.000000] Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000078
[ 0.000000] Mem abort info:
[ 0.000000] ESR = 0x96000005
[ 0.000000] Exception class = DABT (current EL), IL = 32 bits
[ 0.000000] SET = 0, FnV = 0
[ 0.000000] EA = 0, S1PTW = 0
[ 0.000000] Data abort info:
[ 0.000000] ISV = 0, ISS = 0x00000005
[ 0.000000] CM = 0, WnR = 0
[ 0.000000] [0000000000000078] user address but active_mm is swapper
[ 0.000000] Internal error: Oops: 96000005 [#1] SMP
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc5+ #6
[ 0.000000] pstate: 60000089 (nZCv daIf -PAN -UAO)
[ 0.000000] pc : deactivate_slab+0x84/0x6ac
[ 0.000000] lr : deactivate_slab+0x1cc/0x6ac
[ 0.000000] sp : ffff100012cf7be0
[ 0.000000] x29: ffff100012cf7cc0 x28: ffff1000114e4f00
[ 0.000000] x27: ffff1000114e4f20 x26: ffff1000114e4f08
[ 0.000000] x25: ffff1000114e5078 x24: fb00000000000000
[ 0.000000] x23: ffff7fe002080008 x22: ffff808abb5b72d0
[ 0.000000] x21: ffff7fe002080020 x20: ffff7fe002080028
[ 0.000000] x19: ffff7fe002080000 x18: ffff1000148a5538
[ 0.000000] x17: 000000000000001b x16: 0000000000000000
[ 0.000000] x15: 007ffffffc000201 x14: 04ff80082000fa80
[ 0.000000] x13: 0000000080660002 x12: 0000000080660003
[ 0.000000] x11: 4582a03bdc147ab9 x10: ffff100012d31c90
[ 0.000000] x9 : fb00000000000078 x8 : ffff100012d31c80
[ 0.000000] x7 : cccccccccccccccc x6 : ffff1000105d8db8
[ 0.000000] x5 : 0000000000000000 x4 : 0000000000000000
[ 0.000000] x3 : ffff808abb5b72d0 x2 : 04ff800820000580
[ 0.000000] x1 : ffff7fe002080000 x0 : ffff1000114e4f00
[ 0.000000] Process swapper (pid: 0, stack limit = 0x(____ptrval____))
[ 0.000000] Call trace:
[ 0.000000] deactivate_slab+0x84/0x6ac
[ 0.000000] ___slab_alloc+0x648/0x6fc
[ 0.000000] kmem_cache_alloc_node+0x408/0x538
[ 0.000000] __kmem_cache_create+0x20c/0x6a8
[ 0.000000] create_boot_cache+0x68/0xac
[ 0.000000] kmem_cache_init+0xb0/0x19c
[ 0.000000] start_kernel+0x4b4/0xac4
[ 0.000000] Code: 14000057 b9400369 f940032b 8b090309 (f940012a)
[ 0.000000] ---[ end trace 54ad7e55e4749a96 ]---
[ 0.000000] Kernel panic - not syncing: Fatal exception
[ 0.000000] ---[ end Kernel panic - not syncing: Fatal exception ]---
next reply other threads:[~2019-02-07 4:04 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-07 4:04 Qian Cai [this message]
2019-02-07 12:58 ` Andrey Konovalov
2019-02-07 13:27 ` Qian Cai
2019-02-07 15:34 ` Andrey Konovalov
2019-02-08 0:30 ` Qian Cai
2019-02-08 4:16 ` CONFIG_KASAN_SW_TAGS=y not play well with kmemleak Qian Cai
2019-02-08 17:15 ` Andrey Konovalov
2019-02-09 2:17 ` Qian Cai
2019-02-11 12:15 ` Catalin Marinas
2019-02-11 18:52 ` Andrey Konovalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b1d210ae-3fc9-c77a-4010-40fb74a61727@lca.pw \
--to=cai@lca.pw \
--cc=aryabinin@virtuozzo.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox