Re: perf_fuzzer compiled for x32 causes reboot

[Vince Weaver <vincent.weaver@maine.edu>]

On Fri, 21 Feb 2014, Vince Weaver wrote:

> On Fri, 21 Feb 2014, Vince Weaver wrote:
> 
> > So I'm not sure who exactly to report this to.  Some perf people CC'd as
> > I trigger it while using the perf_fuzzer.
> > 
> > This is with 3.14-rc3 on a core2 machine, although I've had the reboots 
> > happen throughout at least 3.14-rc*
> > 
> > I'm having a hard time coming up with a reproducible test case.  Using the 
> > random seed that caused the below will cause the perf_fuzzer to segfault 
> > but not reboot.
> > 
> > The log isn't very helpful, it reboots so fast that the oops doesn't 
> > finish printing and the serial log just moves to the bootloader...
> > 
> > [ 4466.804123] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
> > [ 4466.808014] IP: [<ffffffff81111783>] cache_reap+0x5e/0x1c5
> > [ 4466.808014] PGD 0 
> > [ 4466.808014] Oops: 0000 [#1] GNU GRUB  version 2.00-17
> 
> Maybe related, this is on an x32-compiled binary.
> 
> When trying to reproduce the perf_fuzzer myseriously segfaults on what 
> appears to be perfectly valid mmap'd perf ring-buffers.
> 
> (running under gdb)
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0041efbb in __memset_sse2 ()
> 
> => 0x0041efbb <+2203>:  movdqa %xmm0,(%rdi)
> 
> rdi            0xf7f61000       4160098304
> 
> f7f61000-f7f72000 rw-s 00000000 00:08 4475  anon_inode:[perf_event]
> 
> So I'm not sure if somehow something is wrong with the page mapping, that 
> makes a valid write fail and sometimes (possibly due to address space 
> randomization) reboot the system?

also strange, when I look at the core dumps it always shows the bad memory
address happening at the beginning of an mmap page as expected for the
ip listed, but the segfault listed in the kernel happens at some 
completely unrelated address that isn't even page aligned and shouldn't be 
possible based on the gdb/coredump results?

[ 1560.313863] perf_fuzzer[2826]: segfault at 503283ff ip 000000000041efbb 
sp 00000000ffd367d8 error 6 in perf_fuzzer[400000+d1000]
[ 1704.673245] perf_fuzzer[2835]: segfault at 503283ff ip 000000000041efbb 
sp 00000000ff972be8 error 6 in perf_fuzzer[400000+d1000]
[ 2978.101276] perf_fuzzer[2841]: segfault at 503283ff ip 000000000041efbb 
sp 00000000ff92ba68 error 6 in perf_fuzzer[400000+d1000]
[ 4907.185366] perf_fuzzer[2868]: segfault at 503283ff ip 000000000041efbb 
sp 00000000ffadcd28 error 6 in perf_fuzzer[400000+d1000]
[ 9570.793746] perf_fuzzer[6183]: segfault at 4d0bf28e ip 000000000041efbb 
sp 00000000ff83f688 error 6 in perf_fuzzer[400000+d1000]
[ 9743.888431] perf_fuzzer[6187]: segfault at 91734d5 ip 000000000041efbb 
sp 00000000ffb4e288 error 6 in perf_fuzzer[400000+d1000]

Vince