Re: CONFIG_KASAN_SW_TAGS=y NULL pointer dereference at freelist_dereference()

[Andrey Konovalov <andreyknvl@google.com>]

On Thu, Feb 7, 2019 at 5:04 AM Qian Cai <cai@lca.pw> wrote:
>
> The kernel was compiled by clang-7.0.1 on a ThunderX2 server, and it fails to
> boot. CONFIG_KASAN_GENERIC=y works fine.

Hi Qian,

Could you share the kernel commit id and .config that you use?

Thanks!

>
> deactivate_slab+0x84/0x6ac:
> freelist_dereference at mm/slub.c:262
> (inlined by) get_freepointer at mm/slub.c:268
> (inlined by) deactivate_slab at mm/slub.c:2056
>
> /* Returns the freelist pointer recorded at location ptr_addr. */
> static inline void *freelist_dereference(const struct kmem_cache *s,
>                                          void *ptr_addr)
> {
>         return freelist_ptr(s, (void *)*(unsigned long *)(ptr_addr),
>                             (unsigned long)ptr_addr);
> }
>
> [    0.000000] Memory: 3259968K/100594752K available (15548K kernel code, 12360K
> rwdata, 4096K rodata, 25536K init, 27244K bss, 7444672K reserved, 0K cma-reserved)
> [    0.000000] Unable to handle kernel NULL pointer dereference at virtual
> address 0000000000000078
> [    0.000000] Mem abort info:
> [    0.000000]   ESR = 0x96000005
> [    0.000000]   Exception class = DABT (current EL), IL = 32 bits
> [    0.000000]   SET = 0, FnV = 0
> [    0.000000]   EA = 0, S1PTW = 0
> [    0.000000] Data abort info:
> [    0.000000]   ISV = 0, ISS = 0x00000005
> [    0.000000]   CM = 0, WnR = 0
> [    0.000000] [0000000000000078] user address but active_mm is swapper
> [    0.000000] Internal error: Oops: 96000005 [#1] SMP
> [    0.000000] Modules linked in:
> [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc5+ #6
> [    0.000000] pstate: 60000089 (nZCv daIf -PAN -UAO)
> [    0.000000] pc : deactivate_slab+0x84/0x6ac
> [    0.000000] lr : deactivate_slab+0x1cc/0x6ac
> [    0.000000] sp : ffff100012cf7be0
> [    0.000000] x29: ffff100012cf7cc0 x28: ffff1000114e4f00
> [    0.000000] x27: ffff1000114e4f20 x26: ffff1000114e4f08
> [    0.000000] x25: ffff1000114e5078 x24: fb00000000000000
> [    0.000000] x23: ffff7fe002080008 x22: ffff808abb5b72d0
> [    0.000000] x21: ffff7fe002080020 x20: ffff7fe002080028
> [    0.000000] x19: ffff7fe002080000 x18: ffff1000148a5538
> [    0.000000] x17: 000000000000001b x16: 0000000000000000
> [    0.000000] x15: 007ffffffc000201 x14: 04ff80082000fa80
> [    0.000000] x13: 0000000080660002 x12: 0000000080660003
> [    0.000000] x11: 4582a03bdc147ab9 x10: ffff100012d31c90
> [    0.000000] x9 : fb00000000000078 x8 : ffff100012d31c80
> [    0.000000] x7 : cccccccccccccccc x6 : ffff1000105d8db8
> [    0.000000] x5 : 0000000000000000 x4 : 0000000000000000
> [    0.000000] x3 : ffff808abb5b72d0 x2 : 04ff800820000580
> [    0.000000] x1 : ffff7fe002080000 x0 : ffff1000114e4f00
> [    0.000000] Process swapper (pid: 0, stack limit = 0x(____ptrval____))
> [    0.000000] Call trace:
> [    0.000000]  deactivate_slab+0x84/0x6ac
> [    0.000000]  ___slab_alloc+0x648/0x6fc
> [    0.000000]  kmem_cache_alloc_node+0x408/0x538
> [    0.000000]  __kmem_cache_create+0x20c/0x6a8
> [    0.000000]  create_boot_cache+0x68/0xac
> [    0.000000]  kmem_cache_init+0xb0/0x19c
> [    0.000000]  start_kernel+0x4b4/0xac4
> [    0.000000] Code: 14000057 b9400369 f940032b 8b090309 (f940012a)
> [    0.000000] ---[ end trace 54ad7e55e4749a96 ]---
> [    0.000000] Kernel panic - not syncing: Fatal exception
> [    0.000000] ---[ end Kernel panic - not syncing: Fatal exception ]---
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com.
> To post to this group, send email to kasan-dev@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/b1d210ae-3fc9-c77a-4010-40fb74a61727%40lca.pw.
> For more options, visit https://groups.google.com/d/optout.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel