From: bugzilla-daemon@kernel.org
To: linux-xfs@vger.kernel.org
Subject: [Bug 216073] [s390x] kernel BUG at mm/usercopy.c:101! usercopy: Kernel memory exposure attempt detected from vmalloc 'n o area' (offset 0, size 1)!
Date: Sun, 12 Jun 2022 04:42:44 +0000 [thread overview]
Message-ID: <bug-216073-201763-JT2h3tfux9@https.bugzilla.kernel.org/> (raw)
In-Reply-To: <bug-216073-201763@https.bugzilla.kernel.org/>
https://bugzilla.kernel.org/show_bug.cgi?id=216073
--- Comment #10 from Zorro Lang (zlang@redhat.com) ---
On Wed, Jun 08, 2022 at 09:13:12PM +0200, Alexander Gordeev wrote:
> On Wed, Jun 08, 2022 at 10:19:22AM +0800, Zorro Lang wrote:
> > One of the test environment details as [1]. The xfstests config as [2].
> > It's easier to reproduce on 64k directory size xfs by running xfstests
> > auto group.
>
>
> Thanks for the details, Zorro!
>
> Do you create test and scratch device with xfs_io, as README suggests?
> If yes, what are sizes of the files?
> Also, do you run always xfs/auto or xfs/294 hits for you reliably?
Looks likt it's not a s390x specific bug, I just hit this issue once (not 100%
reproducible) on aarch64 with linux v5.19.0-rc1+ [1]. So back to cc linux-mm
to get more review.
Thanks,
Zorro
[1]
[ 980.200947] usercopy: Kernel memory exposure attempt detected from vmalloc
'no area' (offset 0, size 1)!
[ 980.200968] ------------[ cut here ]------------
[ 980.200969] kernel BUG at mm/usercopy.c:101!
[ 980.201081] Internal error: Oops - BUG: 0 [#1] SMP
[ 980.224192] Modules linked in: rfkill arm_spe_pmu mlx5_ib ast
drm_vram_helper drm_ttm_helper ttm ib_uverbs acpi_ipmi drm_kms_helper ipmi_ssif
fb_sys_fops syscopyarea sysfillrect ib_core sysimgblt arm_cmn arm_dmc620_pmu
arm_dsu_pmu cppc_cpufreq sunrpc vfat fat drm fuse xfs libcrc32c mlx5_core
crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce sbsa_gwdt nvme igb mlxfw
nvme_core tls i2c_algo_bit psample pci_hyperv_intf i2c_designware_platform
i2c_designware_core xgene_hwmon ipmi_devintf ipmi_msghandler
[ 980.268449] CPU: 42 PID: 121940 Comm: rm Kdump: loaded Not tainted
5.19.0-rc1+ #1
[ 980.275921] Hardware name: GIGABYTE R272-P30-JG/MP32-AR0-JG, BIOS F16f (SCP:
1.06.20210615) 07/01/2021
[ 980.285214] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 980.292165] pc : usercopy_abort+0x78/0x7c
[ 980.296167] lr : usercopy_abort+0x78/0x7c
[ 980.300166] sp : ffff80002b007730
[ 980.303469] x29: ffff80002b007740 x28: ffff80002b007cc0 x27:
ffffdc5683ecc880
[ 980.310595] x26: 1ffff00005600f9b x25: ffffdc5681c90000 x24:
ffff80002b007cdc
[ 980.317722] x23: ffff800041a0004a x22: 0000000000000001 x21:
0000000000000001
[ 980.324848] x20: 0000000000000000 x19: ffff800041a00049 x18:
0000000000000000
[ 980.331974] x17: 2720636f6c6c616d x16: 76206d6f72662064 x15:
6574636574656420
[ 980.339101] x14: 74706d6574746120 x13: 21293120657a6973 x12:
ffff6106cbc4c03f
[ 980.346227] x11: 1fffe106cbc4c03e x10: ffff6106cbc4c03e x9 :
ffffdc5681f36e30
[ 980.353353] x8 : ffff08365e2601f7 x7 : 0000000000000001 x6 :
ffff6106cbc4c03e
[ 980.360480] x5 : ffff08365e2601f0 x4 : 1fffe10044b11801 x3 :
0000000000000000
[ 980.367606] x2 : 0000000000000000 x1 : ffff08022588c000 x0 :
000000000000005c
[ 980.374733] Call trace:
[ 980.377167] usercopy_abort+0x78/0x7c
[ 980.380819] check_heap_object+0x3dc/0x3e0
[ 980.384907] __check_object_size.part.0+0x6c/0x1f0
[ 980.389688] __check_object_size+0x24/0x30
[ 980.393774] filldir64+0x548/0x84c
[ 980.397165] xfs_dir2_block_getdents+0x404/0x960 [xfs]
[ 980.402437] xfs_readdir+0x3c4/0x4b0 [xfs]
[ 980.406652] xfs_file_readdir+0x6c/0xa0 [xfs]
[ 980.411127] iterate_dir+0x3a4/0x500
[ 980.414691] __do_sys_getdents64+0xb0/0x230
[ 980.418863] __arm64_sys_getdents64+0x70/0xa0
[ 980.423209] invoke_syscall.constprop.0+0xd8/0x1d0
[ 980.427991] el0_svc_common.constprop.0+0x224/0x2bc
[ 980.432858] do_el0_svc+0x4c/0x90
[ 980.436163] el0_svc+0x5c/0x140
[ 980.439294] el0t_64_sync_handler+0xb4/0x130
[ 980.443553] el0t_64_sync+0x174/0x178
[ 980.447206] Code: f90003e3 aa0003e3 91098100 97ffe24b (d4210000)
[ 980.453292] SMP: stopping secondary CPUs
[ 980.458162] Starting crashdump kernel...
[ 980.462073] Bye!
>
> Thanks!
>
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are watching someone on the CC list of the bug.
next prev parent reply other threads:[~2022-06-12 4:42 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-216073-201763@https.bugzilla.kernel.org/>
2022-06-05 1:01 ` [Bug 216073] [s390x] kernel BUG at mm/usercopy.c:101! usercopy: Kernel memory exposure attempt detected from vmalloc 'n o area' (offset 0, size 1)! bugzilla-daemon
2022-06-05 5:32 ` bugzilla-daemon
2022-06-06 22:13 ` bugzilla-daemon
2022-06-07 15:05 ` bugzilla-daemon
2022-06-08 2:19 ` bugzilla-daemon
2022-06-08 19:13 ` bugzilla-daemon
2022-06-09 2:49 ` bugzilla-daemon
2022-06-11 10:19 ` bugzilla-daemon
2022-06-11 20:26 ` bugzilla-daemon
2022-06-12 4:42 ` bugzilla-daemon [this message]
2022-06-12 11:59 ` bugzilla-daemon
2022-06-12 13:03 ` bugzilla-daemon
2022-06-12 17:26 ` bugzilla-daemon
2022-06-12 18:00 ` bugzilla-daemon
2022-06-12 18:05 ` bugzilla-daemon
2022-06-12 18:44 ` bugzilla-daemon
2022-06-12 19:07 ` bugzilla-daemon
2022-06-12 19:52 ` bugzilla-daemon
2022-06-12 20:53 ` bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-216073-201763-JT2h3tfux9@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@kernel.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.