Hi all,
While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel I've stumbled on the following spew:
[ 3660.610281] BUG: unable to handle kernel NULL pointer dereference at
0000000000000028
[ 3660.612608] IP: blk_throtl_drain (block/blk-throttle.c:1639)
[ 3660.614522] PGD 43c71067 PUD 51a45067 PMD 0
[ 3660.615848] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 3660.617482] Dumping ftrace buffer:
[ 3660.618500] (ftrace buffer empty)
[ 3660.619543] Modules linked in:
[ 3660.620060] CPU: 16 PID: 794 Comm: kworker/16:1 Not tainted
3.16.0-rc3-next-20140703-sasha-00024-g2ad7668-dirty #763
[ 3660.622778] Workqueue: events kobject_delayed_cleanup
[ 3660.622778] task: ffff8803d6a43000 ti: ffff8803d6aa4000 task.ti:
ffff8803d6aa4000
[ 3660.622778] RIP: blk_throtl_drain (block/blk-throttle.c:1639)
[ 3660.622778] RSP: 0018:ffff8803d6aa7bd8 EFLAGS: 00010046
[ 3660.622778] RAX: 0000000000000000 RBX: ffff8804ae39c4e8 RCX: 0000000000000000
[ 3660.622778] RDX: 0000000000000002 RSI: ffffffffb59160a5 RDI: 0000000000000000
[ 3660.622778] RBP: ffff8803d6aa7bf8 R08: 0000000000000001 R09: 0000000000000000
[ 3660.622778] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
[ 3660.622778] R13: ffff8803d5c4ed70 R14: ffff8803d5c4e150 R15: 0000000000000800
[ 3660.622778] FS: 0000000000000000(0000) GS:ffff8803d7000000(0000)
knlGS:0000000000000000
[ 3660.622778] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 3660.622778] CR2: 0000000000000028 CR3: 000000004a2dc000 CR4: 00000000000006a0
[ 3660.622778] Stack:
[ 3660.622778] ffff8803d5c4e150 0000000000000000 ffff8803d5c4ed70
ffff8803d5c4ed60
[ 3660.622778] ffff8803d6aa7c18 ffffffffb1af40d0 0000000000000000
ffff8803d5c4e150
[ 3660.622778] ffff8803d6aa7c48 ffffffffb1acfad7 ffff8803d5c4e150
ffffffffb6d61fe0
[ 3660.622778] Call Trace:
[ 3660.622778] blkcg_drain_queue (block/blk-cgroup.c:876 (discriminator 6))
[ 3660.622778] __blk_drain_queue (block/blk-core.c:385)
[ 3660.622778] blk_queue_bypass_start (include/linux/spinlock.h:353
block/blk-core.c:454)
[ 3660.622778] blkcg_deactivate_policy (include/linux/spinlock.h:328
block/blk-cgroup.c:1058)
[ 3660.622778] blk_throtl_exit (block/blk-throttle.c:1684)
[ 3660.622778] blkcg_exit_queue (block/blk-cgroup.c:891)
[ 3660.622778] blk_release_queue (block/blk-sysfs.c:508)
[ 3660.622778] kobject_delayed_cleanup (lib/kobject.c:629 lib/kobject.c:638)
[ 3660.660168] process_one_work (kernel/workqueue.c:2070
include/linux/jump_label.h:115 include/trace/events/workqueue.h:111
kernel/workqueue.c:2075)
[ 3660.660168] ? process_one_work (include/linux/workqueue.h:185
kernel/workqueue.c:599 kernel/workqueue.c:626 kernel/workqueue.c:2063)
[ 3660.660168] worker_thread (kernel/workqueue.c:2202)
[ 3660.660168] ? process_scheduled_works (kernel/workqueue.c:2146)
[ 3660.660168] kthread (kernel/kthread.c:210)
[ 3660.660168] ? put_lock_stats.isra.12 (./arch/x86/include/asm/preempt.h:98
kernel/locking/lockdep.c:254)
[ 3660.660168] ? kthread_create_on_node (kernel/kthread.c:176)
[ 3660.660168] ret_from_fork (arch/x86/kernel/entry_64.S:349)
[ 3660.670128] ? kthread_create_on_node (kernel/kthread.c:176)
[ 3660.670128] Code: c0 0f 84 e4 00 00 00 0f 1f 80 00 00 00 00 e8 13 e4 6e ff
0f 1f 00 e8 5b f2 6e ff 48 8b 83 d0 00 00 00 31 ff 48 8b 80 80 0b 00 00 <48> 8b
70 28 e8 62 57 72 ff 48 85 c0 49 89 c4 0f 84 c6 00 00 00
All code
========
0: c0 0f 84 rorb $0x84,(%rdi)
3: e4 00 in $0x0,%al
5: 00 00 add %al,(%rax)
7: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
e: e8 13 e4 6e ff callq 0xffffffffff6ee426
13: 0f 1f 00 nopl (%rax)
16: e8 5b f2 6e ff callq 0xffffffffff6ef276
1b: 48 8b 83 d0 00 00 00 mov 0xd0(%rbx),%rax
22: 31 ff xor %edi,%edi
24: 48 8b 80 80 0b 00 00 mov 0xb80(%rax),%rax
2b:* 48 8b 70 28 mov 0x28(%rax),%rsi <-- trapping
instruction
2f: e8 62 57 72 ff callq 0xffffffffff725796
34: 48 85 c0 test %rax,%rax
37: 49 89 c4 mov %rax,%r12
3a: 0f 84 c6 00 00 00 je 0x106
...
Code starting with the faulting instruction
===========================================
0: 48 8b 70 28 mov 0x28(%rax),%rsi
4: e8 62 57 72 ff callq 0xffffffffff72576b
9: 48 85 c0 test %rax,%rax
c: 49 89 c4 mov %rax,%r12
f: 0f 84 c6 00 00 00 je 0xdb
...
[ 3660.670128] RIP blk_throtl_drain (block/blk-throttle.c:1639)
[ 3660.670128] RSP <ffff8803d6aa7bd8>
[ 3660.670128] CR2: 0000000000000028
Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
