ftrace_graph_exit_task crash

Severity

Crash

Found with

perf_fuzzer

Reproducible

No.

First Seen

3.14

Found On

Haswell

Linux-kernel

31 March 2014 -- perf_fuzzer: BUG in kfree() in ftrace_graph_exit_task

Kernel Splat

  1. *** perf_fuzzer 0.28 *** by Vince Weaver                                        
                                                                                    
            Linux version 3.14.0+ x86_64                                            
            Processor: Intel 6/60/3                                                 
                                                                                    
            Seeding random number generator with 1396279266                         
            /proc/sys/kernel/perf_event_max_sample_rate currently: 12500/s          
            /proc/sys/kernel/perf_event_paranoid currently: 1                       
            Logging perf_event_open() failures: no                                  
            Running fsync after every syscall: no                                   
            Run as: ./perf_fuzzer -t OCIRMQWPFpAi -s 50000                          
                                                                                    
    Pid=28059, sleeping 1s           
    [ 5498.573458] BUG: unable to handle kernel NULL pointer dereference at 00000000
    0000006c                                                                        
    [ 5498.585181] IP: [] kfree+0x91/0x220                        
    [ 5498.593887] PGD 0                                                            
    [ 5498.599365] Oops: 0000 [#1] SMP                                              
    [ 5498.606127] Dumping ftrace buffer:                                           
    [ 5498.612973]    (ftrace buffer empty)                                         
    [ 5498.619868] Modules linked in: nfsd auth_rpcgss oid_registry nfs_acl nfs lock
    d fscache sunrpc fuse snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp c
    oretemp i915 kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drm_kms_helpe
    r snd_hda_codec_realtek tpm_tis tpm snd_hda_codec_generic aesni_intel aes_x86_64
     drm lrw mei_me mei parport_pc gf128mul iTCO_wdt iTCO_vendor_support battery vid
    eo parport i2c_algo_bit i2c_i801 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm w
    mi psmouse pcspkr i2c_core button processor serio_raw snd_seq snd_seq_device lpc
    _ich snd_timer glue_helper ablk_helper evdev cryptd snd mfd_core soundcore sg sd
    _mod sr_mod crc_t10dif cdrom crct10dif_common hid_generic usbhid hid ehci_pci ah
    ci xhci_hcd e1000e ehci_hcd libahci libata ptp crc32c_intel usbcore scsi_mod pps
    _core usb_common fan thermal thermal_sys                                        
    [ 5498.720303] CPU: 1 PID: 13 Comm: ksoftirqd/1 Tainted: G        W    3.14.0+ #
    14                                                                              
    [ 5498.731359] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2
    014                                                                             
    [ 5498.742532] task: ffff880118f4ca80 ti: ffff880118f52000 task.ti: ffff880118f5
    2000                                                                            
    [ 5498.753722] RIP: 0010:[]  [] kfree+0x91/0
    x220                                                                            
    [ 5498.764966] RSP: 0018:ffff880118f53cf0  EFLAGS: 00010046                     
    [ 5498.773911] RAX: ffffea000005b150 RBX: ffff880114fc4110 RCX: ffffffffffffffe8
    [ 5498.784831] RDX: ffffea000005b150 RSI: 0000000000000000 RDI: ffffffff81a06ba0
    [ 5498.795763] RBP: ffff880118f53d20 R08: 0000000000000000 R09: 0000000000000010
    [ 5498.806617] R10: ffffea0003ceed10 R11: ff00007ffe000000 R12: ffffffff81a06ba0
    [ 5498.817550] R13: 0000000000000286 R14: 0000000001a06ba0 R15: 0000000000000000
    [ 5498.828515] FS:  0000000000000000(0000) GS:ffff88011ea40000(0000) knlGS:00000
    00000000000                                                                     
    [ 5498.840520] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033                
    [ 5498.849929] CR2: 000000000000006c CR3: 000000000180e000 CR4: 00000000001407e0
    [ 5498.860847] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 5498.871762] DR3: 000000000072a000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
    [ 5498.882707] Stack:                                                           
    [ 5498.888160]  0000000000000001 ffff880114fc4110 ffff880114fc2940 ffff880114fc4
    930                                                                             
    [ 5498.899533]  000000000000000a ffff8801181a2820 ffff880118f53d30 ffffffff81105
    26e                                                                             
    [ 5498.910958]  ffff880118f53d48 ffffffff810620ca ffff880114fc4110 ffff880118f53
    d68                                                                             
    [ 5498.922378] Call Trace:                                                      
    [ 5498.928288]  [] ftrace_graph_exit_task+0x1e/0x20           
    [ 5498.938203]  [] free_task+0x3a/0x60                        
    [ 5498.946908]  [] __put_task_struct+0x8f/0x130               
    [ 5498.956409]  [] delayed_put_task_struct+0x78/0x80          
    [ 5498.966421]  [] rcu_process_callbacks+0x1e6/0x580          
    [ 5498.976348]  [] __do_softirq+0xf5/0x290                    
    [ 5498.985233]  [] run_ksoftirqd+0x30/0x50                    
    [ 5498.994077]  [] smpboot_thread_fn+0xff/0x1b0               
    [ 5499.003284]  [] ? SyS_setgroups+0x1a0/0x1a0                
    [ 5499.012310]  [] kthread+0xd2/0xf0                          
    [ 5499.020314]  [] ? kthread_create_on_node+0x180/0x180       
    [ 5499.030054]  [] ret_from_fork+0x7c/0xb0                    
    [ 5499.038575]  [] ? kthread_create_on_node+0x180/0x180       
    [ 5499.048264] Code: 00 48 c1 e2 06 48 29 c2 48 b8 00 00 00 00 00 ea ff ff 48 01
     c2 48 8b 02 f6 c4 80 0f 85 03 01 00 00 48 89 d0 4c 8b 78 30 4c 89 e7 <49> 63 77
     6c e8 16 42 19 00 65 8b 04 25 c4 b0 00 00 83 3d 7f b9                          
    [ 5499.076043] RIP  [] kfree+0x91/0x220                       
    [ 5499.084437]  RSP                                           
    [ 5499.090962] CR2: 000000000000006c                                            
    [ 5499.305409] ---[ end trace 9fd1de8fe3e4eea1 ]---                             
    [ 5499.313185] Kernel panic - not syncing: Fatal exception in interrupt         
    [ 5499.322890] Dumping ftrace buffer:                                           
    [ 5499.329430]    (ftrace buffer empty)                                         
    [ 5499.336136] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xf
    fffffff80000000-0xffffffff9fffffff)                                             
    [ 5499.350088] drm_kms_helper: panic occurred, switching back to text console   
    [ 5499.360490] ------------[ cut here ]------------                             
    [ 5499.368379] WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_s
    end_reschedule+0x5d/0x60()                                                      
    [ 5499.381493] Modules linked in: nfsd auth_rpcgss oid_registry nfs_acl nfs lock
    d fscache sunrpc fuse snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp c
    oretemp i915 kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel drm_kms_helpe
    r snd_hda_codec_realtek tpm_tis tpm snd_hda_codec_generic aesni_intel aes_x86_64
     drm lrw mei_me mei parport_pc gf128mul iTCO_wdt iTCO_vendor_support battery vid
    eo parport i2c_algo_bit i2c_i801 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm w
    mi psmouse pcspkr i2c_core button processor serio_raw snd_seq snd_seq_device lpc
    _ich snd_timer glue_helper ablk_helper evdev cryptd snd mfd_core soundcore sg sd
    _mod sr_mod crc_t10dif cdrom crct10dif_common hid_generic usbhid hid ehci_pci ah
    ci xhci_hcd e1000e ehci_hcd libahci libata ptp crc32c_intel usbcore scsi_mod pps
    _core usb_common fan thermal thermal_sys                                        
    [ 5499.482836] CPU: 1 PID: 13 Comm: ksoftirqd/1 Tainted: G      D W    3.14.0+ #
    14                                                                              
    [ 5499.494069] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2
    014                                                                             
    [ 5499.505369]  0000000000000009 ffff88011ea43d98 ffffffff8155a210 0000000000000
    000                                                                             
    [ 5499.516960]  ffff88011ea43dd0 ffffffff810651ad 0000000000000000 ffff88011ea14
    340                                                                             
    [ 5499.528525]  0000000000000001 0000000000000001 000000000000e288 ffff88011ea43
    de0                                                                             
    [ 5499.540031] Call Trace:                                                      
    [ 5499.546011]    [] dump_stack+0x45/0x56                
    [ 5499.555610]  [] warn_slowpath_common+0x7d/0xa0             
    [ 5499.565324]  [] warn_slowpath_null+0x1a/0x20               
    [ 5499.574798]  [] native_smp_send_reschedule+0x5d/0x60       
    [ 5499.584855]  [] trigger_load_balance+0x142/0x1b0           
    [ 5499.594543]  [] scheduler_tick+0x97/0xd0                   
    [ 5499.603446]  [] update_process_times+0x60/0x70             
    [ 5499.612886]  [] tick_sched_handle.isra.16+0x25/0x60        
    [ 5499.622822]  [] tick_sched_timer+0x41/0x60                 
    [ 5499.631807]  [] __run_hrtimer+0x83/0x1e0                   
    [ 5499.640649]  [] ? tick_sched_handle.isra.16+0x60/0x60      
    [ 5499.650677]  [] hrtimer_interrupt+0xf7/0x240               
    [ 5499.659808]  [] local_apic_timer_interrupt+0x37/0x60       
    [ 5499.669745]  [] smp_apic_timer_interrupt+0x3f/0x60         
    [ 5499.679487]  [] apic_timer_interrupt+0x6d/0x80             
    [ 5499.688859]    [] ? panic+0x196/0x1d7                 
    [ 5499.697881]  [] ? panic+0xfd/0x1d7                         
    [ 5499.706063]  [] ? console_unlock+0x1e8/0x3f0               
    [ 5499.715181]  [] oops_end+0xd3/0xe0                         
    [ 5499.723480]  [] no_context+0x27e/0x28b                     
    [ 5499.732094]  [] __bad_area_nosemaphore+0x73/0x1ca          
    [ 5499.741773]  [] bad_area_nosemaphore+0x13/0x15             
    [ 5499.751080]  [] __do_page_fault+0x91/0x520                 
    [ 5499.760053]  [] ? try_to_wake_up+0x1e6/0x290               
    [ 5499.769148]  [] ? free_one_page+0x317/0x320                
    [ 5499.778152]  [] do_page_fault+0x22/0x30                    
    [ 5499.786757]  [] page_fault+0x28/0x30                       
    [ 5499.795141]  [] ? kfree+0x91/0x220                         
    [ 5499.803349]  [] ftrace_graph_exit_task+0x1e/0x20           
    [ 5499.812773]  [] free_task+0x3a/0x60                        
    [ 5499.821011]  [] __put_task_struct+0x8f/0x130               
    [ 5499.830107]  [] delayed_put_task_struct+0x78/0x80          
    [ 5499.839681]  [] rcu_process_callbacks+0x1e6/0x580          
    [ 5499.849249]  [] __do_softirq+0xf5/0x290                    
    [ 5499.857891]  [] run_ksoftirqd+0x30/0x50                    
    [ 5499.866511]  [] smpboot_thread_fn+0xff/0x1b0               
    [ 5499.875561]  [] ? SyS_setgroups+0x1a0/0x1a0                
    [ 5499.884545]  [] kthread+0xd2/0xf0                          
    [ 5499.892585]  [] ? kthread_create_on_node+0x180/0x180       
    [ 5499.902385]  [] ret_from_fork+0x7c/0xb0                    
    [ 5499.910841]  [] ? kthread_create_on_node+0x180/0x180       
    [ 5499.920469] ---[ end trace 9fd1de8fe3e4eea2 ]---    
    

Back to perf_fuzzer bugs found