general protection fault: 0000 [#4] SMP perf_event_context_sched_in __get_cpu_context

Severity

Crash

Found by

perf_fuzzer

First Seen

3.15-rc5

Most recently Seen

3.15-rc7

Reproducible

no

Found On

haswell

Linux-kernel Mailing List Report

25 May 2014 -- perf: perf_fuzzer gpf in __get_cpu_context()

Analysis Memory corruption (poisoned). Address maps to:
static inline struct perf_cpu_context *
__get_cpu_context(struct perf_event_context *ctx)
{
        return this_cpu_ptr(ctx->pmu->pmu_cpu_context);
}

Kernel Splat

  1. *** perf_fuzzer 0.29-pre *** by Vince Weaver
    
            Linux version 3.15.0-rc7+ x86_64
            Processor: Intel 6/60/3
    
            Seeding random number generator with 1401221795
            /proc/sys/kernel/perf_event_max_sample_rate currently: 12500/s
            /proc/sys/kernel/perf_event_paranoid currently: 1
            Logging perf_event_open() failures: no
            Running fsync after every syscall: no
            To reproduce, try: ./perf_fuzzer -t OCIRMQWPFpAi -s 50000 -r 1401221795
    Pid=29366, sleeping 1s
    ==================================================
    Fuzzing the following syscalls:
            mmap perf_event_open close read write ioctl fork prctl poll 
    *NOT* Fuzzing the following syscalls:
            
    Also attempting the following:
            busy-instruction-loop accessing-perf-proc-and-sys-files trashing-the-mma
    p-page 
    *NOT* attempting the following:
            signal-handler-on-overflow 
    ==================================================
    Iteration 10000
            Open attempts: 198209  Successful: 938
                    EPERM : 25
                    ENOENT : 1816
                    E2BIG : 23213
                    EBADF : 9153
                    EACCES : 998
                    EINVAL : 161295
                    ENOSPC : 159
                    EOPNOTSUPP : 612
                    Type (Hardware 206/26075)(software 373/29308)(tracepoint 81/29044)(Cache 62/24737)(cpu 177/28921)(breakpoint 39/29101)(uncore_imc 0/4182)(power 0/4253)(#8 0/80)(#9 0/30)(#10 0/21)(#11 0/24)(#12 0/22)(#13 0/16)(#14 0/32)(>14 0/22363)
            Close attempts: 895  Successful: 895
            Read attempts: 918  Successful: 827
            Write attempts: 910  Successful: 0
            Ioctl attempts: 906  Successful: 392
            Mmap attempts: 938  Successful: 357
            Prctl attempts: 886  Successful: 886
            Fork attempts: 449  Successful: 449
            Poll attempts: 908  Successful: 7
            Access attempts: 930  Successful: 476
            Trash mmap attempts: 926  Successful: 926
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 20000
            Open attempts: 195885  Successful: 872
                    EPERM : 30
                    ENOENT : 1788
                    E2BIG : 22726
                    EBADF : 9121
                    EACCES : 940
                    EINVAL : 159606
                    ENOSPC : 180
                    EOPNOTSUPP : 622
                    Type (Hardware 218/25943)(software 339/28765)(tracepoint 66/28662)(Cache 53/24605)(cpu 167/28683)(breakpoint 29/28740)(uncore_imc 0/4067)(power 0/4021)(#8 0/91)(#9 0/32)(#10 0/19)(#11 0/27)(#12 0/27)(#13 0/24)(#14 0/28)(>14 0/22151)
            Close attempts: 887  Successful: 887
            Read attempts: 908  Successful: 812
            Write attempts: 941  Successful: 0
            Ioctl attempts: 923  Successful: 387
            Mmap attempts: 872  Successful: 362
            Prctl attempts: 951  Successful: 951
            Fork attempts: 456  Successful: 456
            Poll attempts: 895  Successful: 2
            Access attempts: 904  Successful: 463
            Trash mmap attempts: 883  Successful: 883
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 30000
            Open attempts: 184631  Successful: 884
                    EPERM : 27
                    ENOENT : 1591
                    E2BIG : 21406
                    EBADF : 9118
                    EACCES : 898
                    EINVAL : 149987
                    ENOSPC : 164
                    EOPNOTSUPP : 556
                    Type (Hardware 216/24524)(software 343/27031)(tracepoint 83/27054)(Cache 53/23173)(cpu 165/26819)(breakpoint 24/27255)(uncore_imc 0/3926)(power 0/3808)(#8 0/92)(#9 0/20)(#10 0/28)(#11 0/17)(#12 0/33)(#13 0/20)(#14 0/19)(>14 0/20812)
            Close attempts: 874  Successful: 874
            Read attempts: 953  Successful: 853
            Write attempts: 890  Successful: 0
            Ioctl attempts: 867  Successful: 386
            Mmap attempts: 884  Successful: 398
            Prctl attempts: 930  Successful: 930
            Fork attempts: 442  Successful: 442
            Poll attempts: 950  Successful: 27
            Access attempts: 882  Successful: 432
            Trash mmap attempts: 860  Successful: 860
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 40000
            Open attempts: 187546  Successful: 878
                    EPERM : 27
                    ENOENT : 1749
                    E2BIG : 21947
                    EBADF : 8688
                    EACCES : 947
                    EINVAL : 152561
                    ENOSPC : 188
                    EOPNOTSUPP : 561
                    Type (Hardware 202/24753)(software 359/27659)(tracepoint 98/27304)(Cache 42/23539)(cpu 153/27611)(breakpoint 24/27336)(uncore_imc 0/3983)(power 0/3995)(#8 0/85)(#9 0/17)(#10 0/25)(#11 0/22)(#12 0/26)(#13 0/25)(#14 0/30)(>14 0/21136)
            Close attempts: 904  Successful: 904
            Read attempts: 886  Successful: 794
            Write attempts: 906  Successful: 0
            Ioctl attempts: 895  Successful: 403
            Mmap attempts: 878  Successful: 368
            Prctl attempts: 933  Successful: 933
            Fork attempts: 438  Successful: 438
            Poll attempts: 948  Successful: 0
            Access attempts: 898  Successful: 437
            Trash mmap attempts: 932  Successful: 932
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    [27432.633290] general protection fault: 0000 [#1] SMP 
    [27432.638663] Modules linked in: fuse x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic coretemp kvm crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw snd_hda_intel snd_hda_controller ppdev gf128mul snd_hda_codec iTCO_wdt glue_helper evdev iTCO_vendor_support i915 ablk_helper snd_hwdep snd_pcm parport_pc video mei_me processor cryptd snd_timer drm_kms_helper parport psmouse tpm_tis wmi serio_raw snd mei pcspkr soundcore battery drm tpm button i2c_i801 i2c_algo_bit lpc_ich i2c_core mfd_core sd_mod crc_t10dif sr_mod crct10dif_generic cdrom ahci libahci e1000e libata ptp ehci_pci crct10dif_pclmul crct10dif_common xhci_hcd scsi_mod crc32c_intel ehci_hcd pps_core usbcore usb_common thermal fan thermal_sys
    [27432.712246] CPU: 1 PID: 29366 Comm: perf_fuzzer Not tainted 3.15.0-rc7+ #111
    [27432.719794] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
    [27432.727697] task: ffff8800c93004d0 ti: ffff8800c8382000 task.ti: ffff8800c8382000
    [27432.735753] RIP: 0010:[]  [] __perf_event_task_sched_out+0xb0/0x3c0
    [27432.745881] RSP: 0018:ffff8800c8383c48  EFLAGS: 00010086
    [27432.751554] RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000008 RCX: 0000000000000000
    [27432.759223] RDX: 0000000000001a1a RSI: 0000000000030000 RDI: ffff8801183f5410
    [27432.766885] RBP: ffff8800c8383ca8 R08: ffff8800c9300bf0 R09: 0000000000000002
    [27432.774553] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801188dac00
    [27432.782183] R13: ffff8801183f5410 R14: ffff880118f7a490 R15: ffff8800c93004d0
    [27432.789847] FS:  00007f7613b83700(0000) GS:ffff88011ea40000(0000) knlGS:0000000000000000
    [27432.798502] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [27432.804669] CR2: 0000000001ceb000 CR3: 00000000cf9a8000 CR4: 00000000001407e0
    [27432.812295] DR0: 0000000000000000 DR1: 0000000001d56000 DR2: 00000000012a0000
    [27432.819933] DR3: 00000000012a0000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
    [27432.827508] Stack:
    [27432.829692]  ffffffff811378ff 0000000000000000 0000000000000000 0000000000000000
    [27432.837715]  0000000000000000 0000000000000001 ffff88011ea58220 ffff8800c93004d0
    [27432.845735]  ffff880118f7a490 ffffffff8180de60 0000000000000001 ffff8800c93004d0
    [27432.853787] Call Trace:
    [27432.856390]  [] ? __perf_event_task_sched_out+0xcf/0x3c0
    [27432.863797]  [] perf_event_task_sched_out+0x93/0xa0
    [27432.870678]  [] ? __schedule+0x183/0x760
    [27432.876568]  [] __schedule+0x183/0x760
    [27432.882283]  [] _cond_resched+0x29/0x40
    [27432.888084]  [] mutex_lock_nested+0x2e/0x360
    [27432.894344]  [] ? __mutex_init+0x56/0x60
    [27432.900222]  [] ? __perf_event_init_context+0x3b/0x90
    [27432.907314]  [] find_get_context+0x79/0x1f0
    [27432.913492]  [] SYSC_perf_event_open+0x486/0xb00
    [27432.920112]  [] SyS_perf_event_open+0xe/0x10
    [27432.926348]  [] system_call_fastpath+0x1a/0x1f
    [27432.932769] Code: c9 4c 89 ff be 01 00 00 00 e8 cd f1 ff ff 48 83 c4 38 5b 41 5c 41 5d 41 5e 41 5f 5d c3 66 0f 1f 44 00 00 31 c0 eb d5 49 8b 04 24 <48> 8b 40 38 65 48 03 04 25 e8 de 00 00 48 83 b8 70 01 00 00 00 
    [27432.954225] RIP  [] __perf_event_task_sched_out+0xb0/0x3c0
    [27432.961798]  RSP 
    [27432.989643] ---[ end trace cf67c79a3cc6af1b ]---
    
  2. Seriously locked the machine, the ethernet switch, and also some ext4 filesystem corruption.
    *** perf_fuzzer 0.29-pre *** by Vince Weaver
    
            Linux version 3.15.0-rc5+ x86_64
            Processor: Intel 6/60/3
    
            Seeding random number generator with 1400458041
            /proc/sys/kernel/perf_event_max_sample_rate currently: 250/s
            /proc/sys/kernel/perf_event_paranoid currently: 1
            Logging perf_event_open() failures: no
            Running fsync after every syscall: no
            To reproduce, try: ./perf_fuzzer -t OCIRMQWPFpAi -s 50000 -r 1400458041
    
    Pid=24718, sleeping 1s
    ==================================================
    Fuzzing the following syscalls:
            mmap perf_event_open close read write ioctl fork prctl poll 
    *NOT* Fuzzing the following syscalls:
            
    Also attempting the following:
            busy-instruction-loop accessing-perf-proc-and-sys-files trashing-the-mmap-page 
    *NOT* attempting the following:
            signal-handler-on-overflow 
    ==================================================
    Iteration 10000
            Open attempts: 193102  Successful: 897
                    EPERM : 20
                    ENOENT : 1741
                    E2BIG : 22290
                    EBADF : 9220
                    EACCES : 924
                    EINVAL : 157157
                    ENOSPC : 257
                    EOPNOTSUPP : 596
                    Type (Hardware 207/25354)(software 371/28434)(tracepoint 78/28541)(Cache 44/24180)(cpu 172/28277)(breakpoint 25/28287)(uncore_imc 0/4047)(power 0/4096)(#8 0/90)(#9 0/26)(#10 0/30)(#11 0/25)(#12 0/20)(#13 0/18)(#14 0/20)(>14 0/21657)
            Close attempts: 877  Successful: 877
            Read attempts: 900  Successful: 796
            Write attempts: 820  Successful: 0
            Ioctl attempts: 895  Successful: 397
            Mmap attempts: 897  Successful: 386
            Prctl attempts: 929  Successful: 929
            Fork attempts: 464  Successful: 464
            Poll attempts: 906  Successful: 0
            Access attempts: 886  Successful: 447
            Trash mmap attempts: 900  Successful: 900
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 20000
            Open attempts: 184804  Successful: 899
                    EPERM : 15
                    ENOENT : 1635
                    E2BIG : 21520
                    EBADF : 8701
                    EACCES : 845
                    EINVAL : 150414
                    ENOSPC : 247
                    EOPNOTSUPP : 528
                    Type (Hardware 218/24529)(software 375/27484)(tracepoint 60/26798)(Cache 51/23238)(cpu 169/26707)(breakpoint 26/27219)(uncore_imc 0/3931)(power 0/4046)(#8 0/87)(#9 0/29)(#10 0/33)(#11 0/15)(#12 0/36)(#13 0/20)(#14 0/12)(>14 0/20620)
            Close attempts: 881  Successful: 881
            Read attempts: 886  Successful: 794
            Write attempts: 884  Successful: 0
            Ioctl attempts: 923  Successful: 415
            Mmap attempts: 899  Successful: 392
            Prctl attempts: 927  Successful: 927
            Fork attempts: 467  Successful: 467
            Poll attempts: 886  Successful: 0
            Access attempts: 893  Successful: 451
            Trash mmap attempts: 945  Successful: 945
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 30000
            Open attempts: 188665  Successful: 865
                    EPERM : 24
                    ENOENT : 1731
                    E2BIG : 21980
                    EBADF : 8807
                    EACCES : 934
                    EINVAL : 153511
                    ENOSPC : 246
                    EOPNOTSUPP : 567
                    Type (Hardware 192/25115)(software 339/27581)(tracepoint 81/27848)(Cache 54/23502)(cpu 176/27668)(breakpoint 23/27682)(uncore_imc 0/3927)(power 0/3892)(#8 0/89)(#9 0/34)(#10 0/31)(#11 0/17)(#12 0/25)(#13 0/22)(#14 0/20)(>14 0/21212)
            Close attempts: 870  Successful: 870
            Read attempts: 913  Successful: 834
            Write attempts: 937  Successful: 0
            Ioctl attempts: 939  Successful: 412
            Mmap attempts: 865  Successful: 336
            Prctl attempts: 926  Successful: 926
            Fork attempts: 460  Successful: 460
            Poll attempts: 908  Successful: 0
            Access attempts: 904  Successful: 451
            Trash mmap attempts: 896  Successful: 896
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    Iteration 40000
            Open attempts: 202041  Successful: 927
                    EPERM : 21
                    ENOENT : 1755
                    E2BIG : 23610
                    EBADF : 9926
                    EACCES : 980
                    EINVAL : 163923
                    ENOSPC : 291
                    EOPNOTSUPP : 608
                    Type (Hardware 205/26758)(software 404/29677)(tracepoint 76/29763)(Cache 62/25414)(cpu 159/29524)(breakpoint 21/29507)(uncore_imc 0/4210)(power 0/4145)(#8 0/87)(#9 0/30)(#10 0/29)(#11 0/25)(#12 0/31)(#13 0/24)(#14 0/15)(>14 0/22802)
            Close attempts: 957  Successful: 957
            Read attempts: 886  Successful: 797
            Write attempts: 918  Successful: 0
            Ioctl attempts: 910  Successful: 415
            Mmap attempts: 927  Successful: 383
            Prctl attempts: 904  Successful: 904
            Fork attempts: 439  Successful: 439
            Poll attempts: 880  Successful: 0
            Access attempts: 874  Successful: 462
            Trash mmap attempts: 894  Successful: 894
            Overflows: 0
            SIGIOs due to RT signal queue full: 0
    [186097.858397] general protection fault: 0000 [#4] SMP 
    [186097.865775] Dumping ftrace buffer:
    [186097.871373]    (ftrace buffer empty)
    [186097.877101] Modules linked in: fuse x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_codec_realtek kvm snd_hda_codec_hdmi snd_hda_codec_generic crc32_pclmul snd_hda_intel ghash_clmulni_intel aesni_intel snd_hda_controller aes_x86_64 snd_hda_codec i915 snd_hwdep iTCO_wdt lrw snd_pcm gf128mul drm_kms_helper glue_helper snd_timer iTCO_vendor_support ppdev evdev drm wmi battery parport_pc mei_me tpm_tis parport ablk_helper button i2c_algo_bit processor video i2c_i801 psmouse i2c_core snd pcspkr serio_raw cryptd soundcore tpm lpc_ich mfd_core mei sd_mod crc_t10dif sr_mod crct10dif_generic cdrom ehci_pci ehci_hcd xhci_hcd ahci e1000e libahci libata crct10dif_pclmul crct10dif_common ptp usbcore crc32c_intel scsi_mod pps_core usb_common fan thermal thermal_sys
    [186097.956794] CPU: 2 PID: 24718 Comm: perf_fuzzer Tainted: G      D W     3.15.0-rc5+ #108
    [186097.966857] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
    [186097.976293] task: ffff8800c7178710 ti: ffff8800ce162000 task.ti: ffff8800ce162000
    [186097.985551] RIP: 0010:[]  [] perf_event_context_sched_in+0x16/0xd0
    [186097.997003] RSP: 0018:ffff8800ce163b78  EFLAGS: 00010086
    [186098.004075] RAX: 6b6b6b6b6b6b6b6b RBX: ffff880036e80c00 RCX: 000000000000038f
    [186098.013062] RDX: 00000000000064e8 RSI: ffff8800c7178710 RDI: ffff880036e80c00
    [186098.021933] RBP: ffff8800ce163b98 R08: 0000000000000000 R09: 0000000000000000
    [186098.030914] R10: 0000000000000000 R11: 0000000225c17d03 R12: ffff8801188ae2d0
    [186098.039922] R13: ffff88011801a580 R14: 0000000000000000 R15: ffff8801188ae2d0
    [186098.048832] FS:  00007f53f0b0a700(0000) GS:ffff88011ea80000(0000) knlGS:0000000000000000
    [186098.058768] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [186098.066133] CR2: 00007fffd2aceb38 CR3: 00000000ce345000 CR4: 00000000001407e0
    [186098.074990] DR0: 0000000000000000 DR1: 0000000001b15000 DR2: 00000000007f9000
    [186098.083823] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
    [186098.092612] Stack:
    [186098.095884]  ffff8800c7178710 ffff8801188ae2d0 ffff88011801a580 0000000000000000
    [186098.104977]  ffff8800ce163be0 ffffffff81137253 ffff8800ce163c20 ffffffff810a4616
    [186098.114095]  ffff88011ea94f40 ffff8801188ae2d0 ffff88011801a580 0000000000000000
    [186098.123171] Call Trace:
    [186098.126793]  [] __perf_event_task_sched_in+0x1d3/0x1f0
    [186098.134967]  [] ? pick_next_task_fair+0x4c6/0x840
    [186098.142633]  [] finish_task_switch+0xd8/0x120
    [186098.149937]  [] __schedule+0x2c0/0x740
    [186098.156551]  [] schedule+0x29/0x70
    [186098.162793]  [] schedule_timeout+0x1b9/0x230
    [186098.169940]  [] ? wait_for_completion+0x28/0x100
    [186098.177449]  [] wait_for_completion+0xc4/0x100
    [186098.184801]  [] ? wake_up_state+0x20/0x20
    [186098.191705]  [] ? call_rcu_bh+0x20/0x20
    [186098.198423]  [] wait_rcu_gp+0x5a/0x70
    [186098.204904]  [] ? ftrace_raw_output_rcu_utilization+0x50/0x50
    [186098.213626]  [] ? ftrace_event_reg+0x4a/0xf0
    [186098.220812]  [] synchronize_sched+0x3a/0x50
    [186098.227867]  [] perf_trace_event_unreg.isra.1+0x3b/0x90
    [186098.236016]  [] perf_trace_destroy+0x38/0x50
    [186098.243167]  [] tp_perf_event_destroy+0xe/0x10
    [186098.250497]  [] __free_event+0x28/0x60
    [186098.257087]  [] SYSC_perf_event_open+0x8c8/0xb90
    [186098.264584]  [] ? __fput+0x17a/0x1e0
    [186098.270996]  [] SyS_perf_event_open+0xe/0x10
    [186098.278135]  [] system_call_fastpath+0x1a/0x1f
    [186098.285439] Code: 48 89 e5 e8 fd fd ff ff 31 c0 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 48 8b 07 48 89 fb <4c> 8b 60 38 65 4c 03 24 25 e8 de 00 00 49 39 bc 24 70 01 00 00 
    [186098.307822] RIP  [] perf_event_context_sched_in+0x16/0xd0
    [186098.316202]  RSP 
    [186098.344547] ---[ end trace 4d7b668c63a63e5f ]---
    
    

Back to perf_fuzzer bugs found