403 Star 1.4K Fork 1.3K

GVPopenEuler / kernel

 / 详情

【OLK-5.10】[Syzkaller] general protection fault in reweight_entity

已完成
任务 成员
创建于  
2022-04-20 10:34
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
CPU: 3 PID: 25649 Comm: syz-executor.6 Not tainted 5.10 #12
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:__read_once_size include/linux/compiler.h:207 [inline]
RIP: 0010:dequeue_load_avg kernel/sched/fair.c:2890 [inline]
RIP: 0010:reweight_entity+0x9b/0xc90 kernel/sched/fair.c:2914
Code: 03 80 3c 02 00 0f 85 90 0a 00 00 4c 8d 85 a0 00 00 00 4c 8b b3 a0 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 c2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 08 00 00 48 8b 85 a0 00 00 00 ba 00 00 00 00
RSP: 0018:ffff888131207d50 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: ffff8881311fdf00 RCX: ffff8881311fe0a0
RDX: 0000000000000014 RSI: ffff8881311fdf00 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00000000000000a0 R09: ffff8881311fdf40
R10: ffff8881311fdf10 R11: ffff8881311fe0a8 R12: 0000000000003c00
R13: 0000000000003c00 R14: 0000000000000334 R15: ffff8881311fdee8
FS: 00007f0873a30700(0000) GS:ffff8883e2f80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0873a306d0 CR3: 0000000118a86005 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 reweight_task+0xbe/0x1e0 kernel/sched/fair.c:2943
 set_user_nice+0x1d8/0x710 kernel/sched/core.c:3985
 set_one_prio+0x1dd/0x250 kernel/sys.c:188
 __do_sys_setpriority+0x262/0x710 kernel/sys.c:229
 do_syscall_64+0xc7/0x280 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x46bb29
Code: 5d db fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b db fa ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f0873a2fc48 EFLAGS: 00000246 ORIG_RAX: 000000000000008d
RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 000000000046bb29
RDX: 0000000000000097 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 000000000077bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff7f1e7bff R14: 00007f0873a309c0 R15: 00007fff7f1e7d90
Modules linked in:
---[ end trace 11b56ac78d31a2b7 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:207 [inline]
RIP: 0010:dequeue_load_avg kernel/sched/fair.c:2890 [inline]
RIP: 0010:reweight_entity+0x9b/0xc90 kernel/sched/fair.c:2914
Code: 03 80 3c 02 00 0f 85 90 0a 00 00 4c 8d 85 a0 00 00 00 4c 8b b3 a0 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 c2 48 c1 ea 03 <80> 3c 02 00 0f 85 76 08 00 00 48 8b 85 a0 00 00 00 ba 00 00 00 00
RSP: 0018:ffff888131207d50 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: ffff8881311fdf00 RCX: ffff8881311fe0a0
RDX: 0000000000000014 RSI: ffff8881311fdf00 RDI: 0000000000000000
RBP: 0000000000000000 R08: 00000000000000a0 R09: ffff8881311fdf40
R10: ffff8881311fdf10 R11: ffff8881311fe0a8 R12: 0000000000003c00
R13: 0000000000003c00 R14: 0000000000000334 R15: ffff8881311fdee8
FS: 00007f0873a30700(0000) GS:ffff8883e2f80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0873a306d0 CR3: 0000000118a86005 CR4: 00000000003606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	03 80 3c 02 00 0f add 0xf00023c(%rax),%eax
   6:	85 90 0a 00 00 4c test %edx,0x4c00000a(%rax)
   c:	8d 85 a0 00 00 00 lea 0xa0(%rbp),%eax
  12:	4c 8b b3 a0 01 00 00 mov 0x1a0(%rbx),%r14
  19:	48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	4c 89 c2 mov %r8,%rdx
  26:	48 c1 ea 03 shr $0x3,%rdx
* 2a:	80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 76 08 00 00 jne 0x8aa
  34:	48 8b 85 a0 00 00 00 mov 0xa0(%rbp),%rax
  3b:	ba 00 00 00 00 mov $0x0,%edx

评论 (3)

Zheng Zucheng 创建了任务

Hi oskernel0719, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers: @YangYingliang , @pi3orama , @成坚 (CHENG Jian) , @jiaoff , @Qiuuuuu , @zhengzengkai , @刘勇强 , @Xie XiuQi

openeuler-ci-bot 添加了
 
sig/Kernel
标签
Zheng Zucheng 修改了描述
Zheng Zucheng 修改了描述
Zheng Zucheng 修改了描述
Zheng Zucheng 修改了描述

线程创建过程中,出现并发对新建线程调用setpriority()进行优先级设置操作,由于新线程尚未初始化cfs_rq,导致在设置优先级时访问cfs_rq出现空指针异常

Zheng Zucheng 修改了描述
Zheng Zucheng 修改了描述
zhengzengkai 通过src-openeuler/kernel Pull Request !605任务状态待办的 修改为已完成

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
5329419 openeuler ci bot 1632792936 8909060 oskernel0719 1670549376
C
1
https://gitee.com/openeuler/kernel.git
git@gitee.com:openeuler/kernel.git
openeuler
kernel
kernel

搜索帮助

344bd9b3 5694891 D2dac590 5694891