[BUG] general protection fault in ceph_lock_message

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached and a
proposed patch forthcoming):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   43.951209][  T988] libceph: mon0 (1)127.0.0.1:6789 session established
[   44.003444][ T9495] libceph: client4321 fsid
deadbeef-0011-2233-4455-66778899aabb
[   44.299800][ T9495] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
[   44.300981][ T9495] KASAN: null-ptr-deref in range
[0x0000000000000020-0x0000000000000027]
[   44.301826][ T9495] CPU: 0 UID: 0 PID: 9495 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   44.302851][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   44.303938][ T9495] RIP: 0010:ceph_lock_message+0x608/0xf40
[   44.304525][ T9495] Code: 3c 10 00 74 12 4c 89 e7 e8 75 37 da fd 48
ba 00 00 00 00 00 fc ff df 4d 8b 3c 24 4d 8d 77 20 49 83 c7 27 4c 89
f0 48 c1 e8 03 <0f> b6 04 10 84 c0 48 8b 5c 24 08 0f 85 33 04 00 00 4c
89 f8 48 c1
[   44.306318][ T9495] RSP: 0018:ffffc9000ff1fb88 EFLAGS: 00010202
[   44.306964][ T9495] RAX: 0000000000000004 RBX: 0000000000000000
RCX: ffff888107eca640
[   44.307725][ T9495] RDX: dffffc0000000000 RSI: 0000000000000110
RDI: 0000000000000110
[   44.308475][ T9495] RBP: 0000000000000000 R08: ffffc9000ff1fac7
R09: 1ffff92001fe3f58
[   44.309225][ T9495] R10: dffffc0000000000 R11: fffff52001fe3f59
R12: ffff8880200ab190
[   44.309959][ T9495] R13: ffff8880200aae00 R14: 0000000000000020
R15: 0000000000000027
[   44.310744][ T9495] FS:  0000000028e9b400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.311613][ T9495] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.312262][ T9495] CR2: 0000560b6d3e02e4 CR3: 0000000022fa7000
CR4: 0000000000752ef0
[   44.313012][ T9495] PKRU: 55555554
[   44.313365][ T9495] Call Trace:
[   44.313676][ T9495]  <TASK>
[   44.313983][ T9495]  vfs_test_lock+0xfa/0x160
[   44.314428][ T9495]  fcntl_getlk+0x6d0/0xaa0
[   44.314861][ T9495]  do_fcntl+0xb6b/0x1a20
[   44.315276][ T9495]  ? do_sys_openat2+0x14e/0x200
[   44.315748][ T9495]  ? kmem_cache_free+0x182/0x650
[   44.316232][ T9495]  ? __pfx_do_fcntl+0x10/0x10
[   44.316686][ T9495]  ? do_sys_openat2+0x14e/0x200
[   44.317215][ T9495]  ? __pfx_do_sys_openat2+0x10/0x10
[   44.317738][ T9495]  ? __se_sys_mount+0x3d6/0x420
[   44.318218][ T9495]  ? rcu_is_watching+0x16/0xb0
[   44.318660][ T9495]  ? bpf_lsm_file_fcntl+0x9/0x20
[   44.319140][ T9495]  __se_sys_fcntl+0xc8/0x150
[   44.319587][ T9495]  do_syscall_64+0x155/0x510
[   44.320046][ T9495]  ? trace_irq_disable+0x3b/0x140
[   44.320536][ T9495]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.321118][ T9495]  ? clear_bhb_loop+0x30/0x80
[   44.321567][ T9495]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.322107][ T9495] RIP: 0033:0x41ff87
[   44.322471][ T9495] Code: 00 00 00 f3 0f 1e fa 55 48 89 e5 48 83 ec
10 64 48 8b 04 25 28 00 00 00 48 89 45 f8 31 c0 83 fe 09 74 20 b8 48
00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 48 8b 55 f8 64 48 2b 14 25 28
00 00 00 75
[   44.324222][ T9495] RSP: 002b:00007fff77b7b230 EFLAGS: 00000297
ORIG_RAX: 0000000000000048
[   44.325015][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000041ff87
[   44.325750][ T9495] RDX: 00007fff77b7b2d0 RSI: 0000000000000005
RDI: 0000000000000003
[   44.326503][ T9495] RBP: 00007fff77b7b240 R08: 0000000000000000
R09: 0000000000000000
[   44.327318][ T9495] R10: 0000000000000000 R11: 0000000000000297
R12: 00007fff77b7b428
[   44.328108][ T9495] R13: 00007fff77b7b438 R14: 0000000000000002
R15: 00000000004bca00
[   44.328856][ T9495]  </TASK>
[   44.329161][ T9495] Modules linked in:
[   44.329577][ T9495] ---[ end trace 0000000000000000 ]---
[   44.330409][ T9495] RIP: 0010:ceph_lock_message+0x608/0xf40
[   44.330422][ T9495] Code: 3c 10 00 74 12 4c 89 e7 e8 75 37 da fd 48
ba 00 00 00 00 00 fc ff df 4d 8b 3c 24 4d 8d 77 20 49 83 c7 27 4c 89
f0 48 c1 e8 03 <0f> b6 04 10 84 c0 48 8b 5c 24 08 0f 85 33 04 00 00 4c
89 f8 48 c1
[   44.330428][ T9495] RSP: 0018:ffffc9000ff1fb88 EFLAGS: 00010202
[   44.330434][ T9495] RAX: 0000000000000004 RBX: 0000000000000000
RCX: ffff888107eca640
[   44.330438][ T9495] RDX: dffffc0000000000 RSI: 0000000000000110
RDI: 0000000000000110
[   44.330443][ T9495] RBP: 0000000000000000 R08: ffffc9000ff1fac7
R09: 1ffff92001fe3f58
[   44.330447][ T9495] R10: dffffc0000000000 R11: fffff52001fe3f59
R12: ffff8880200ab190
[   44.330452][ T9495] R13: ffff8880200aae00 R14: 0000000000000020
R15: 0000000000000027
[   44.330456][ T9495] FS:  0000000028e9b400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.330462][ T9495] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.330466][ T9495] CR2: 0000560b6d3e02e4 CR3: 0000000022fa7000
CR4: 0000000000752ef0
[   44.330472][ T9495] PKRU: 55555554
[   44.330478][ T9495] Kernel panic - not syncing: Fatal exception
[   44.340807][ T9495] Kernel Offset: disabled
[   44.341354][ T9495] Rebooting in 86400 seconds..

Regards,
SEFCOM Lab @ ASU

Attachment: reproducer.c
Description: Binary data