Re: Crash in cgroup_procs_show

From: Laura Abbott
Date: Wed Dec 13 2017 - 12:10:46 EST


On 12/13/2017 07:29 AM, Tejun Heo wrote:
Hello, Laura.

On Tue, Dec 12, 2017 at 04:38:33PM -0800, Laura Abbott wrote:
Hi,

Fedora got a bug report on 4.14.4 of a crash on
reboot https://bugzilla.redhat.com/show_bug.cgi?id=1525279

BUG: unable to handle kernel NULL pointer dereference at 0000000000000254
IP: __task_pid_nr_ns+0xc7/0xf0

Any chance you can map this back to the source line with addr2line?

Thanks.


annotated with decode_stacktrace.sh


IP: __task_pid_nr_ns (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/kernel/pid.c:506 /usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/kernel/pid.c:535)

cgroup_procs_show (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/kernel/cgroup/cgroup.c:4240)
cgroup_seqfile_show (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/kernel/cgroup/cgroup.c:3413)
kernfs_seq_show (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/kernfs/file.c:169)
seq_read (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/seq_file.c:269)
kernfs_fop_read (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/kernfs/file.c:252)
__vfs_read (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/read_write.c:416)
? security_file_permission (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/include/linux/fsnotify.h:56 /usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/security/security.c:867)
vfs_read (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/read_write.c:448)
SyS_read (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/read_write.c:574 /usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/fs/read_write.c:566)
entry_SYSCALL_64_fastpath (/usr/src/debug/kernel-4.14.fc26/linux-4.14.4-200.fc26.x86_64/arch/x86/entry/entry_64.S:206)

All code
========
0: 04 74 add $0x74,%al
2: 0e (bad)
3: 89 f6 mov %esi,%esi
5: 48 8d 04 76 lea (%rsi,%rsi,2),%rax
9: 48 8d 04 c5 f0 05 00 lea 0x5f0(,%rax,8),%rax
10: 00
11: 48 8b bf b8 05 00 00 mov 0x5b8(%rdi),%rdi
18: 48 01 c7 add %rax,%rdi
1b: 31 c0 xor %eax,%eax
1d: 48 8b 0f mov (%rdi),%rcx
20: 48 85 c9 test %rcx,%rcx
23: 74 18 je 0x3d
25: 8b b2 30 08 00 00 mov 0x830(%rdx),%esi
2b:* 3b 71 04 cmp 0x4(%rcx),%esi <-- trapping instruction
2e: 77 0d ja 0x3d
30: 48 c1 e6 05 shl $0x5,%rsi
34: 48 01 f1 add %rsi,%rcx
37: 48 3b 51 38 cmp 0x38(%rcx),%rdx
3b: 74 09 je 0x46
3d: 5d pop %rbp
3e: c3 retq
3f: 8b .byte 0x8b

Code starting with the faulting instruction
===========================================
0: 3b 71 04 cmp 0x4(%rcx),%esi
3: 77 0d ja 0x12
5: 48 c1 e6 05 shl $0x5,%rsi
9: 48 01 f1 add %rsi,%rcx
c: 48 3b 51 38 cmp 0x38(%rcx),%rdx
10: 74 09 je 0x1b
12: 5d pop %rbp
13: c3 retq
14: 8b .byte 0x8b