Hi Max,
On 9/29/20 7:28 PM, Maxim Mikityanskiy wrote:
On 2020-09-27 04:07, kernel test robot wrote:
> Greeting,
>
> FYI, we noticed the following commit (built with gcc-9):
>
> commit: d18d22ce8f62839365c984b1df474d3975ed4eb2 ("net: Fix packet
> reordering caused by GRO and listified RX cooperation")
>
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable-rc.git
> linux-5.4.y
>
>
> in testcase: trinity
> version: trinity-i386-4d2343bd-1_20200320
> with following parameters:
>
> runtime: 300s
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url:
http://codemonkey.org.uk/projects/trinity/
>
>
> on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2
> -m 8G
>
> caused below changes (please refer to attached dmesg/kmsg for entire
> log/backtrace):
>
>
>
+------------------------------------------------------------------+------------+------------+
>
> | |
> 8bc3025206 | d18d22ce8f |
>
+------------------------------------------------------------------+------------+------------+
>
> | boot_successes | 0 | 0 |
> | boot_failures | 4 | 6 |
> | UBSAN:Undefined_behaviour_in_arch/x86/kernel.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/tbprint.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/tbutils.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/tbdata.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/tbxface.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_kernel/workqueue.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/nsaccess.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_lib/string.c | 4 | 6 |
> | UBSAN:Undefined_behaviour_in_arch/x86/kernel/alternative.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_arch/x86/realmode/init.c | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_crypto/algapi.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/events/core.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/exit.c | 4 | 6 |
> | UBSAN:Undefined_behaviour_in_kernel/sched/cputime.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/locking/lockdep.c | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/tbxfload.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/dsmthdat.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/psargs.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/dsinit.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/evgpeinit.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/evregion.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/nsinit.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/utpredef.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/sysfs.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/rsutils.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/rsaddr.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/rscalc.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/rsmisc.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/acpi/acpica/rsxface.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_lib/zlib_inflate/inffast.c |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_crypto/api.c | 4 | 6 |
> | UBSAN:Undefined_behaviour_in_drivers/base/devres.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/linux/compiler.h | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_include/uapi/linux/swab.h | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_include/linux/unaligned/access_ok.h |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/af_inet.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/net/ip.h | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/ipconfig.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/ip_input.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/udp.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/signal.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/linux/skbuff.h | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/cgroup/cgroup.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/ip6_offload.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/ip6_input.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/net/ipv6.h | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/route.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/icmp.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/net/ip6_checksum.h |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/ndisc.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/addrconf_core.c | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/addrconf.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/ip6_fib.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_fs/readdir.c | 4 | 6 |
> | UBSAN:Undefined_behaviour_in_net/unix/garbage.c | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_include/linux/etherdevice.h |
> 4 | 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/tcp_offload.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/tcp_ipv4.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/linux/tcp.h | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_include/net/dsfield.h | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/tcp_input.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_net/ipv4/tcp_minisocks.c | 4
> | 6 |
> | UBSAN:Undefined_behaviour_in_net/sunrpc/xprtsock.c | 4 |
> 6 |
> | UBSAN:Undefined_behaviour_in_kernel/events/hw_breakpoint.c |
> 4 | 4 |
> | UBSAN:Undefined_behaviour_in_kernel/capability.c | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_kernel/time/time.c | 3
> | |
> | UBSAN:Undefined_behaviour_in_kernel/sys.c | 4 | 4 |
> | UBSAN:Undefined_behaviour_in_fs/utimes.c | 4 | 4 |
> | UBSAN:Undefined_behaviour_in_kernel/futex.c | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_include/net/ndisc.h | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_net/ipv6/udp.c | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_include/linux/jhash.h | 4 |
> 4 |
> | UBSAN:Undefined_behaviour_in_include/net/neighbour.h | 4 |
> 4 |
> | EIP:check_poison_obj | 1 | 2 |
> | EIP:rcutorture_one_extend | 1 | |
> | UBSAN:Undefined_behaviour_in_kernel/sched/core.c | 2 |
> 4 |
> | EIP:arch_local_irq_enable | 1 | |
> | EIP:delay_tsc | 2 | 1 |
> | EIP:arch_local_irq_restore | 2 | 2 |
> | EIP:kmem_cache_alloc | 1 | |
> | UBSAN:Undefined_behaviour_in_fs/proc/array.c | 1
> | |
> | EIP:__copy_user_ll | 1 | |
> | EIP:update_stack_state | 0 | 1 |
> | UBSAN:Undefined_behaviour_in_net/core/dev.c | 0 |
> 6 |
> | UBSAN:Undefined_behaviour_in_fs/ioctl.c | 0 | 2 |
> | EIP:copy_user_highpage | 0 | 1 |
> | EIP:do_fault | 0 | 1 |
> | EIP:native_safe_halt | 0 | 2 |
>
+------------------------------------------------------------------+------------+------------+
>
>
> To reproduce:
>
> # build kernel
> cd linux
> cp config-5.4.15-00023-gd18d22ce8f628 .config
> make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare
> modules_prepare bzImage
>
> git clone
https://github.com/intel/lkp-tests.git
> cd lkp-tests
> bin/lkp qemu -k <bzImage> job-script # job-script is
> attached in this email
Dear kernel test robot / Rong Chen,
The steps to reproduce don't seem to work for me:
result_root:
.../.lkp//result/trinity/300s/vm-snb-i386/debian-i386-20191205.cgz/i386-randconfig-a015-20200923/gcc-9/d18d22ce8f62839365c984b1df474d3975ed4eb2/1
downloading initrds ...
/usr/bin/wget -q --timeout=1800 --tries=1 --local-encoding=UTF-8
https://download.01.org/0day-ci/lkp-qemu/osimage/debian/debian-i386-20191...
-N -P .../.lkp/cache/osimage/debian
550160 blocks
/usr/bin/wget -q --timeout=1800 --tries=1 --local-encoding=UTF-8
https://download.01.org/0day-ci/lkp-qemu/osimage/pkg/debian-i386-20191205...
-N -P .../.lkp/cache/osimage/pkg/debian-i386-20191205.cgz
Failed to download
osimage/pkg/debian-i386-20191205.cgz/trinity-i386-4d2343bd-1_20200320.cgz
The file the last command tries to download doesn't exist on your
server. Any ideas how to run the repro?
Sorry for the late, the file doesn't be uploaded the server, I have
uploaded it now.
Second, are you sure that my commit introduces a regression? From what
I see in the stack traces, there is some unaligned pointer to an SKB,
but my code doesn't touch any pointers to SKBs. All it does is put
existing SKBs to an intermediate list, however, it doesn't allocate or
move the SKB structs itself, so I don't see anything that could
unalign an aligned pointer, which makes me think such pointers were
passed from external code, and my patch doesn't look related.
I didn't study your code, as you can see, there are many existing UBSAN
errors before your commit,
and "UBSAN:Undefined_behaviour_in_net/core/dev.c" was first found in
this commit, so I sent it to you
for your reference, please ignore the report if it's a false positive.
Best Regards,
Rong Chen