Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test_nanosleep is flaky under Valgrind #48

Closed
pscollins opened this issue Jan 28, 2016 · 1 comment · Fixed by #55
Closed

test_nanosleep is flaky under Valgrind #48

pscollins opened this issue Jan 28, 2016 · 1 comment · Fixed by #55

Comments

@pscollins
Copy link
Member

Example:

make -C tests valgrind
make[1]: Entering directory `~/lkl-linux-master/tools/lkl/tests'
VALGRIND_CMD="valgrind --suppressions=valgrind.supp --leak-check=full --show-leak-kinds=all" ./boot.sh -t ext4
20480+0 records in
20480+0 records out
20971520 bytes (21 MB) copied, 0.0601454 s, 349 MB/s
mke2fs 1.42.9 (4-Feb-2014)
==51041== Memcheck, a memory error detector
==51041== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==51041== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==51041== Command: ./boot -d /tmp/tmp.WW4HVFKxn7 -t ext4 -n lkl_boot
==51041== 
disk_add             passed [3 0]
netdev_add           passed [0 4 0]
==51041== Thread 6:
...<snip>...
==51041== 
getpid               passed [1]
umask                passed [22 777]
creat                passed [0]
close                passed [0]
failopen             passed [-2]
open                 passed [0]
write                passed [5]
lseek                passed [0 ]
read                 passed [5 test]
fstat                passed [0 100721 5]
mkdir                passed [0]
stat                 passed [0 40721]
nanosleep            **failed** [97188672]
mount                passed [0]
chdir                passed [0]
opendir              passed [1]
getdents64           passed [1 lost+found .. . ]
umount               passed [0 0 0]
lo_ifup              passed [0]
netdev_ifup          passed [0 2]
==51041== 
==51041== HEAP SUMMARY:

Presumably because there's an upper bound on the time that passes while the test thread sleeps (under test_nanosleep in boot.c):

clock_gettime(CLOCK_MONOTONIC, &start);
ret = lkl_sys_nanosleep(&ts, NULL);
clock_gettime(CLOCK_MONOTONIC, &stop);

delta = 1e9*(stop.tv_sec - start.tv_sec) +
    (stop.tv_nsec - start.tv_nsec);

snprintf(str, len, "%ld", delta);

if (ret == 0 && delta > sleep_ns * 0.9 && delta < sleep_ns * 1.1)
    return 1;

return 0;

I'm not sure how important you consider this part of the test to be --- is there a very compelling reason to check that delta < sleep_ns * 1.1, or can that line be changed to "if (ret == 0 && delta > sleep_ns)" instead?

@ghost
Copy link

ghost commented Jan 28, 2016

Good point, I agree that we should remove the upper bound check.

@ghost ghost closed this as completed in #55 Feb 1, 2016
tavip pushed a commit to tavip/linux that referenced this issue May 2, 2018
prp pushed a commit to lsds/lkl that referenced this issue Sep 7, 2020
commit f4c23a1 upstream.

I got null-ptr-deref in serial8250_start_tx():

[   78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[   78.123778] Mem abort info:
[   78.126560]   ESR = 0x86000007
[   78.129603]   EC = 0x21: IABT (current EL), IL = 32 bits
[   78.134891]   SET = 0, FnV = 0
[   78.137933]   EA = 0, S1PTW = 0
[   78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600
[   78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000
[   78.160029] Internal error: Oops: 86000007 [#1] SMP
[   78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd
[   78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ lkl#48
[   78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020
[   78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[   78.228435] pc : 0x0
[   78.230618] lr : serial8250_start_tx+0x160/0x260
[   78.235215] sp : ffff800062eefb80
[   78.238517] x29: ffff800062eefb80 x28: 0000000000000fff
[   78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000
[   78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000
[   78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002
[   78.259679] x21: 0000000000000001 x20: 0000000000000000
[   78.264969] x19: ffffa688827eecc8 x18: 0000000000000000
[   78.270259] x17: 0000000000000000 x16: 0000000000000000
[   78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6
[   78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539
[   78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0
[   78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88
[   78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000
[   78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8
[   78.307292] x3 : 0000000000000000 x2 : 0000000000000002
[   78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8
[   78.317873] Call trace:
[   78.320312]  0x0
[   78.322147]  __uart_start.isra.9+0x64/0x78
[   78.326229]  uart_start+0xb8/0x1c8
[   78.329620]  uart_flush_chars+0x24/0x30
[   78.333442]  n_tty_receive_buf_common+0x7b0/0xc30
[   78.338128]  n_tty_receive_buf+0x44/0x2c8
[   78.342122]  tty_ioctl+0x348/0x11f8
[   78.345599]  ksys_ioctl+0xd8/0xf8
[   78.348903]  __arm64_sys_ioctl+0x2c/0xc8
[   78.352812]  el0_svc_common.constprop.2+0x88/0x1b0
[   78.357583]  do_el0_svc+0x44/0xd0
[   78.360887]  el0_sync_handler+0x14c/0x1d0
[   78.364880]  el0_sync+0x140/0x180
[   78.368185] Code: bad PC value

SERIAL_PORT_DFNS is not defined on each arch, if it's not defined,
serial8250_set_defaults() won't be called in serial8250_isa_init_ports(),
so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref.
Fix this problem by calling serial8250_set_defaults() after init uart port.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200721143852.4058352-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
thehajime referenced this issue in thehajime/linux Aug 5, 2022
nft_set_elem_expr_alloc() needs an initialized set if expression sets on
the NFT_EXPR_GC flag. Move set fields initialization before expression
setup.

[4512935.019450] ==================================================================
[4512935.019456] BUG: KASAN: null-ptr-deref in nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019487] Read of size 8 at addr 0000000000000070 by task nft/23532
[4512935.019494] CPU: 1 PID: 23532 Comm: nft Not tainted 5.12.0-rc4+ #48
[...]
[4512935.019502] Call Trace:
[4512935.019505]  dump_stack+0x89/0xb4
[4512935.019512]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019536]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019560]  kasan_report.cold.12+0x5f/0xd8
[4512935.019566]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019590]  nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019615]  nf_tables_newset+0xc7f/0x1460 [nf_tables]

Reported-by: syzbot+ce96ca2b1d0b37c6422d@syzkaller.appspotmail.com
Fixes: 6503842 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant