Greetings!!!
IBM CI has reported a kernel OOPs while running TPM2selftests on IBM Power11 system with linux-next20251002 kernel.
Test Case:
make run_tests TAP version 13 1..3 # timeout set to 600 # selftests: tpm2: test_smoke.sh # test_read_partial_overwrite (tpm2_tests.SmokeTest) ... ok # test_read_partial_resp (tpm2_tests.SmokeTest) ... ok # test_seal_with_auth (tpm2_tests.SmokeTest) ... ok # test_seal_with_policy (tpm2_tests.SmokeTest) ... ok # test_seal_with_too_long_auth (tpm2_tests.SmokeTest) ... ok # test_send_two_cmds (tpm2_tests.SmokeTest) ... ok # test_too_short_cmd (tpm2_tests.SmokeTest) ... ok # test_unseal_with_wrong_auth (tpm2_tests.SmokeTest) ... ok # test_unseal_with_wrong_policy (tpm2_tests.SmokeTest) ... ERROR # # ====================================================================== # ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest) # -----------------------------------------------------
Traces:
[ 452.604333] BUG: KASAN: slab-use-after-free in tpmrm_release+0x78/0xa8 [ 452.604345] Read of size 8 at addr c00000001c650000 by task python3/1856 [ 452.604353] [ 452.604358] CPU: 24 UID: 0 PID: 1856 Comm: python3 Kdump: loaded Not tainted 6.17.0-next-20251003 #1 VOLUNTARY [ 452.604364] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.01 (NH1110_069) hv:phyp pSeries [ 452.604368] Call Trace: [ 452.604370] [c0000000c1867840] [c00000000187ea4c] dump_stack_lvl+0x84/0xe8 (unreliable) [ 452.604380] [c0000000c1867870] [c000000000803754] print_address_description.constprop.0+0x11c/0x56c [ 452.604388] [c0000000c1867910] [c000000000803c84] print_report+0xe0/0x358 [ 452.604394] [c0000000c18679e0] [c000000000804124] kasan_report+0x128/0x1f4 [ 452.604400] [c0000000c1867af0] [c0000000008062b4] __asan_load8+0xa8/0xe0 [ 452.604406] [c0000000c1867b10] [c000000000f2ec18] tpmrm_release+0x78/0xa8 [ 452.604412] [c0000000c1867b40] [c0000000008b6a2c] __fput+0x21c/0x60c [ 452.604417] [c0000000c1867bc0] [c0000000008ada70] sys_close+0x74/0xd0 [ 452.604424] [c0000000c1867bf0] [c000000000039270] system_call_exception+0x1e0/0x460 [ 452.604431] [c0000000c1867e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec [ 452.604438] ---- interrupt: 3000 at 0x7fffb7534ab4 [ 452.604443] NIP: 00007fffb7534ab4 LR: 00007fffb7534ab4 CTR: 0000000000000000 [ 452.604446] REGS: c0000000c1867e80 TRAP: 3000 Not tainted (6.17.0-next-20251003) [ 452.604449] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44284422 XER: 00000000 [ 452.604466] IRQMASK: 0 [ 452.604466] GPR00: 0000000000000006 00007ffff65d76b0 00007fffb7c17700 0000000000000006 [ 452.604466] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000004 [ 452.604466] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 452.604466] GPR12: 0000000000000000 00007fffb7e6b8e0 00000000000000a1 00007fffb67acec0 [ 452.604466] GPR16: 0000000164032ad0 00007fffb67aceb0 00007fffb76f6a90 0000000000000000 [ 452.604466] GPR20: 00007fffb6f21850 0000000000000000 00007fffb71062c0 0000000164034490 [ 452.604466] GPR24: 00007fffb6f2fea0 00007fffb67acea8 0000000164032b18 00007fffb7c45b32 [ 452.604466] GPR28: 00007fffb7c678e0 00007fffb67aceb8 0000000000000006 0000000164034490 [ 452.604510] NIP [00007fffb7534ab4] 0x7fffb7534ab4 [ 452.604513] LR [00007fffb7534ab4] 0x7fffb7534ab4 [ 452.604516] ---- interrupt: 3000 [ 452.604518] [ 452.604601] Allocated by task 1856: [ 452.604607] kasan_save_stack+0x34/0x64 [ 452.604614] kasan_save_track+0x2c/0x50 [ 452.604621] kasan_save_alloc_info+0x58/0x74 [ 452.604628] __kasan_kmalloc+0x12c/0x168 [ 452.604635] __kmalloc_cache_noprof+0x1d8/0x71c [ 452.604643] tpmrm_open+0x88/0x168 [ 452.604649] chrdev_open+0x1f4/0x484 [ 452.604656] do_dentry_open+0x578/0x9cc [ 452.604663] vfs_open+0x68/0x23c [ 452.604670] do_open+0x514/0x74c [ 452.604676] path_openat+0x16c/0x380 [ 452.604682] do_filp_open+0x104/0x230 [ 452.604689] do_sys_openat2+0xb8/0x154 [ 452.604696] sys_openat+0xcc/0x130 [ 452.604703] system_call_exception+0x1e0/0x460 [ 452.604710] system_call_vectored_common+0x15c/0x2ec [ 452.604718] [ 452.604722] Freed by task 1856: [ 452.604726] kasan_save_stack+0x34/0x64 [ 452.604733] kasan_save_track+0x2c/0x50 [ 452.604739] __kasan_save_free_info+0x64/0x110 [ 452.604747] __kasan_slab_free+0xb0/0x10c [ 452.604753] kfree+0x220/0x624 [ 452.604760] tpmrm_release+0x6c/0xa8 [ 452.604766] __fput+0x21c/0x60c [ 452.604772] sys_close+0x74/0xd0 [ 452.604779] system_call_exception+0x1e0/0x460 [ 452.604786] system_call_vectored_common+0x15c/0x2ec [ 452.604794] [ 452.604797] The buggy address belongs to the object at c00000001c650000 [ 452.604797] which belongs to the cache kmalloc-8k of size 8192 [ 452.604806] The buggy address is located 0 bytes inside of [ 452.604806] freed 8192-byte region [c00000001c650000, c00000001c652000) [ 452.604815] [ 452.604818] The buggy address belongs to the physical page: [ 452.604824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xc00000001c644000 pfn:0x1c60 [ 452.604833] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 452.604840] flags: 0x3ffffe00000040(head|node=0|zone=0|lastcpupid=0x1fffff) [ 452.604849] page_type: f5(slab) [ 452.604856] raw: 003ffffe00000040 c000000007012300 5deadbeef0000122 0000000000000000 [ 452.604864] raw: c00000001c644000 000000008020001e 00000000f5000000 0000000000000000 [ 452.604872] head: 003ffffe00000040 c000000007012300 5deadbeef0000122 0000000000000000 [ 452.604879] head: c00000001c644000 000000008020001e 00000000f5000000 0000000000000000 [ 452.604887] head: 003ffffe00000003 c00c000000071801 00000000ffffffff 00000000ffffffff [ 452.604894] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 452.604900] page dumped because: kasan: bad access detected [ 452.604905] [ 452.604908] Memory state around the buggy address: [ 452.604914] c00000001c64ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 452.604920] c00000001c64ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 452.604927] >c00000001c650000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.604933] ^ [ 452.604937] c00000001c650080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.604944] c00000001c650100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 452.604950] ================================================================== [ 452.604955] Disabling lock debugging due to kernel taint [ 452.604961] Kernel attempted to read user page (770) - exploit attempt? (uid: 0) [ 452.604969] BUG: Kernel NULL pointer dereference on read at 0x00000770 [ 452.604975] Faulting instruction address: 0xc0000000002b2e0c [ 452.604982] Oops: Kernel access of bad area, sig: 11 [#1] [ 452.604987] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries [ 452.604996] Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat bonding nf_conntrack tls nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables nfnetlink sunrpc pseries_rng vmx_crypto fuse ext4 crc16 mbcache jbd2 sd_mod sg ibmvscsi ibmveth scsi_transport_srp pseries_wdt [ 452.605073] CPU: 24 UID: 0 PID: 1856 Comm: python3 Kdump: loaded Tainted: G B 6.17.0-next-20251003 #1 VOLUNTARY [ 452.605084] Tainted: [B]=BAD_PAGE [ 452.605089] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.01 (NH1110_069) hv:phyp pSeries [ 452.605096] NIP: c0000000002b2e0c LR: c0000000002b2e08 CTR: 0000000000000000 [ 452.605103] REGS: c0000000c1867820 TRAP: 0300 Tainted: G B (6.17.0-next-20251003) [ 452.605110] MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28284420 XER: 0000000d [ 452.605132] CFAR: c000000000807920 DAR: 0000000000000770 DSISR: 40000000 IRQMASK: 0 [ 452.605132] GPR00: c0000000002b2e08 c0000000c1867ac0 c00000000234a500 0000000000000001 [ 452.605132] GPR04: 0000000000000008 0000000000000000 c0000000002b2e08 0000000000000001 [ 452.605132] GPR08: 0000000000000020 0000000000000001 0000000000000001 a80e000000000000 [ 452.605132] GPR12: c00e0000009b1c8c c000000d0ddeb700 0000000000000000 0000000000000000 [ 452.605132] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 452.605132] GPR20: 0000000000000008 0000000000000000 c000000008202f00 c00000007b9ff620 [ 452.605132] GPR24: c00000008a76cb20 c00000008a76cb40 c00000008a76cb08 c000000002201e80 [ 452.605132] GPR28: c000000061569248 0000000000000770 c00000008a76cb00 0000000000000768 [ 452.605227] NIP [c0000000002b2e0c] up_read+0x50/0x17c [ 452.605237] LR [c0000000002b2e08] up_read+0x4c/0x17c [ 452.605245] Call Trace: [ 452.605249] [c0000000c1867ac0] [c0000000002b2e08] up_read+0x4c/0x17c (unreliable) [ 452.605261] [c0000000c1867b10] [c000000000f2ec28] tpmrm_release+0x88/0xa8 [ 452.605271] [c0000000c1867b40] [c0000000008b6a2c] __fput+0x21c/0x60c [ 452.605280] [c0000000c1867bc0] [c0000000008ada70] sys_close+0x74/0xd0 [ 452.605291] [c0000000c1867bf0] [c000000000039270] system_call_exception+0x1e0/0x460 [ 452.605301] [c0000000c1867e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec [ 452.605312] ---- interrupt: 3000 at 0x7fffb7534ab4 [ 452.605319] NIP: 00007fffb7534ab4 LR: 00007fffb7534ab4 CTR: 0000000000000000 [ 452.605326] REGS: c0000000c1867e80 TRAP: 3000 Tainted: G B (6.17.0-next-20251003) [ 452.605333] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44284422 XER: 00000000 [ 452.605362] IRQMASK: 0 [ 452.605362] GPR00: 0000000000000006 00007ffff65d76b0 00007fffb7c17700 0000000000000006 [ 452.605362] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000004 [ 452.605362] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 452.605362] GPR12: 0000000000000000 00007fffb7e6b8e0 00000000000000a1 00007fffb67acec0 [ 452.605362] GPR16: 0000000164032ad0 00007fffb67aceb0 00007fffb76f6a90 0000000000000000 [ 452.605362] GPR20: 00007fffb6f21850 0000000000000000 00007fffb71062c0 0000000164034490 [ 452.605362] GPR24: 00007fffb6f2fea0 00007fffb67acea8 0000000164032b18 00007fffb7c45b32 [ 452.605362] GPR28: 00007fffb7c678e0 00007fffb67aceb8 0000000000000006 0000000164034490 [ 452.605450] NIP [00007fffb7534ab4] 0x7fffb7534ab4 [ 452.605456] LR [00007fffb7534ab4] 0x7fffb7534ab4 [ 452.605462] ---- interrupt: 3000 [ 452.605467] Code: fbc1fff0 7c7f1b78 f8010010 f821ffb1 e92d0c78 f9210028 39200000 3ba30008 38800008 7fa3eb78 48554af5 60000000 <ebdf0008> eb8d0908 7bc90764 fbc10020 [ 452.605501] ---[ end trace 0000000000000000 ]--- [ 452.613685] pstore: backend (nvram) writing error (-1) [ 452.613691]
If you happen to fix this, please add below tag.
Reported-by: Venkat Rao Bagalkote venkat88@linux.ibm.com
Regards,
Venkat.