[Bug 1628686] [NEW] kernel BUG at linux-4.8.0/mm/usercopy.c:75!

Vinson Lee 1628686 at bugs.launchpad.net
Wed Sep 28 20:57:24 UTC 2016 

Public bug reported:

This kernel warning occurs on Ubuntu 16.10 guests with Linux 4.8 on
VMware Fusion. The VM will boot but does not make it a graphical
display.

usercopy: kernel memory overwrite attempt detected to ffff9bdaf3e00000 (<spans multiple pages>) (4392 bytes)
------------[ cut here ]------------
kernel BUG at /build/linux-FGN3Aj/linux-4.8.0/mm/usercopy.c:75!
invalid opcode: 0000 [#1] SMP
Modules linked in: intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_msghandler aesni_intel vmw_balloon aes_x86_64 lrw glue_helper ablk_helper cryptd intel_rapl_perf joydev input_leds serio_raw binfmt_misc snd_ens1371 snd_ac97_codec gameport ac97_bus snd_pcm uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core snd_seq_midi videodev snd_seq_midi_event media snd_rawmidi snd_seq snd_seq_device btusb btrtl btbcm snd_timer btintel snd bluetooth soundcore i2c_piix4 vmw_vmci shpchp nfit floppy(+) mac_hid parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid vmwgfx ttm psmouse drm_kms_helper syscopyarea sysfillrect ahci libahci e1000 mptspi mptscsih mptbase scsi_transport_spi sysimgblt fb_sys_fops drm pata_acpi fjes
CPU: 0 PID: 1293 Comm: glxinfo Not tainted 4.8.0-17-generic #19-Ubuntu
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
task: ffff9bdb74465580 task.stack: ffff9bdb73f00000
RIP: 0010:[<ffffffff9cc2e421>]  [<ffffffff9cc2e421>] __check_object_size+0x111/0x49b
RSP: 0018:ffff9bdb73f03c58  EFLAGS: 00010282
RAX: 000000000000006c RBX: ffff9bdaf3e00000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff9bdb7a60dc68 RDI: ffff9bdb7a60dc68
RBP: ffff9bdb73f03ca0 R08: 79706f6372657375 R09: 656b203a79706f63
R10: 00003fffc0000000 R11: 00000000000006c1 R12: 0000000000001128
R13: 0000000000000000 R14: ffff9bdaf3e01128 R15: ffff9bdaf3e01127
FS:  00007f22f6d20740(0000) GS:ffff9bdb7a600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b6cf2c71c8 CR3: 00000000b3f91000 CR4: 00000000001406f0
Stack:
 ffff9bdb73f16ce8 ffff9bdb73f03ca0 ffffffffc03df765 00003fffc0000000
 ffff9bdaf41c0000 000055b6cf0ca1b0 ffff9bdb73edbc00 ffff9bdaf3e00000
 0000000000001128 ffff9bdb73f03d90 ffffffffc03c6f0f ffff9bdb73f03d08
Call Trace:
 [<ffffffffc03df765>] ? vmw_cmdbuf_alloc+0x175/0x240 [vmwgfx]
 [<ffffffffc03c6f0f>] vmw_execbuf_process+0x8bf/0x1250 [vmwgfx]
 [<ffffffff9cc2e43d>] ? __check_object_size+0x12d/0x49b
 [<ffffffffc0246dd6>] ? drm_ioctl+0x236/0x4f0 [drm]
 [<ffffffff9cbab015>] ? __alloc_pages_nodemask+0x135/0x300
 [<ffffffffc03b0cb4>] ? ttm_read_lock+0x34/0xc0 [ttm]
 [<ffffffffc03c79c6>] vmw_execbuf_ioctl+0xe6/0x180 [vmwgfx]
 [<ffffffffc03cb919>] vmw_generic_ioctl+0x249/0x280 [vmwgfx]
 [<ffffffffc03cb985>] vmw_unlocked_ioctl+0x15/0x20 [vmwgfx]
 [<ffffffff9cc47843>] do_vfs_ioctl+0xa3/0x610
 [<ffffffff9ca6b3b3>] ? __do_page_fault+0x203/0x4d0
 [<ffffffff9cc47e29>] SyS_ioctl+0x79/0x90
 [<ffffffff9d299c76>] entry_SYSCALL_64_fastpath+0x1e/0xa8
Code: 1f 03 00 00 49 c7 c0 86 36 6a 9d 48 c7 c2 30 0b 68 9d 48 c7 c6 4c 8e 69 9d 4d 89 e1 48 89 d9 48 c7 c7 10 03 6a 9d e8 03 05 f7 ff <0f> 0b 4c 8b 75 b8 48 8b 5d d0 45 89 fd 4c 8b 65 c8 4c 89 e6 48 
RIP  [<ffffffff9cc2e421>] __check_object_size+0x111/0x49b
 RSP <ffff9bdb73f03c58>
---[ end trace 48bce713521eb13e ]---


Disabling CONFIG_HARDENED_USERCOPY_PAGESPAN works around this issue. 

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e1f74ea02cf4562404c48c6882214821552c13f

** Affects: linux (Ubuntu)
     Importance: Undecided
         Status: Incomplete

** Package changed: netcfg (Ubuntu) => linux (Ubuntu)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to netcfg in Ubuntu.
https://bugs.launchpad.net/bugs/1628686

Title:
  kernel BUG at linux-4.8.0/mm/usercopy.c:75!

Status in linux package in Ubuntu:
  Incomplete

Bug description:
  This kernel warning occurs on Ubuntu 16.10 guests with Linux 4.8 on
  VMware Fusion. The VM will boot but does not make it a graphical
  display.

  usercopy: kernel memory overwrite attempt detected to ffff9bdaf3e00000 (<spans multiple pages>) (4392 bytes)
  ------------[ cut here ]------------
  kernel BUG at /build/linux-FGN3Aj/linux-4.8.0/mm/usercopy.c:75!
  invalid opcode: 0000 [#1] SMP
  Modules linked in: intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_msghandler aesni_intel vmw_balloon aes_x86_64 lrw glue_helper ablk_helper cryptd intel_rapl_perf joydev input_leds serio_raw binfmt_misc snd_ens1371 snd_ac97_codec gameport ac97_bus snd_pcm uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core snd_seq_midi videodev snd_seq_midi_event media snd_rawmidi snd_seq snd_seq_device btusb btrtl btbcm snd_timer btintel snd bluetooth soundcore i2c_piix4 vmw_vmci shpchp nfit floppy(+) mac_hid parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid vmwgfx ttm psmouse drm_kms_helper syscopyarea sysfillrect ahci libahci e1000 mptspi mptscsih mptbase scsi_transport_spi sysimgblt fb_sys_fops drm pata_acpi fjes
  CPU: 0 PID: 1293 Comm: glxinfo Not tainted 4.8.0-17-generic #19-Ubuntu
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
  task: ffff9bdb74465580 task.stack: ffff9bdb73f00000
  RIP: 0010:[<ffffffff9cc2e421>]  [<ffffffff9cc2e421>] __check_object_size+0x111/0x49b
  RSP: 0018:ffff9bdb73f03c58  EFLAGS: 00010282
  RAX: 000000000000006c RBX: ffff9bdaf3e00000 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffff9bdb7a60dc68 RDI: ffff9bdb7a60dc68
  RBP: ffff9bdb73f03ca0 R08: 79706f6372657375 R09: 656b203a79706f63
  R10: 00003fffc0000000 R11: 00000000000006c1 R12: 0000000000001128
  R13: 0000000000000000 R14: ffff9bdaf3e01128 R15: ffff9bdaf3e01127
  FS:  00007f22f6d20740(0000) GS:ffff9bdb7a600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000055b6cf2c71c8 CR3: 00000000b3f91000 CR4: 00000000001406f0
  Stack:
   ffff9bdb73f16ce8 ffff9bdb73f03ca0 ffffffffc03df765 00003fffc0000000
   ffff9bdaf41c0000 000055b6cf0ca1b0 ffff9bdb73edbc00 ffff9bdaf3e00000
   0000000000001128 ffff9bdb73f03d90 ffffffffc03c6f0f ffff9bdb73f03d08
  Call Trace:
   [<ffffffffc03df765>] ? vmw_cmdbuf_alloc+0x175/0x240 [vmwgfx]
   [<ffffffffc03c6f0f>] vmw_execbuf_process+0x8bf/0x1250 [vmwgfx]
   [<ffffffff9cc2e43d>] ? __check_object_size+0x12d/0x49b
   [<ffffffffc0246dd6>] ? drm_ioctl+0x236/0x4f0 [drm]
   [<ffffffff9cbab015>] ? __alloc_pages_nodemask+0x135/0x300
   [<ffffffffc03b0cb4>] ? ttm_read_lock+0x34/0xc0 [ttm]
   [<ffffffffc03c79c6>] vmw_execbuf_ioctl+0xe6/0x180 [vmwgfx]
   [<ffffffffc03cb919>] vmw_generic_ioctl+0x249/0x280 [vmwgfx]
   [<ffffffffc03cb985>] vmw_unlocked_ioctl+0x15/0x20 [vmwgfx]
   [<ffffffff9cc47843>] do_vfs_ioctl+0xa3/0x610
   [<ffffffff9ca6b3b3>] ? __do_page_fault+0x203/0x4d0
   [<ffffffff9cc47e29>] SyS_ioctl+0x79/0x90
   [<ffffffff9d299c76>] entry_SYSCALL_64_fastpath+0x1e/0xa8
  Code: 1f 03 00 00 49 c7 c0 86 36 6a 9d 48 c7 c2 30 0b 68 9d 48 c7 c6 4c 8e 69 9d 4d 89 e1 48 89 d9 48 c7 c7 10 03 6a 9d e8 03 05 f7 ff <0f> 0b 4c 8b 75 b8 48 8b 5d d0 45 89 fd 4c 8b 65 c8 4c 89 e6 48 
  RIP  [<ffffffff9cc2e421>] __check_object_size+0x111/0x49b
   RSP <ffff9bdb73f03c58>
  ---[ end trace 48bce713521eb13e ]---

  
  Disabling CONFIG_HARDENED_USERCOPY_PAGESPAN works around this issue. 

  http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e1f74ea02cf4562404c48c6882214821552c13f

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1628686/+subscriptions

More information about the foundations-bugs mailing list