linux-kernel - Re: BUG: Sporadic crashes with current Linus tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Sep 2017 08:22:45 -0700
From:   Andy Lutomirski <luto@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>, Andy Lutomirski <luto@...nel.org>
Subject: Re: BUG: Sporadic crashes with current Linus tree

On Thu, Sep 14, 2017 at 12:38 AM, Thomas Gleixner <tglx@...utronix.de> wrote:
> Hi!
>
> I've seen the following crash sporadically with commit 46c1e79fee:
>
> Have not seen that with 3882a734c19b, though I saw the PCID warnings on
> that machine.
>
> I have no idea how to reproduce so bisecting is pretty much pointless. Any
> idea what to do?

Does tools/testing/selftests/x86/sigreturn_64 reproduce it?

>
> Thanks,
>
>         tglx
>
>
> BUG: unable to handle kernel paging request at ffffffffffffffd8
> IP: __memmove+0x24/0x1a0
> PGD 1e17c0c067 P4D 1e17c0c067 PUD 1e17c0e067 PMD 0
> Oops: 0002 [#1] SMP
> CPU: 43 PID: 1958 Comm: rsyslogd Tainted: G        W       4.13.0+ #184
> task: ffff9eb5e8780080 task.stack: ffffb648a08cc000
> RIP: 0010:__memmove+0x24/0x1a0
> RSP: 0018:ffffb648a08cfef0 EFLAGS: 00252097
> RAX: ffffffffffffffd8 RBX: ffffffffffffff50 RCX: 0000000000000028
> RDX: 0000000000000028 RSI: ffffb648a08cffd8 RDI: ffffffffffffffd8
> RBP: ffffb648a08cff10 R08: ffffb648a08d0000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
> R13: ffffb648a08cff20 R14: 00007fffef2ed9a8 R15: 0000000000000000
> FS:  00007f05281eff80(0000) GS:ffff9eb5ff5c0000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffffffffffd8 CR3: 000000302857c002 CR4: 00000000001606e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> ? fixup_bad_iret+0x3c/0x60
>   error_entry+0xb4/0xc0
> ? general_protection+0xc/0x30
> Code: 90 90 90 90 90 90 90 48 89 f8 48 83 fa 20 0f 82 03 01 00 00 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f 9f 00 00 00 48 89 d1 <f3> a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 3b 48 83 ea 20
> RIP: __memmove+0x24/0x1a0 RSP: ffffb648a08cfef0
> CR2: ffffffffffffffd8

Ugh, weird.  It kind of looks like current->thread.sp0 == NULL.  I
have a patch series that changes a bunch of that code in my git tree,
but that's definitely not in Linus' tree.