linux-kernel - Re: [linux-next][DLPAR CPU][Oops] Bad kernel stack pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Sep 2017 22:26:10 +1000
From:   Michael Ellerman <mpe@...erman.id.au>
To:     Abdul Haleem <abdhalee@...ux.vnet.ibm.com>
Cc:     linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        linux-next <linux-next@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Rob Herring <robh@...nel.org>,
        Paul Mackerras <paulus@...ba.org>
Subject: Re: [linux-next][DLPAR CPU][Oops] Bad kernel stack pointer

Abdul Haleem <abdhalee@...ux.vnet.ibm.com> writes:

> On Wed, 2017-09-20 at 21:42 +1000, Michael Ellerman wrote:
>> Abdul Haleem <abdhalee@...ux.vnet.ibm.com> writes:
>> 
>> > Hi,
>> >
>> > Dynamic CPU remove operation resulted in Kernel Panic on today's
>> > next-20170915 kernel.
>> >
>> > Machine Type: Power 7 PowerVM LPAR
>> > Kernel : 4.13.0-next-20170915
>> > config : attached
>> > test: DLPAR CPU remove
>> >
>> >
>> > dmesg logs:
>> > ----------
>> > cpu 37 (hwid 37) Ready to die...
>> > cpu 38 (hwid 38) Ready to die...
>> > cpu 39 (hwid 39)
>> > ******* RTAS CReady to die...
>> > ALL BUFFER CORRUPTION *******
>> 
>> Cool. Does that come from RTAS itself? I have never seen that happen
>> before.
>
> Not sure, the var logs does not have any messages captured. This is
> first time we hit this type of issue.

Yeah it is from RTAS:

# lsprop /proc/device-tree/rtas/linux,rtas-base 
/proc/device-tree/rtas/linux,rtas-base
		 1eca0000 (516554752)
# lsprop /proc/device-tree/rtas/rtas-size
/proc/device-tree/rtas/rtas-size
		 01360000 (20316160)

# dd if=/dev/mem bs=4096 skip=126112 count=4960 of=rtas.bin
# strings rtas.bin | grep "RTAS CALL BUFFER"
******* RTAS CALL BUFFER CORRUPTION *******


So we were doing an RTAS call and RTAS itself detected that the call
buffer was corrupted. I'm not sure how it detects that, but something is
definitely screwed up.

>> Is this easily reproducible?
>
> I am unable to reproduce it again. I will keep an eye on our CI runs for
> few more runs.

OK thanks.

cheers