linux-kernel - Re: Unexpected kernel BRK exception at EL1 - Internal error: BRK handler: f20003e8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 16 May 2022 15:48:57 +0100
From:   Marc Zyngier <maz@...nel.org>
To:     Naresh Kamboju <naresh.kamboju@...aro.org>
Cc:     open list <linux-kernel@...r.kernel.org>,
        Linux-Next Mailing List <linux-next@...r.kernel.org>,
        lkft-triage@...ts.linaro.org,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Thomas Gleixner <tglx@...utronix.de>, pali@...nel.org,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: Unexpected kernel BRK exception at EL1 - Internal error: BRK handler: f20003e8 - gic_dist_config

On Mon, 16 May 2022 14:58:28 +0100,
Naresh Kamboju <naresh.kamboju@...aro.org> wrote:
> 
> Hi Marc,
> 
> Thanks for looking into this report.
> 
> On Mon, 16 May 2022 at 12:38, Marc Zyngier <maz@...nel.org> wrote:
> >
> > On Mon, 16 May 2022 07:16:22 +0100,
> > Naresh Kamboju <naresh.kamboju@...aro.org> wrote:
> > >
> > > The kernel crash reported on arm64 juno-r2 device with kselftest-merge config
> > > while booting Linux next-20220513 kernel  [1].
> 
> <trim>
> 
> >
> > Huh. Who inserts random BRKs like this?
> >
> > > [    0.000000] Internal error: BRK handler: f20003e8 [#1] PREEMPT SMP
> > > [    0.000000] Modules linked in:
> > > [    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
> > > 5.18.0-rc6-next-20220513 #1
> > > [    0.000000] Hardware name: ARM Juno development board (r2) (DT)
> > > [    0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > > [    0.000000] pc : gic_dist_config+0x4c/0x68
> > > [    0.000000] lr : gic_init_bases+0xd4/0x248
> >
> > Please provide a disassembly of this function.
> 
> objdump snipper is here.
> http://ix.io/3XUW

Wrong function (I wasn't clear I wanted the breaking function, not the
caller).

> The vmlinux file is located in this url
> Please make use of it.
> http://snapshots.linaro.org/openembedded/lkft/lkft/sumo/juno/lkft/linux-next/1226/

ffff8000087f9908 <gic_dist_config>:
ffff8000087f9908:       a9bd7bfd        stp     x29, x30, [sp, #-48]!
ffff8000087f990c:       910003fd        mov     x29, sp
ffff8000087f9910:       a90153f3        stp     x19, x20, [sp, #16]
ffff8000087f9914:       f90013f5        str     x21, [sp, #32]
ffff8000087f9918:       2a0103f3        mov     w19, w1
ffff8000087f991c:       aa0003f4        mov     x20, x0
ffff8000087f9920:       aa0203f5        mov     x21, x2
ffff8000087f9924:       aa1e03e0        mov     x0, x30
ffff8000087f9928:       97e0de72        bl      ffff8000080312f0 <_mcount>
ffff8000087f992c:       7100827f        cmp     w19, #0x20
ffff8000087f9930:       54000149        b.ls    ffff8000087f9958 <gic_dist_config+0x50>  // b.plast
ffff8000087f9934:       52800402        mov     w2, #0x20                       // #32
ffff8000087f9938:       53027c40        lsr     w0, w2, #2
ffff8000087f993c:       91300000        add     x0, x0, #0xc00
ffff8000087f9940:       8b000280        add     x0, x20, x0
ffff8000087f9944:       b900001f        str     wzr, [x0]
ffff8000087f9948:       11004042        add     w2, w2, #0x10
ffff8000087f994c:       6b02027f        cmp     w19, w2
ffff8000087f9950:       54ffff48        b.hi    ffff8000087f9938 <gic_dist_config+0x30>  // b.pmore
ffff8000087f9954:       d4207d00        brk     #0x3e8

What the hell is this??? This function has no WARN_ON, no BUG_ON, the
allowed values for the immediate are:

#define KPROBES_BRK_IMM                 0x004
#define UPROBES_BRK_IMM                 0x005
#define KPROBES_BRK_SS_IMM              0x006
#define FAULT_BRK_IMM                   0x100
#define KGDB_DYN_DBG_BRK_IMM            0x400
#define KGDB_COMPILED_DBG_BRK_IMM       0x401
#define BUG_BRK_IMM                     0x800
#define KASAN_BRK_IMM                   0x900
#define KASAN_BRK_MASK                  0x0ff

and 0x3e8 isn't one of them. This seems like a GCC 'division by zero'
hack, but there are no divisions by zero here. Your kernel is also
full of the stuff.

What sort of odd options do you have? I can't help but notice that you
have the Rust stuff in your tree. Can you please start by disabling
this, just in case there is an interaction with your toolchain?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.