linux-kernel - Re: [PATCH 5.4 086/255] once: add DO_ONCE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y15+X1VJ5xdt1642@kroah.com>
Date:   Sun, 30 Oct 2022 14:38:39 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Oleksandr Tymoshenko <ovt@...gle.com>
Cc:     christophe.leroy@...roup.eu, davem@...emloft.net,
        edumazet@...gle.com, linux-kernel@...r.kernel.org,
        sashal@...nel.org, stable@...r.kernel.org, w@....eu
Subject: Re: [PATCH 5.4 086/255] once: add DO_ONCE_SLOW() for sleepable
 contexts

On Sat, Oct 29, 2022 at 01:12:11AM +0000, Oleksandr Tymoshenko wrote:
> Hello,
> 
> This commit causes the following panic in kernel built with clang
> (GCC build is not affected): 
> 
> [    8.320308] BUG: unable to handle page fault for address: ffffffff97216c6a                                        [26/4066]
> [    8.330029] #PF: supervisor write access in kernel mode                                                                    
> [    8.337263] #PF: error_code(0x0003) - permissions violation 
> [    8.344816] PGD 12e816067 P4D 12e816067 PUD 12e817063 PMD 800000012e2001e1                                                 
> [    8.354337] Oops: 0003 [#1] SMP PTI                
> [    8.359178] CPU: 2 PID: 437 Comm: curl Not tainted 5.4.220 #15                                                             
> [    8.367241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015                                   
> [    8.378529] RIP: 0010:__do_once_slow_done+0xf/0xa0   
> [    8.384962] Code: 1b 84 db 74 0c 48 c7 c7 80 ce 8d 97 e8 fa e9 4a 00 84 db 0f 94 c0 5b 5d c3 66 90 55 48 89 e5 41 57 41 56 
> 53 49 89 d7 49 89 f6 <c6> 07 01 48 c7 c7 80 ce 8d 97 e8 d2 e9 4a 00 48 8b 3d 9b de c9 00                                      
> [    8.409066] RSP: 0018:ffffb764c02d3c90 EFLAGS: 00010246
> [    8.415697] RAX: 4f51d3d06bc94000 RBX: d474b86ddf7162eb RCX: 000000007229b1d6                                              
> [    8.424805] RDX: 0000000000000000 RSI: ffffffff9791b4a0 RDI: ffffffff97216c6a                                              
> [    8.434108] RBP: ffffb764c02d3ca8 R08: 0e81c130f1159fc1 R09: 1d19d60ce0b52c77                                              
> [    8.443408] R10: 8ea59218e6892b1f R11: d5260237a3c1e35c R12: ffff9c3dadd42600                                              
> [    8.452468] R13: ffffffff97910f80 R14: ffffffff9791b4a0 R15: 0000000000000000                                            
> [    8.461416] FS:  00007eff855b40c0(0000) GS:ffff9c3db7a80000(0000) knlGS:0000000000000000                                   
> [    8.471632] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033                                                              
> [    8.478763] CR2: ffffffff97216c6a CR3: 000000022ded0000 CR4: 00000000000006a0                                              
> [    8.487789] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000                                              
> [    8.496684] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400                                              
> [    8.505443] Call Trace:                                                                                                    
> [    8.508568]  __inet_hash_connect+0x523/0x530                                                                               
> [    8.513839]  ? inet_hash_connect+0x50/0x50                                                                                 
> [    8.518818]  ? secure_ipv4_port_ephemeral+0x69/0xe0
> [    8.525003]  tcp_v4_connect+0x2c5/0x410
> [    8.529858]  __inet_stream_connect+0xd7/0x360
> [    8.535329]  ? _raw_spin_unlock+0xe/0x10
> ... skipped ...
> 
> 
> The root cause is the difference in __section macro semantics between 5.4 and
> later LTS releases. On 5.4 it stringifies the argument so the ___done
> symbol is created in a bogus section ".data.once", with double quotes:
> 
> % readelf -S vmlinux | grep data.once
>   [ 5] ".data.once"      PROGBITS         ffffffff82216c6a  01416c6a

This is really odd.  I just did a bunch of build tests, and this seems
to only show up on the latest version of clang (14) and the 5.4 kernel.
Newer kernel trees are fine, and I don't see the problem showing up on
older clang releases with 5.4 (i.e. Android builds of the Android 11
release)

So this is very compiler and version dependant, ugh...

greg k-h