linux-kernel - Re: Oops on /proc/interrupt access with 6.5-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86a5w2wc2d.wl-maz@kernel.org>
Date:   Tue, 11 Jul 2023 19:14:02 +0100
From:   Marc Zyngier <maz@...nel.org>
To:     Johan Hovold <johan@...nel.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Shanker Donthineni <sdonthineni@...dia.com>,
        Konrad Dybcio <konrad.dybcio@...aro.org>,
        linux-kernel@...r.kernel.org
Subject: Re: Oops on /proc/interrupt access with 6.5-rc1

On Tue, 11 Jul 2023 16:51:10 +0100,
Johan Hovold <johan@...nel.org> wrote:
> 
> Hi,
> 
> Konrad reported on IRC that he hit a segfault and hang when watch:ing
> /proc/interrupts with 6.5-rc1.
> 
> I tried simply catting it and hit the below oops immediately with my
> X13s (aarch64).
> 
> Commit 721255b9826b ("genirq: Use a maple tree for interrupt descriptor
> management") stood out when skimming the log, and Marc soon suggested
> the same possible culprit on IRC.
> 
> I have not been able to reproduce it with the maple tree patch reverted,
> but I hit it again after adding it back. Did not trigger immediately
> after boot though, I had had the machine idling for a few minutes in
> between.
> 
> Marc asked for a dump so figured I'd CC the list as well.

Thanks for that. I've been trying to reproduce this locally, but
failed so far. I'll try a different part of the zoo to see if I get
more luck.

I wonder if you have a driver that periodically allocates an interrupt
and then frees it...

[...]

> [ 2546.693932] Unable to handle kernel paging request at virtual address ffff80008106bb19

The VA seems legitimate, and not unusual for a string.

> [ 2546.695148] Mem abort info:
> [ 2546.695562]   ESR = 0x0000000096000007
> [ 2546.695976]   EC = 0x25: DABT (current EL), IL = 32 bits
> [ 2546.696394]   SET = 0, FnV = 0
> [ 2546.696807]   EA = 0, S1PTW = 0
> [ 2546.697220]   FSC = 0x07: level 3 translation fault
> [ 2546.697642] Data abort info:
> [ 2546.698066]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
> [ 2546.698494]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0

This is a read, but we don't have any valid syndrome information.

Could you try and enable KASAN?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.