| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4d300f38-f906-4246-908a-3b9d757a9660@suse.com>
Date: Thu, 26 Oct 2023 08:33:17 +0200
From: Juergen Gross <jgross@...e.com>
To: kernel test robot <oliver.sang@...el.com>
Cc: oe-lkp@...ts.linux.dev, lkp@...el.com,
Peter Zijlstra <peterz@...radead.org>,
linux-kernel@...r.kernel.org,
virtualization@...ts.linux-foundation.org, x86@...nel.org,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
"H. Peter Anvin" <hpa@...or.com>, Ajay Kaher <akaher@...are.com>,
Alexey Makhalov <amakhalov@...are.com>,
VMware PV-Drivers Reviewers <pv-drivers@...are.com>
Subject: Re: [PATCH v3 4/5] x86/paravirt: switch mixed paravirt/alternative
calls to alternative_2
On 26.10.23 04:44, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:unable_to_handle_page_fault_for_address" on:
>
> commit: b0b8b06548f7984351b503ec5f5c13fa80bae6a2 ("[PATCH v3 4/5] x86/paravirt: switch mixed paravirt/alternative calls to alternative_2")
> url: https://github.com/intel-lab-lkp/linux/commits/Juergen-Gross/x86-paravirt-move-some-functions-and-defines-to-alternative/20231019-171709
> base: https://git.kernel.org/cgit/virt/kvm/kvm.git queue
> patch link: https://lore.kernel.org/all/20231019091520.14540-5-jgross@suse.com/
> patch subject: [PATCH v3 4/5] x86/paravirt: switch mixed paravirt/alternative calls to alternative_2
>
> in testcase: boot
>
> compiler: gcc-12
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
> +---------------------------------------------+------------+------------+
> | | efa1a70f0b | b0b8b06548 |
> +---------------------------------------------+------------+------------+
> | BUG:unable_to_handle_page_fault_for_address | 0 | 14 |
> | Oops:#[##] | 0 | 14 |
> | EIP:apply_alternatives | 0 | 14 |
> | Kernel_panic-not_syncing:Fatal_exception | 0 | 14 |
> +---------------------------------------------+------------+------------+
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@...el.com>
> | Closes: https://lore.kernel.org/oe-lkp/202310261032.76a10bc0-oliver.sang@intel.com
>
>
> [ 1.382500][ T0] BUG: unable to handle page fault for address: 84864e91
> [ 1.383633][ T0] #PF: supervisor read access in kernel mode
> [ 1.384579][ T0] #PF: error_code(0x0000) - not-present page
> [ 1.384579][ T0] *pde = 00000000
> [ 1.384579][ T0] Oops: 0000 [#1] PREEMPT SMP
> [ 1.384579][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.6.0-rc5-00101-gb0b8b06548f7 #1 7cb7f016c05986cc453a3ae4b37cd3712c62c0c0
> [ 1.384579][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> [ 1.384579][ T0] EIP: apply_alternatives (arch/x86/kernel/alternative.c:419 arch/x86/kernel/alternative.c:489)
> [ 1.384579][ T0] Code: 3c 06 0f 85 4e 02 00 00 8b 85 ec fe ff ff 80 38 ff 0f 85 3f 02 00 00 80 78 01 15 0f 85 35 02 00 00 8b 8d ec fe ff ff 8b 41 02 <8b> 44 01 06 85 c0 74 17 89 c2 81 ea 60 18 7c c2 01 95 f3 fe ff ff
> All code
> ========
> 0: 3c 06 cmp $0x6,%al
> 2: 0f 85 4e 02 00 00 jne 0x256
> 8: 8b 85 ec fe ff ff mov -0x114(%rbp),%eax
> e: 80 38 ff cmpb $0xff,(%rax)
> 11: 0f 85 3f 02 00 00 jne 0x256
> 17: 80 78 01 15 cmpb $0x15,0x1(%rax)
> 1b: 0f 85 35 02 00 00 jne 0x256
> 21: 8b 8d ec fe ff ff mov -0x114(%rbp),%ecx
> 27: 8b 41 02 mov 0x2(%rcx),%eax
> 2a:* 8b 44 01 06 mov 0x6(%rcx,%rax,1),%eax <-- trapping instruction
> 2e: 85 c0 test %eax,%eax
> 30: 74 17 je 0x49
> 32: 89 c2 mov %eax,%edx
> 34: 81 ea 60 18 7c c2 sub $0xc27c1860,%edx
> 3a: 01 95 f3 fe ff ff add %edx,-0x10d(%rbp)
>
> Code starting with the faulting instruction
> ===========================================
> 0: 8b 44 01 06 mov 0x6(%rcx,%rax,1),%eax
> 4: 85 c0 test %eax,%eax
> 6: 74 17 je 0x1f
> 8: 89 c2 mov %eax,%edx
> a: 81 ea 60 18 7c c2 sub $0xc27c1860,%edx
> 10: 01 95 f3 fe ff ff add %edx,-0x10d(%rbp)
> [ 1.384579][ T0] EAX: c37e7374 EBX: c37b7e3a ECX: c107db17 EDX: 00000005
> [ 1.384579][ T0] ESI: c3ffc70a EDI: 00000000 EBP: c37b7f48 ESP: c37b7e00
> [ 1.384579][ T0] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00210246
> [ 1.384579][ T0] CR0: 80050033 CR2: 84864e91 CR3: 04037000 CR4: 000406d0
> [ 1.384579][ T0] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [ 1.384579][ T0] DR6: fffe0ff0 DR7: 00000400
> [ 1.384579][ T0] Call Trace:
> [ 1.384579][ T0] ? show_regs (arch/x86/kernel/dumpstack.c:479)
> [ 1.384579][ T0] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)
> [ 1.384579][ T0] ? oops_enter (kernel/panic.c:627)
> [ 1.384579][ T0] ? page_fault_oops (arch/x86/mm/fault.c:707)
> [ 1.384579][ T0] ? kernelmode_fixup_or_oops+0x9c/0xf4
> [ 1.384579][ T0] ? __bad_area_nosemaphore+0x13f/0x260
> [ 1.384579][ T0] ? insn_get_opcode (arch/x86/lib/insn.c:299)
> [ 1.384579][ T0] ? insn_get_modrm (arch/x86/lib/insn.c:344)
> [ 1.384579][ T0] ? insn_get_sib (arch/x86/lib/insn.c:422)
> [ 1.384579][ T0] ? bad_area_nosemaphore (arch/x86/mm/fault.c:867)
> [ 1.384579][ T0] ? do_user_addr_fault (arch/x86/mm/fault.c:1476)
> [ 1.384579][ T0] ? optimize_nops (arch/x86/kernel/alternative.c:246)
> [ 1.384579][ T0] ? exc_page_fault (arch/x86/include/asm/irqflags.h:26 arch/x86/include/asm/irqflags.h:67 arch/x86/include/asm/irqflags.h:127 arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561)
> [ 1.384579][ T0] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1518)
> [ 1.384579][ T0] ? handle_exception (arch/x86/entry/entry_32.S:1049)
> [ 1.384579][ T0] ? ___pte_free_tlb (arch/x86/include/asm/paravirt.h:92 arch/x86/mm/pgtable.c:57)
> [ 1.384579][ T0] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1518)
> [ 1.384579][ T0] ? apply_alternatives (arch/x86/kernel/alternative.c:419 arch/x86/kernel/alternative.c:489)
> [ 1.384579][ T0] ? pvclock_clocksource_read_nowd (arch/x86/mm/fault.c:1518)
> [ 1.384579][ T0] ? apply_alternatives (arch/x86/kernel/alternative.c:419 arch/x86/kernel/alternative.c:489)
> [ 1.384579][ T0] ? lock_acquire (kernel/locking/lockdep.c:5670 kernel/locking/lockdep.c:5744)
> [ 1.384579][ T0] ? ___pte_free_tlb (arch/x86/include/asm/paravirt.h:92 arch/x86/mm/pgtable.c:57)
> [ 1.384579][ T0] alternative_instructions (arch/x86/kernel/alternative.c:1677)
> [ 1.384579][ T0] ? fpu__init_cpu (arch/x86/kernel/fpu/init.c:54)
> [ 1.384579][ T0] arch_cpu_finalize_init (arch/x86/kernel/cpu/common.c:2407)
> [ 1.384579][ T0] start_kernel (init/main.c:1035)
> [ 1.384579][ T0] ? set_init_arg (init/main.c:530)
> [ 1.384579][ T0] i386_start_kernel (arch/x86/kernel/head32.c:74)
> [ 1.384579][ T0] startup_32_smp (arch/x86/kernel/head_32.S:305)
> [ 1.384579][ T0] Modules linked in:
> [ 1.384579][ T0] CR2: 0000000084864e91
> [ 1.384579][ T0] ---[ end trace 0000000000000000 ]---
> [ 1.384579][ T0] EIP: apply_alternatives (arch/x86/kernel/alternative.c:419 arch/x86/kernel/alternative.c:489)
> [ 1.384579][ T0] Code: 3c 06 0f 85 4e 02 00 00 8b 85 ec fe ff ff 80 38 ff 0f 85 3f 02 00 00 80 78 01 15 0f 85 35 02 00 00 8b 8d ec fe ff ff 8b 41 02 <8b> 44 01 06 85 c0 74 17 89 c2 81 ea 60 18 7c c2 01 95 f3 fe ff ff
> All code
> ========
> 0: 3c 06 cmp $0x6,%al
> 2: 0f 85 4e 02 00 00 jne 0x256
> 8: 8b 85 ec fe ff ff mov -0x114(%rbp),%eax
> e: 80 38 ff cmpb $0xff,(%rax)
> 11: 0f 85 3f 02 00 00 jne 0x256
> 17: 80 78 01 15 cmpb $0x15,0x1(%rax)
> 1b: 0f 85 35 02 00 00 jne 0x256
> 21: 8b 8d ec fe ff ff mov -0x114(%rbp),%ecx
> 27: 8b 41 02 mov 0x2(%rcx),%eax
> 2a:* 8b 44 01 06 mov 0x6(%rcx,%rax,1),%eax <-- trapping instruction
> 2e: 85 c0 test %eax,%eax
> 30: 74 17 je 0x49
> 32: 89 c2 mov %eax,%edx
> 34: 81 ea 60 18 7c c2 sub $0xc27c1860,%edx
> 3a: 01 95 f3 fe ff ff add %edx,-0x10d(%rbp)
>
> Code starting with the faulting instruction
> ===========================================
> 0: 8b 44 01 06 mov 0x6(%rcx,%rax,1),%eax
> 4: 85 c0 test %eax,%eax
> 6: 74 17 je 0x1f
> 8: 89 c2 mov %eax,%edx
> a: 81 ea 60 18 7c c2 sub $0xc27c1860,%edx
> 10: 01 95 f3 fe ff ff add %edx,-0x10d(%rbp)
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20231026/202310261032.76a10bc0-oliver.sang@intel.com
Yay, 32-bit code.
I'll update the patch to consider X86_32, which has no %rip relative indirect
call.
Juergen
Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3099 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (496 bytes)
Powered by blists - more mailing lists