linux-kernel - [ppc64le] Boot failure kernel BUG at mm/usercopy.c:102!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <AE224519-3E62-41E3-A75D-62E7EA0E3EC7@linux.ibm.com>
Date: Mon, 25 Mar 2024 12:08:35 +0530
From: Sachin Sant <sachinp@...ux.ibm.com>
To: linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>
Cc: LKML <linux-kernel@...r.kernel.org>, Dawei Li <dawei.li@...ngroup.cn>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Rasmus Villemoes <linux@...musvillemoes.dk>,
        Yury Norov <yury.norov@...il.com>
Subject: [ppc64le] Boot failure kernel BUG at mm/usercopy.c:102!

Today’s next (6.9.0-rc1-next-20240325) fails to boot on powerpc:

[ 1.955512] usercopy: Kernel memory exposure attempt detected from SLUB object 'cpumask' (offset 0, size 16)!
[ 1.955531] ------------[ cut here ]------------
[ 1.955535] kernel BUG at mm/usercopy.c:102!
[ 1.955539] Oops: Exception in kernel mode, sig: 5 [#1]
[ 1.955543] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=8192 NUMA pSeries
[ 1.955547] Modules linked in:
[ 1.955551] CPU: 27 PID: 482 Comm: systemd-udevd Not tainted 6.9.0-rc1-next-20240325 #1
[ 1.955556] Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_018) hv:phyp pSeries
[ 1.955561] NIP: c0000000005d08d4 LR: c0000000005d08d0 CTR: 00000000006e638c
[ 1.955565] REGS: c00000005383f9f0 TRAP: 0700 Not tainted (6.9.0-rc1-next-20240325)
[ 1.955570] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2800220f XER: 00000002
[ 1.955579] CFAR: c0000000002141f0 IRQMASK: 0 
[ 1.955579] GPR00: c0000000005d08d0 c00000005383fc90 c000000001563b00 0000000000000061 
[ 1.955579] GPR04: c000000e855b7c08 c000000e8563e000 c00000005383fad8 0000000e83380000 
[ 1.955579] GPR08: 0000000000000027 c00000000223c030 0000000e83380000 0000000000000001 
[ 1.955579] GPR12: c000000002a37bd0 c000000e87be8300 0000000000000000 0000000000000000 
[ 1.955579] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
[ 1.955579] GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
[ 1.955579] GPR24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
[ 1.955579] GPR28: 0000000000000001 c000000004017200 0000000000000010 c0000000097129b0 
[ 1.955623] NIP [c0000000005d08d4] usercopy_abort+0x78/0xb0
[ 1.955630] LR [c0000000005d08d0] usercopy_abort+0x74/0xb0
[ 1.955634] Call Trace:
[ 1.955636] [c00000005383fc90] [c0000000005d08d0] usercopy_abort+0x74/0xb0 (unreliable)
[ 1.955642] [c00000005383fd00] [c0000000005424e4] __check_heap_object+0x1b0/0x1b4
[ 1.955649] [c00000005383fd40] [c0000000005d0b24] check_heap_object+0x218/0x240
[ 1.955654] [c00000005383fd80] [c0000000005d0bd0] __check_object_size+0x84/0x1a4
[ 1.955659] [c00000005383fdc0] [c0000000001c1990] sys_sched_getaffinity+0x114/0x174
[ 1.955665] [c00000005383fe10] [c000000000033498] system_call_exception+0x138/0x330
[ 1.955671] [c00000005383fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
[ 1.955678] --- interrupt: 3000 at 0x7fff8ccb72c0
[ 1.955682] NIP: 00007fff8ccb72c0 LR: 00007fff8ccb72c0 CTR: 0000000000000000
[ 1.955686] REGS: c00000005383fe80 TRAP: 3000 Not tainted (6.9.0-rc1-next-20240325)
[ 1.955690] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44002808 XER: 00000000
[ 1.955700] IRQMASK: 0 
[ 1.955700] GPR00: 00000000000000df 00007fffd97f38a0 00007fff8d337500 0000000000000000 
[ 1.955700] GPR04: 0000000000000010 0000000145511090 0000000145510010 0000000000145511 
[ 1.955700] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
[ 1.955700] GPR12: 0000000000000000 00007fff8d3e4c40 0000000110e15770 0000000110e157c8 
[ 1.955700] GPR16: 0000000110e15840 0000000110e15880 0000000110e15800 0000000110e190c0 
[ 1.955700] GPR20: 0000000000000000 0000000000000001 0000000000000001 0000000110e60000 
[ 1.955700] GPR24: 0000000110e60340 0000000110e603c8 0000000110e603c0 0000000110e60058 
[ 1.955700] GPR28: 0000000000000038 0000000000000100 0000000145511090 0000000000000010 
[ 1.955742] NIP [00007fff8ccb72c0] 0x7fff8ccb72c0
[ 1.955746] LR [00007fff8ccb72c0] 0x7fff8ccb72c0
[ 1.955749] --- interrupt: 3000
[ 1.955751] Code: 2c280000 41820050 3ce2ffe6 3d22ffe5 38e77ce8 3929c168 7c661b78 3c62ffe6 f9610060 38637cf0 4bc438dd 60000000 <0fe00000> 3c82ffe4 3ca2ffef 38846510 
[ 1.955765] ---[ end trace 0000000000000000 ]---
[ 1.957568] pstore: backend (nvram) writing error (-1)
[ 1.957572] 
[ 2.957575] Kernel panic - not syncing: Fatal exception
[ 2.963038] Rebooting in 10 seconds..

Git bisect points to following patch

commit 328c801335d5f7edf2a3c9c331ddf8978f21e2a7
    cpumask: create dedicated kmem cache for cpumask var

Have attached the boot log and .config

View attachment "boot.txt" of type "text/plain" (27226 bytes)

Download attachment "config_next" of type "application/octet-stream" (174532 bytes)



-- Sachin