linux-kernel - Re: [bug?] s390: kernel panic on specification exception: 0006

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c2436d8ae2cb94b6f029e8f0291e22be@linux.ibm.com>
Date: Tue, 20 May 2025 10:57:01 +0100
From: Ilya Leoshkevich <iii@...ux.ibm.com>
To: Heiko Carstens <hca@...ux.ibm.com>
Cc: Ihor Solodrai <ihor.solodrai@...ux.dev>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [bug?] s390: kernel panic on specification exception: 0006

On 2025-05-20 10:47, Heiko Carstens wrote:
> [full quote, and adding Ilya]
> 
> On Thu, May 15, 2025 at 07:04:20PM +0000, Ihor Solodrai wrote:
>> Hi everyone.
>> 
>> Stumbled on the following while testing unrelated changes to BPF CI 
>> scripts:
>> 
>>     #353     select_reuseport:OK
>>     specification exception: 0006 ilc:2 [#1]SMP
>>     Modules linked in: bpf_testmod(OE) [last unloaded: 
>> bpf_test_modorder_x(OE)]
>>     CPU: 0 UID: 0 PID: 108 Comm: new_name Tainted: G           OE      
>>  6.15.0-rc4-g169491540638-dirty #1 NONE
>>     Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
>>     Hardware name: IBM 8561 LT1 400 (KVM/Linux)
>>     Krnl PSW : 0404e00180000000 000001e43ac595e4 
>> (hrtimer_interrupt+0x4/0x2a0)
>>                R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 
>> EA:3
>>     Krnl GPRS: 7fffffffffffffff 000001e43ac595e0 00000000fff8f200 
>> 000001e43c52a0c0
>>                00000164c50740d8 0000000000000000 0000000000000000 
>> 0000000000000000
>>                0000000000000000 0000000000000000 000001643afabe00 
>> 0000000000000000
>>                000003ff9fbadf98 000001e43b747550 000001e43ab12774 
>> 00000000fffdfe68
>>     Krnl Code:#000001e43ac595e0: 67756573		mxd	%f7,1395(%r5,%r6)
>>               >000001e43ac595e4: 743d696e		unknown
>>                000001e43ac595e8: 73303031		unknown
>>                000001e43ac595ec: 61652c64		unknown
>>                000001e43ac595f0: 65627567		unknown
>>                000001e43ac595f4: 2d74		ddr	%f7,%f4
>>                000001e43ac595f6: 68726561		ld	%f7,1377(%r2,%r6)
>>                000001e43ac595fa: 64733d6f		unknown
>>     Call Trace:
>>      [<000001e43ac595e4>] hrtimer_interrupt+0x4/0x2a0
>>      [<000001e43ab128ca>] do_irq_async+0x5a/0x78
>>      [<000001e43b65f694>] do_ext_irq+0xac/0x168
>>      [<000001e43b66ae90>] ext_int_handler+0xc8/0xf8
>>     Last Breaking-Event-Address:
>>      [<000001e43ab08a9e>] clock_comparator_work+0x2e/0x30
>>     Kernel panic - not syncing: Fatal exception in interrupt
>> 
>> This is on the current tip of bpf-next (9325d53fe9ad).
>> 
>> Job: 
>> https://github.com/kernel-patches/vmtest/actions/runs/15051985809/job/42309244372
>> You can download full logs from there.
>> 
>> It only happened once so far, didn't repeat on restart.
> 
> Looks like the text section, which contains the hrtimer_interrupt
> function, got corrupted, and an ASCII string was written there.
> The hexdump above with the corrupted code translates to the following
> ASCII text: "guest=ins001ae,debug-threads=o".
> 
> Does that ring a bell?

This looks like a part of the following QEMU config:

static QemuOptsList qemu_name_opts = {
     .name = "name",
     .implied_opt_name = "guest",
     .merge_lists = true,
     .head = QTAILQ_HEAD_INITIALIZER(qemu_name_opts.head),
     .desc = {
         {
             .name = "guest",
             .type = QEMU_OPT_STRING,
             .help = "Sets the name of the guest.\n"
                     "This name will be displayed in the SDL window 
caption.\n"
                     "The name will also be used for the VNC server",
         }, {
             .name = "process",
             .type = QEMU_OPT_STRING,
             .help = "Sets the name of the QEMU process, as shown in top 
etc",
         }, {
             .name = "debug-threads",
             .type = QEMU_OPT_BOOL,
             .help = "When enabled, name the individual threads; defaults 
off.\n"
                     "NOTE: The thread names are for debugging and not 
a\n"
                     "stable API.",
         },
         { /* End of list */ }
     },
};

Can it be that the hypervisor has corrupted guest memory?
But I'm not sure what exactly in the CI software stack can specify these 
values.
I checked vmtest, and it doesn't seem to use debug-threads.