linux-kernel - [Bug] "BUG: soft lockup in unwind_get_return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP=Rh=OLo895nvSSXq5Z2Ubzs-eDtAfg6gHDineqF3NEap+rwQ@mail.gmail.com>
Date: Thu, 22 May 2025 23:09:13 +0800
From: John <john.cs.hey@...il.com>
To: Josh Poimboeuf <jpoimboe@...nel.org>, Peter Zijlstra <peterz@...radead.org>, 
	Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org
Subject: [Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

Dear Linux Kernel Maintainers,

I hope this message finds you well.

I am writing to report a potential vulnerability I encountered during
testing of the Linux Kernel version v6.15-rc5.

Git Commit: 92a09c47464d040866cf2b4cd052bc60555185fb (tag: v6.15-rc5)

Bug Location: unwind_get_return_address+0x59/0xa0
arch/x86/kernel/unwind_orc.c:364

Bug report: https://hastebin.com/share/epuwikajob.bash

Complete log: https://hastebin.com/share/sumefafijo.perl

Entire kernel config:  https://hastebin.com/share/padecilimo.ini

Root Cause Analysis:
A soft lockup occurred on CPU0 due to a recursion or deadlock
involving __sanitizer_cov_trace_pc() during KCOV instrumentation.
The traced path includes slab deallocation (kmem_cache_free), task
exit handling (exit_task_work), and stack unwinding
(unwind_next_frame), which eventually leads to a GPF caused by
dereferencing current in a stale task context (FS=0).
This can be triggered repeatedly by malformed multicast socket setups
causing repeated IGMP autojoin failures and entering
trace-instrumented paths.

At present, I have not yet obtained a minimal reproducer for this
issue. However, I am actively working on reproducing it, and I will
promptly share any additional findings or a working reproducer as soon
as it becomes available.

Thank you very much for your time and attention to this matter. I
truly appreciate the efforts of the Linux kernel community.

Best regards,
John