linux-kernel - [RFC PATCH 1/2] x86: Retry with new instruction if INT3 is disappaered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:  <174956685825.1494782.929110313017233978.stgit@mhiramat.tok.corp.google.com>
Date: Tue, 10 Jun 2025 23:47:38 +0900
From: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>
Cc: Steven Rostedt <rostedt@...dmis.org>,
	x86@...nel.org,
	Naresh Kamboju <naresh.kamboju@...aro.org>,
	open list <linux-kernel@...r.kernel.org>,
	Linux trace kernel <linux-trace-kernel@...r.kernel.org>,
	lkft-triage@...ts.linaro.org,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Arnd Bergmann <arnd@...db.de>,
	Dan Carpenter <dan.carpenter@...aro.org>,
	Anders Roxell <anders.roxell@...aro.org>
Subject: [RFC PATCH 1/2] x86: Retry with new instruction if INT3 is disappaered

From: Masami Hiramatsu (Google) <mhiramat@...nel.org>

An Oops caused by a stray INT3 is reported by LKFT.

 ## Test log
 ftrace-stress-test: <12>[   21.971153] /usr/local/bin/kirk[277]:
 starting test ftrace-stress-test (ftrace_stress_test.sh 90)
 <4>[   58.997439] Oops: int3: 0000 [#1] SMP PTI
 <4>[   58.998089] CPU: 0 UID: 0 PID: 323 Comm: sh Not tainted
 6.15.0-next-20250605 #1 PREEMPT(voluntary)
 <4>[   58.998152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
 BIOS 1.16.3-debian-1.16.3-2 04/01/2014
 <4>[   58.998260] RIP: 0010:_raw_spin_lock+0x5/0x50
 <4>[   58.998563] Code: 5d e9 ff 12 00 00 66 66 2e 0f 1f 84 00 00 00
 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
 0f 1e fa 0f <1f> 44 00 00 55 48 89 e5 53 48 89 fb bf 01 00 00 00 e8 15
 12 e4 fe

But INT3(cc) is not shown in the dumped code. This means there is a
chance to handle an INT3 exception when the INT3 is replaecd with
the original instruction.

To evacuate the kernel from this stuation, when the kernel failed to
handle the INT3, check whether there is an INT3 at the trapped
address. If there isn't, retry executing the new instruction.

Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
Closes: https://lore.kernel.org/all/CA+G9fYsLu0roY3DV=tKyqP7FEKbOEETRvTDhnpPxJGbA=Cg+4w@mail.gmail.com/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>
---
 arch/x86/kernel/traps.c |   25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index c5c897a86418..f489e86c1b5e 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -880,6 +880,29 @@ static void do_int3_user(struct pt_regs *regs)
 	cond_local_irq_disable(regs);
 }
 
+static int handle_disappeared_int3(struct pt_regs *regs)
+{
+	unsigned long addr = instruction_pointer(regs) - INT3_INSN_SIZE;
+	unsigned char opcode;
+	int ret;
+
+	/*
+	 * Evacuate the kernel from disappeared int3, which was there when
+	 * the exception happens, but it is removed now by another CPU.
+	 */
+	ret = copy_from_kernel_nofault(&opcode, (void *)addr, INT3_INSN_SIZE);
+	if (ret < 0)
+		return ret;
+	if (opcode == INT3_INSN_OPCODE)
+		return -EFAULT;
+
+	/* There is no INT3 here. Retry with the new instruction. */
+	WARN_ONCE(1, "A disappeared INT3 was handled at %pS.", (void *)addr);
+	instruction_pointer_set(regs, addr);
+
+	return 0;
+}
+
 DEFINE_IDTENTRY_RAW(exc_int3)
 {
 	/*
@@ -907,7 +930,7 @@ DEFINE_IDTENTRY_RAW(exc_int3)
 		irqentry_state_t irq_state = irqentry_nmi_enter(regs);
 
 		instrumentation_begin();
-		if (!do_int3(regs))
+		if (!do_int3(regs) && handle_disappeared_int3(regs) < 0)
 			die("int3", regs, 0);
 		instrumentation_end();
 		irqentry_nmi_exit(regs, irq_state);