linux-kernel - Re: next-20250605: Test regression: qemu-x86_64-compat mode ltp tracing Oops int3 kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250619100028.7ec6e40b@batman.local.home>
Date: Thu, 19 Jun 2025 10:00:28 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
Cc: Naresh Kamboju <naresh.kamboju@...aro.org>, open list
 <linux-kernel@...r.kernel.org>, Linux trace kernel
 <linux-trace-kernel@...r.kernel.org>, lkft-triage@...ts.linaro.org, Stephen
 Rothwell <sfr@...b.auug.org.au>, Arnd Bergmann <arnd@...db.de>, Dan
 Carpenter <dan.carpenter@...aro.org>, Anders Roxell
 <anders.roxell@...aro.org>
Subject: Re: next-20250605: Test regression: qemu-x86_64-compat mode ltp
 tracing Oops int3 kernel panic

On Wed, 18 Jun 2025 08:40:22 +0900
Masami Hiramatsu (Google) <mhiramat@...nel.org> wrote:


> > I would add more of what you found above in the change log. And the issue
> > that was triggered I don't think was because of a buffer overflow. It was
> > because an entry was added to the text_poke_array out of order causing the
> > bsearch to fail.  
> 
> There are two patterns of bugs I saw, one is "Oops: int3" and another is
> "#PF in smp_text_poke_batch_finish (or smp_text_poke_int3_handler)".
> The latter comes from buffer overflow.
> 
> -----
> [  164.164215] BUG: unable to handle page fault for address: ffffffff32c00000
> [  164.166999] #PF: supervisor read access in kernel mode
> [  164.169096] #PF: error_code(0x0000) - not-present page
> [  164.171143] PGD 8364b067 P4D 8364b067 PUD 0 
> [  164.172954] Oops: Oops: 0000 [#1] SMP PTI
> [  164.174581] CPU: 4 UID: 0 PID: 2702 Comm: sh Tainted: G        W           6.15.0-next-20250606-00002-g75b4e49588c2 #239 PREEMPT(voluntary) 
> [  164.179193] Tainted: [W]=WARN
> [  164.180926] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [  164.184696] RIP: 0010:smp_text_poke_batch_finish+0xb9/0x400
> [  164.186873] Code: e4 4c 8d 6d c2 85 c9 74 39 48 63 03 b9 01 00 00 00 4c 89 ea 41 83 c4 01 48 c7 c7 d0 f7 f7 b2 48 83 c3 10 48 8d b0 00 00 c0 b2 <0f> b6 80 00 00 c0 b2 88 43 ff e8 68 e3 ff ff 44 3b 25 d1 29 5f 02
> -----
> 
> This is because smp_text_poke_single() overwrites the
> text_poke_array.vec[TEXT_POKE_ARRAY_MAX], which is nr_entries (and
> the variables next to text_poke_array.)

Interesting. It must be that the stress test was able to get in and add
a bunch of individual entries while a batch was being performed.

Still, both are a bug and solved by the same solution ;-)

(Two for the price of one!)

-- Steve