linux-kernel - Re: "stack state/frame" and "jump dest instruction" errors (was Re: Linux 6.16)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <hla34nepia6wyi2fndx5ynud4dagxd7j75xnkevtxt365ihkjj@4p746zsu6s6z>
Date: Mon, 28 Jul 2025 08:42:44 -0700
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: "Alan J. Wylie" <alan@...ie.me.uk>
Cc: linux-kernel@...r.kernel.org, regressions@...ts.linux.dev, 
	stable@...r.kernel.org, Linus Torvalds <torvalds@...ux-foundation.org>, 
	Masami Hiramatsu <mhiramat@...nel.org>
Subject: Re: "stack state/frame" and "jump dest instruction" errors (was Re:
 Linux 6.16)

On Mon, Jul 28, 2025 at 09:41:35AM +0100, Alan J. Wylie wrote:
> #regzbot introduced: 6.15.8..6.16
> 
> Linus Torvalds <torvalds@...ux-foundation.org> writes:
> 
> > It's Sunday afternoon, and the release cycle has come to an end. Last
> > week was nice and calm, and there were no big show-stopper surprises
> > to keep us from the regular schedule, so I've tagged and pushed out
> > 6.16 as planned.
> 
> Even after a "make mrproper" and "git clean -fxd" I'm seeing lots of
> warnings and errors.
> 
> can't find jump dest instruction
> stack state mismatch
> return with modified stack frame
> objtool: can't decode instruction
> can't find starting instruction
> 
> gcc (Gentoo Hardened 14.3.0 p8) 14.3.0
> 
> I selected "Y" to the new config option "X86_NATIVE_CPU"
> 
> CPU is AMD FX-8350
> 
> .config attached

The problem is likely that CONFIG_X86_NATIVE_CPU is using some
AMD-specific instruction(s) which objtool doesn't know how to decode.

Building with KCFLAGS="-march=bdver2", I see the following:

0000000000000150 <amd_uncore_df_ctx_scan>:
     150:	f3 0f 1e fa          	endbr64
     154:	e8 00 00 00 00       	call   159 <amd_uncore_df_ctx_scan+0x9>	155: R_X86_64_PLT32	__fentry__-0x4
     159:	48 8b 05 00 00 00 00 	mov    0x0(%rip),%rax        # 160 <amd_uncore_df_ctx_scan+0x10>	15c: R_X86_64_PC32	boot_cpu_data+0x2c
     160:	a9 00 00 00 01       	test   $0x1000000,%eax
     165:	74 64                	je     1cb <amd_uncore_df_ctx_scan+0x7b>
     167:	48 c7 c0 00 00 00 00 	mov    $0x0,%rax	16a: R_X86_64_32S	cpu_info
     16e:	89 f6                	mov    %esi,%esi
     170:	53                   	push   %rbx
     171:	83 3d 00 00 00 00 01 	cmpl   $0x1,0x0(%rip)        # 178 <amd_uncore_df_ctx_scan+0x28>	173: R_X86_64_PC32	.bss-0x5
     178:	48 8b 0c f5 00 00 00 00 	mov    0x0(,%rsi,8),%rcx	17c: R_X86_64_32S	__per_cpu_offset
     180:	49 89 f9             	mov    %rdi,%r9
     183:	44 8b 84 01 ec 00 00 00 	mov    0xec(%rcx,%rax,1),%r8d
     18b:	b8 04 00 00 00       	mov    $0x4,%eax
     190:	7e 1a                	jle    1ac <amd_uncore_df_ctx_scan+0x5c>
     192:	b8 22 00 00 80       	mov    $0x80000022,%eax
     197:	31 c9                	xor    %ecx,%ecx
     199:	0f a2                	cpuid
     19b:	48 8b 0c f5 00 00 00 00 	mov    0x0(,%rsi,8),%rcx	19f: R_X86_64_32S	__per_cpu_offset
     1a3:	8f ea 78 10 c3 0a 06 00 00 	bextr  $0x60a,%ebx,%eax
     1ac:	0f b6 c0             	movzbl %al,%eax
     1af:	45 0f b6 c0          	movzbl %r8b,%r8d
     1b3:	49 8b 11             	mov    (%r9),%rdx
     1b6:	49 c1 e0 30          	shl    $0x30,%r8
     1ba:	48 c1 e0 20          	shl    $0x20,%rax
     1be:	4c 09 c0             	or     %r8,%rax
     1c1:	48 89 04 0a          	mov    %rax,(%rdx,%rcx,1)
     1c5:	5b                   	pop    %rbx
     1c6:	e9 00 00 00 00       	jmp    1cb <amd_uncore_df_ctx_scan+0x7b>	1c7: R_X86_64_PLT32	__x86_return_thunk-0x4
     1cb:	e9 00 00 00 00       	jmp    1d0 <amd_uncore_l3_event_init>	1cc: R_X86_64_PLT32	__x86_return_thunk-0x4

I don't have time to look at this for at least the next few days, but I
suspect this one:

     1a3:	8f ea 78 10 c3 0a 06 00 00 	bextr  $0x60a,%ebx,%eax

in which case the kernel's x86 decoder (which objtool also uses) needs
to be updated.

-- 
Josh