netdev - Re: v4.14-rc3/arm64 DABT exception in atomic_inc() / __skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171020091823.GA18282@arm.com>
Date:   Fri, 20 Oct 2017 10:18:23 +0100
From:   Will Deacon <will.deacon@....com>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     Wei Wei <dotweiba@...il.com>,
        Willem de Bruijn <willemb@...gle.com>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        David Miller <davem@...emloft.net>,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: v4.14-rc3/arm64 DABT exception in atomic_inc() / __skb_clone()

On Thu, Oct 19, 2017 at 10:34:54PM -0700, Eric Dumazet wrote:
> On Thu, Oct 19, 2017 at 8:13 PM, Wei Wei <dotweiba@...il.com> wrote:
> > Code: f9406680 8b010000 91009000 f9800011 (885f7c01)
> > All code
> > ========
> >    0:   80 66 40 f9             andb   $0xf9,0x40(%rsi)
> >    4:   00 00                   add    %al,(%rax)
> >    6:   01 8b 00 90 00 91       add    %ecx,-0x6eff7000(%rbx)
> >    c:   11 00                   adc    %eax,(%rax)
> >    e:   80 f9 01                cmp    $0x1,%cl
> >   11:   7c 5f                   jl     0x72
> >   13:*  88 00                   mov    %al,(%rax)               <-- trapping instruction
> >   15:   00 00                   add    %al,(%rax)
> >         ...
> >
> > Code starting with the faulting instruction
> > ===========================================
> >    0:   01 7c 5f 88             add    %edi,-0x78(%rdi,%rbx,2)
> >    4:   00 00                   add    %al,(%rax)
> >         ...
> > —[ end trace 261e7ac1458ccc0a ]---
> >
> 
> I thought it was happening on arm64 ?
> 
> This is x86_64 disassembly :/

I guess they forgot the ARCH/CROSS_COMPILE env vars for decodecode. here
you go:

Code: f9406680 8b010000 91009000 f9800011 (885f7c01)
All code
========
   0:	f9406680 	ldr	x0, [x20,#200]
   4:	8b010000 	add	x0, x0, x1
   8:	91009000 	add	x0, x0, #0x24
   c:	f9800011 	prfm	pstl1strm, [x0]
  10:*	885f7c01 	ldxr	w1, [x0]		<-- trapping instruction

Code starting with the faulting instruction
===========================================
   0:	885f7c01 	ldxr	w1, [x0]

so it's faulting on the load part of an atomic rmw.

Will