Colin Ian King writes via Kernel.org Bugzilla:
Passing a read-only incorrectly aligned address into getcpu() causes a kernel panic. I originally found this issue when testing stress-ng using stress-ng --sysbadaddr 1, I've managed to make a short reproducer that can panic the kernel on every invocation of the program.
I can reproduce this on mainline kernels (in Debian), tested and reproduced on kernels 6.6.15, 6.9.7 and 6.10.6, so it's been around a while and it's still reproducible on recent kernels.
This only occurs on PA-RISC (hppa) kernels and only tested in a QEMU VM since I don't have access to real H/W.
cking@hppa:~$ cat crash.c
#define _GNU_SOURCE
#include <sched.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>
void main(void)
{
char *addr;
addr = mmap(NULL, 4096, PROT_READ, MAP_ANONYMOUS | MAP_SHARED, -1, 0);
if (addr != MAP_FAILED)
getcpu((int *)addr, (int *)(1 + addr));
}
cking@hppa:~$ gcc crash.c -o crash
cking@hppa:~$ ./crash
[ 361.158650] Backtrace:
[ 361.159621] [<10413c78>] handle_unaligned+0x590/0x710
[ 361.159621] [<10409354>] handle_interruption+0x1dc/0x7b8
[ 361.159621] [<104545d8>] sys_getcpu+0x30/0x74
[ 361.159621]
[ 361.159621]
[ 361.159621] Page fault: bad address: Code=26 (Data memory access rights trap) at addr f9000000
[ 361.159621] CPU: 2 PID: 749 Comm: crash Not tainted 6.6.15-parisc #1 Debian 6.6.15-2
[ 361.159621] Hardware name: 9000/778/B160L
[ 361.159621]
[ 361.159621] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
[ 361.159621] PSW: 00000000000001000000000000001111 Not tainted
[ 361.159621] r00-03 0004000f 00000000 10413c78 142903c0
[ 361.159621] r04-07 14290080 12a08000 fc000000 f9000001
[ 361.159621] r08-11 00000000 0f3dd280 f9099c20 f9096e58
[ 361.159621] r12-15 00011008 0119c228 00000000 00000001
[ 361.159621] r16-19 14290080 00138428 011b4e00 ff000000
[ 361.159621] r20-23 00000000 00000000 00000000 00000011
[ 361.159621] r24-27 00000000 00000000 14290080 110dd848
[ 361.159621] r28-31 f9000000 00000000 14290400 000003c3
[ 361.159621] sr00-03 000003c3 000003c3 00000000 000003c3
[ 361.159621] sr04-07 00000000 00000000 00000000 00000000
[ 361.159621]
[ 361.159621] IASQ: 00000000 00000000 IAOQ: 104135ac 104135b0
[ 361.170517] IIR: 0f945280 ISR: 000003c3 IOR: f9000000
[ 361.170517] CPU: 2 CR30: 12a08000 CR31: 00000000
[ 361.170517] ORIG_R28: 12a08000
[ 361.170517] IAOQ[0]: emulate_stw+0x5c/0x94
[ 361.170517] IAOQ[1]: emulate_stw+0x60/0x94
[ 361.170517] RP(r2): handle_unaligned+0x590/0x710
[ 361.170517] Backtrace:
[ 361.170517] [<10413c78>] handle_unaligned+0x590/0x710
[ 361.170517] [<10409354>] handle_interruption+0x1dc/0x7b8
[ 361.170517] [<104545d8>] sys_getcpu+0x30/0x74
[ 361.170517]
[ 361.170517] Kernel panic - not syncing: Page fault: bad address
[ 361.170517] ---[ end Kernel panic - not syncing: Page fault: bad address ]---
View: https://bugzilla.kernel.org/show_bug.cgi?id=219339#c0
You can reply to this message to join the discussion.
--
Deet-doot-dot, I am a bot.
Kernel.org Bugzilla (bugspray 0.1-dev)
