On Mon Mar 27, 2023 at 8:15 AM AEST, Jens Axboe wrote: > Powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which > from my (arguably very short) checking is not commonly done for other > archs. This is fine, except when PF_IO_WORKER's have been created and > the task does something that causes a coredump to be generated. Then we > get this crash:
Hey Jens, Thanks for the testing and the patch. I think your patch would work, but I'd be inclined to give the IO worker a pt_regs so it looks more like other archs and a regular user thread. Your IO worker bug reminded me to resurrect some copy_thread patches I had and I think they should do that https://lists.ozlabs.org/pipermail/linuxppc-dev/2023-March/256271.html I wouldn't ask you to test it until I've at least tried, do you have a test case that triggers this? Thanks, Nick > > Kernel attempted to read user page (160) - exploit attempt? (uid: 1000) > BUG: Kernel NULL pointer dereference on read at 0x00000160 > Faulting instruction address: 0xc0000000000c3a60 > Oops: Kernel access of bad area, sig: 11 [#1] > LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries > Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb > ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg > libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop > configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic > usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod > CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 > Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 > of:SLOF,HEAD hv:linux,kvm pSeries > NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 > REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) > MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: > 200400f8 > CFAR: c0000000000c386c DAR: 0000000000000160 DSISR: 40000000 IRQMASK: 0 > GPR00: c000000000039920 c000000004183650 c00000000175d600 c0000000040f9800 > GPR04: 0000000000000160 0000000000000008 c000000000039920 0000000000000000 > GPR08: 0000000000000000 0000000000000000 00000003fe060000 0000000000002000 > GPR12: c0000000000398e0 c0000003fffff200 c0000000015edbc0 c00000000ba2f648 > GPR16: c00000000ba2f600 c000000001616ea8 0000000000000004 00000000ffffffff > GPR20: 0000000000000048 c000000004183918 c000000001410f00 c000000001410ef8 > GPR24: c0000000040f9800 c0000000040f9800 c0000000041837b8 c0000000000398e0 > GPR28: c00000000cc4cb80 c0000000040f9800 0000000000000008 0000000000000008 > NIP [c0000000000c3a60] memcpy_power7+0x200/0x7d0 > LR [c000000000039944] ppr_get+0x64/0xb0 > Call Trace: > [c000000004183650] [c000000000039920] ppr_get+0x40/0xb0 (unreliable) > [c000000004183690] [c0000000001e5e80] __regset_get+0x180/0x1f0 > [c000000004183700] [c0000000001e5f94] regset_get_alloc+0x64/0x90 > [c000000004183740] [c0000000007ae638] elf_core_dump+0xb98/0x1b60 > [c0000000041839c0] [c0000000007bb564] do_coredump+0x1c34/0x24a0 > [c000000004183ba0] [c0000000001acf0c] get_signal+0x71c/0x1410 > [c000000004183ce0] [c0000000000228a0] do_notify_resume+0x140/0x6f0 > [c000000004183db0] [c0000000000353bc] > interrupt_exit_user_prepare_main+0x29c/0x320 > [c000000004183e20] [c00000000003579c] interrupt_exit_user_prepare+0x6c/0xa0 > [c000000004183e50] [c00000000000c6f4] interrupt_return_srr_user+0x8/0x138 > --- interrupt: 300 at 0x183ee09e0 > NIP: 0000000183ee09e0 LR: 0000000183ee09dc CTR: 800000000280f033 > REGS: c000000004183e80 TRAP: 0300 Not tainted (6.3.0-rc2+) > MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 22002848 XER: 000000f8 > CFAR: 00007ffe6d746aa8 DAR: 0000000000000000 DSISR: 42000000 IRQMASK: 0 > GPR00: 0000000183ee09dc 00007ffff20d37c0 0000000183f07f00 0000000000000000 > GPR04: 0000000000000000 00007ffff20d37a8 0000000000000000 00007ffe6d9eae00 > GPR08: 00007ffff20d3710 0000000000000000 0000000000000000 0000000000000000 > GPR12: 0000000000000000 00007ffe6d9eae00 0000000000000000 0000000000000000 > GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 > GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000183ee0860 > GPR24: 00007ffe6d9df820 00007ffe6d9e0000 00007ffff20d7d98 0000000000000001 > GPR28: 0000000183ee0c60 00007ffff20d7924 00007ffff20d7820 0000000000000000 > NIP [0000000183ee09e0] 0x183ee09e0 > LR [0000000183ee09dc] 0x183ee09dc > --- interrupt: 300 > Code: f9030018 38630020 409f001c e8040000 e8c40008 38840010 f8030000 f8c30008 > 38630010 78a50720 7cb01120 409c001c <80040000> 80c40004 38840008 90030000 > ---[ end trace 0000000000000000 ]--- > > note: ppc-crash[1982] exited with irqs disabled > > because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL > pt_regs. > > Check for a valid pt_regs in both ppc_get/ppr_set, and return an error > if not set. The actual error value doesn't seem to be important here, > so just pick -EINVAL. > > Signed-off-by: Jens Axboe <ax...@kernel.dk> > > diff --git a/arch/powerpc/kernel/ptrace/ptrace-view.c > b/arch/powerpc/kernel/ptrace/ptrace-view.c > index 2087a785f05f..80b699dd0d7f 100644 > --- a/arch/powerpc/kernel/ptrace/ptrace-view.c > +++ b/arch/powerpc/kernel/ptrace/ptrace-view.c > @@ -290,6 +290,8 @@ static int gpr_set(struct task_struct *target, const > struct user_regset *regset, > static int ppr_get(struct task_struct *target, const struct user_regset > *regset, > struct membuf to) > { > + if (!target->thread.regs) > + return -EINVAL; > return membuf_write(&to, &target->thread.regs->ppr, sizeof(u64)); > } > > @@ -297,6 +299,8 @@ static int ppr_set(struct task_struct *target, const > struct user_regset *regset, > unsigned int pos, unsigned int count, const void *kbuf, > const void __user *ubuf) > { > + if (!target->thread.regs) > + return -EINVAL; > return user_regset_copyin(&pos, &count, &kbuf, &ubuf, > &target->thread.regs->ppr, 0, sizeof(u64)); > } > > -- > Jens Axboe
