Re: next-20250605: Test regression: qemu-x86_64-compat mode ltp tracing Oops int3 kernel panic

[Steven Rostedt <rostedt@goodmis.org>]

On Wed, 18 Jun 2025 08:40:22 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:


> > I would add more of what you found above in the change log. And the issue
> > that was triggered I don't think was because of a buffer overflow. It was
> > because an entry was added to the text_poke_array out of order causing the
> > bsearch to fail.  
> 
> There are two patterns of bugs I saw, one is "Oops: int3" and another is
> "#PF in smp_text_poke_batch_finish (or smp_text_poke_int3_handler)".
> The latter comes from buffer overflow.
> 
> -----
> [  164.164215] BUG: unable to handle page fault for address: ffffffff32c00000
> [  164.166999] #PF: supervisor read access in kernel mode
> [  164.169096] #PF: error_code(0x0000) - not-present page
> [  164.171143] PGD 8364b067 P4D 8364b067 PUD 0 
> [  164.172954] Oops: Oops: 0000 [#1] SMP PTI
> [  164.174581] CPU: 4 UID: 0 PID: 2702 Comm: sh Tainted: G        W           6.15.0-next-20250606-00002-g75b4e49588c2 #239 PREEMPT(voluntary) 
> [  164.179193] Tainted: [W]=WARN
> [  164.180926] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [  164.184696] RIP: 0010:smp_text_poke_batch_finish+0xb9/0x400
> [  164.186873] Code: e4 4c 8d 6d c2 85 c9 74 39 48 63 03 b9 01 00 00 00 4c 89 ea 41 83 c4 01 48 c7 c7 d0 f7 f7 b2 48 83 c3 10 48 8d b0 00 00 c0 b2 <0f> b6 80 00 00 c0 b2 88 43 ff e8 68 e3 ff ff 44 3b 25 d1 29 5f 02
> -----
> 
> This is because smp_text_poke_single() overwrites the
> text_poke_array.vec[TEXT_POKE_ARRAY_MAX], which is nr_entries (and
> the variables next to text_poke_array.)

Interesting. It must be that the stress test was able to get in and add
a bunch of individual entries while a batch was being performed.

Still, both are a bug and solved by the same solution ;-)

(Two for the price of one!)

-- Steve