public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Conor Dooley <conor@kernel.org>
To: Andy Chiu <andy.chiu@sifive.com>
Cc: linux-riscv@lists.infradead.org, palmer@dabbelt.com,
	anup@brainfault.org, atishp@atishpatra.org,
	kvm-riscv@lists.infradead.org, kvm@vger.kernel.org,
	vineetg@rivosinc.com, greentime.hu@sifive.com,
	guoren@linux.alibaba.com, ShihPo Hung <shihpo.hung@sifive.com>,
	Vincent Chen <vincent.chen@sifive.com>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	Albert Ou <aou@eecs.berkeley.edu>, Guo Ren <guoren@kernel.org>,
	Alexandre Ghiti <alexandre.ghiti@canonical.com>,
	Myrtle Shah <gatecat@ds0.me>
Subject: Re: [PATCH -next v13 15/19] riscv: Fix a kernel panic issue if $s2 is set to a specific value before entering Linux
Date: Fri, 27 Jan 2023 20:31:03 +0000	[thread overview]
Message-ID: <Y9Q0h88UL0BRaF8d@spud> (raw)
In-Reply-To: <20230125142056.18356-16-andy.chiu@sifive.com>

[-- Attachment #1: Type: text/plain, Size: 4993 bytes --]

Hey Andy,

On Wed, Jan 25, 2023 at 02:20:52PM +0000, Andy Chiu wrote:
> From: Greentime Hu <greentime.hu@sifive.com>
> 
> Panic log:
> [    0.018707] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> [    0.023060] Oops [#1]
> [    0.023214] Modules linked in:
> [    0.023725] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.14.0 #33
> [    0.023955] Hardware name: SiFive,FU800 (DT)
> [    0.024150] epc : __vstate_save+0x1c/0x48
> [    0.024654]  ra : arch_dup_task_struct+0x70/0x108
> [    0.024815] epc : ffffffff80005ad8 ra : ffffffff800035a8 sp : ffffffff81203d50
> [    0.025020]  gp : ffffffff812e8290 tp : ffffffff8120bdc0 t0 : 0000000000000000
> [    0.025216]  t1 : 0000000000000000 t2 : 0000000000000000 s0 : ffffffff81203d80
> [    0.025424]  s1 : ffffffff8120bdc0 a0 : ffffffff8120c820 a1 : 0000000000000000
> [    0.025659]  a2 : 0000000000001000 a3 : 0000000000000000 a4 : 0000000000000600
> [    0.025869]  a5 : ffffffff8120cdc0 a6 : ffffffe00160b400 a7 : ffffffff80a1fe60
> [    0.026069]  s2 : ffffffe0016b8000 s3 : ffffffff81204000 s4 : 0000000000004000
> [    0.026267]  s5 : 0000000000000000 s6 : ffffffe0016b8000 s7 : ffffffe0016b9000
> [    0.026475]  s8 : ffffffff81203ee0 s9 : 0000000000800300 s10: ffffffff812e9088
> [    0.026689]  s11: ffffffd004008000 t3 : 0000000000000000 t4 : 0000000000000100
> [    0.026900]  t5 : 0000000000000600 t6 : ffffffe00167bcc4
> [    0.027057] status: 8000000000000720 badaddr: 0000000000000000 cause: 000000000000000f
> [    0.027344] [<ffffffff80005ad8>] __vstate_save+0x1c/0x48
> [    0.027567] [<ffffffff8000abe8>] copy_process+0x266/0x11a0
> [    0.027739] [<ffffffff8000bc98>] kernel_clone+0x90/0x2aa
> [    0.027915] [<ffffffff8000c062>] kernel_thread+0x76/0x92
> [    0.028075] [<ffffffff8072e34c>] rest_init+0x26/0xfc
> [    0.028242] [<ffffffff80800638>] arch_call_rest_init+0x10/0x18
> [    0.028423] [<ffffffff80800c4a>] start_kernel+0x5ce/0x5fe
> [    0.029188] ---[ end trace 9a59af33f7ba3df4 ]---
> [    0.029479] Kernel panic - not syncing: Attempted to kill the idle task!
> [    0.029907] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
> 
> The NULL pointer accessing caused the kernel panic. There is a NULL
> pointer is because in vstate_save() function it will check
> (regs->status & SR_VS) == SR_VS_DIRTY and this is true, but it shouldn't
> be true because vector is not used here. Since vector is not used, datap
> won't be allocated so it is NULL. The reason why regs->status is set to
> a wrong value is because pt_regs->status is put in stack and it is polluted
> after setup_vm() called.
> 
> In prologue of setup_vm(), we can observe it will save s2 to stack however
> s2 is meaningless here because the caller is assembly code and s2 is just
> some value from previous stage. The compiler will base on calling
> convention to save the register to stack. Then 0x80008638 in s2 is saved
> to stack. It might be any value. In this failure case it is 0x80008638 and
> it will accidentally cause SR_VS_DIRTY to call the vstate_save() function.

> diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
> index 7cc975ce619d..512ebad013aa 100644
> --- a/arch/riscv/kernel/head.S
> +++ b/arch/riscv/kernel/head.S
> @@ -301,6 +301,7 @@ clear_bss_done:
>  	la tp, init_task
>  	la sp, init_thread_union + THREAD_SIZE
>  	XIP_FIXUP_OFFSET sp
> +	addi sp, sp, -PT_SIZE
>  #ifdef CONFIG_BUILTIN_DTB
>  	la a0, __dtb_start
>  	XIP_FIXUP_OFFSET a0
> @@ -318,6 +319,7 @@ clear_bss_done:
>  	/* Restore C environment */
>  	la tp, init_task
>  	la sp, init_thread_union + THREAD_SIZE
> +	addi sp, sp, -PT_SIZE

I've got no idea about this stuff, so I was just poking around at
existing, similar bits of asm.
grepping for code that does this (with your series applied), you are
the only one who is using PT_SIZE rather than PT_SIZE_ON_STACK:
rg "\bPT_SIZE" arch/riscv
arch/riscv/kernel/head.S
304:	addi sp, sp, -PT_SIZE
322:	addi sp, sp, -PT_SIZE

arch/riscv/kernel/asm-offsets.c
78:	DEFINE(PT_SIZE, sizeof(struct pt_regs));
472:	DEFINE(PT_SIZE_ON_STACK, ALIGN(sizeof(struct pt_regs), STACK_ALIGN));

arch/riscv/kernel/probes/rethook_trampoline.S
79:	addi sp, sp, -(PT_SIZE_ON_STACK)
90:	addi sp, sp, PT_SIZE_ON_STACK

arch/riscv/kernel/entry.S
35:	addi sp, sp, -(PT_SIZE_ON_STACK)
45:	addi sp, sp, -(PT_SIZE_ON_STACK)
277:	addi s0, sp, PT_SIZE_ON_STACK
417:	addi sp, sp, -(PT_SIZE_ON_STACK)
461:	addi sp, sp, -(PT_SIZE_ON_STACK)

arch/riscv/kernel/mcount-dyn.S
61:	addi	sp, sp, -PT_SIZE_ON_STACK
64:	addi	sp, sp, PT_SIZE_ON_STACK
66:	addi	sp, sp, -PT_SIZE_ON_STACK
104:	addi	sp, sp, PT_SIZE_ON_STACK
106:	addi	sp, sp, -PT_SIZE_ON_STACK
139:	addi	sp, sp, PT_SIZE_ON_STACK
179:	REG_L	a1, PT_SIZE_ON_STACK(sp)

As I said, I don't know this area, so I am just pointing out the
difference, and wondering if it is intentional!

Cheers,
Conor.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

  reply	other threads:[~2023-01-27 20:31 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-25 14:20 [PATCH -next v13 00/19] riscv: Add vector ISA support Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 01/19] riscv: Rename __switch_to_aux -> fpu Andy Chiu
2023-01-25 21:15   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 02/19] riscv: Extending cpufeature.c to detect V-extension Andy Chiu
2023-01-25 21:33   ` Conor Dooley
2023-01-28  7:09     ` Guo Ren
2023-01-28 10:28       ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 03/19] riscv: Add new csr defines related to vector extension Andy Chiu
2023-01-25 22:16   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 04/19] riscv: Clear vector regfile on bootup Andy Chiu
2023-01-25 21:54   ` Conor Dooley
2023-01-25 21:57     ` Vineet Gupta
2023-01-25 22:18       ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 05/19] riscv: Disable Vector Instructions for kernel itself Andy Chiu
2023-01-25 21:51   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 06/19] riscv: Introduce Vector enable/disable helpers Andy Chiu
2023-01-26 21:06   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 07/19] riscv: Introduce riscv_vsize to record size of Vector context Andy Chiu
2023-01-26 21:24   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 08/19] riscv: Introduce struct/helpers to save/restore per-task Vector state Andy Chiu
2023-01-26 21:32   ` Conor Dooley
2023-01-25 14:20 ` [PATCH -next v13 09/19] riscv: Add task switch support for vector Andy Chiu
2023-01-26 21:44   ` Conor Dooley
2023-01-31  2:55   ` Vineet Gupta
2023-01-25 14:20 ` [PATCH -next v13 10/19] riscv: Allocate user's vector context in the first-use trap Andy Chiu
2023-01-26 23:11   ` Conor Dooley
2023-02-06 12:00     ` Andy Chiu
2023-02-06 13:40       ` Conor Dooley
2023-02-10 12:00         ` Andy Chiu
2023-02-07 14:36   ` Björn Töpel
2023-02-13 22:54     ` Vineet Gupta
2023-02-14  6:43       ` Björn Töpel
2023-02-14 15:36         ` Andy Chiu
2023-02-14 16:50           ` Björn Töpel
2023-02-14 17:24             ` Vineet Gupta
2023-02-15  7:14               ` Björn Töpel
2023-02-15 14:39                 ` Andy Chiu
2023-02-07 21:18   ` Vineet Gupta
2023-02-08  9:20     ` Björn Töpel
2023-01-25 14:20 ` [PATCH -next v13 11/19] riscv: Add ptrace vector support Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 12/19] riscv: signal: check fp-reserved words unconditionally Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 13/19] riscv: signal: Add sigcontext save/restore for vector Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 14/19] riscv: signal: Report signal frame size to userspace via auxv Andy Chiu
2023-01-26 23:19   ` Conor Dooley
2023-01-31 12:34     ` Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 15/19] riscv: Fix a kernel panic issue if $s2 is set to a specific value before entering Linux Andy Chiu
2023-01-27 20:31   ` Conor Dooley [this message]
2023-01-31 12:34     ` Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 16/19] riscv: Add V extension to KVM ISA Andy Chiu
2023-01-27 20:43   ` Conor Dooley
2023-01-30  9:58     ` Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 17/19] riscv: KVM: Add vector lazy save/restore support Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 18/19] riscv: kvm: redirect illegal instruction traps to guests Andy Chiu
2023-01-27 11:28   ` Anup Patel
2023-01-30  8:18     ` Andy Chiu
2023-01-25 14:20 ` [PATCH -next v13 19/19] riscv: Enable Vector code to be built Andy Chiu
2023-01-25 21:04   ` Conor Dooley
2023-01-25 21:38     ` Jessica Clarke
2023-01-25 22:24       ` Conor Dooley
2023-01-30  6:38     ` Andy Chiu
2023-01-30 18:38       ` Vineet Gupta
2023-01-30  7:46     ` Andy Chiu
2023-01-30  8:13       ` Conor Dooley
2023-02-08 18:19         ` Conor Dooley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y9Q0h88UL0BRaF8d@spud \
    --to=conor@kernel.org \
    --cc=alexandre.ghiti@canonical.com \
    --cc=andy.chiu@sifive.com \
    --cc=anup@brainfault.org \
    --cc=aou@eecs.berkeley.edu \
    --cc=atishp@atishpatra.org \
    --cc=gatecat@ds0.me \
    --cc=greentime.hu@sifive.com \
    --cc=guoren@kernel.org \
    --cc=guoren@linux.alibaba.com \
    --cc=kvm-riscv@lists.infradead.org \
    --cc=kvm@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=palmer@dabbelt.com \
    --cc=paul.walmsley@sifive.com \
    --cc=shihpo.hung@sifive.com \
    --cc=vincent.chen@sifive.com \
    --cc=vineetg@rivosinc.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox