Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753213AbaBXTNc (ORCPT ); Mon, 24 Feb 2014 14:13:32 -0500 Received: from cdptpa-outbound-snat.email.rr.com ([107.14.166.225]:25826 "EHLO cdptpa-oedge-vip.email.rr.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752794AbaBXTNb (ORCPT ); Mon, 24 Feb 2014 14:13:31 -0500 Date: Mon, 24 Feb 2014 14:13:29 -0500 From: Steven Rostedt To: "H. Peter Anvin" Cc: Vince Weaver , Peter Zijlstra , Linux Kernel , Ingo Molnar , "H.J. Lu" Subject: Re: perf_fuzzer compiled for x32 causes reboot Message-ID: <20140224141329.1cd3bb52@gandalf.local.home> In-Reply-To: <530B90A5.3090302@zytor.com> References: <53084317.4090304@zytor.com> <530AD71E.50800@zytor.com> <18f0cea3-7e3b-4477-b433-0269f3de976b@email.android.com> <20140224172536.GD9987@twins.programming.kicks-ass.net> <530B841F.5050803@zytor.com> <530B90A5.3090302@zytor.com> X-Mailer: Claws Mail 3.9.3 (GTK+ 2.24.22; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-RR-Connecting-IP: 107.14.168.142:25 X-Cloudmark-Score: 0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 24 Feb 2014 10:34:13 -0800 "H. Peter Anvin" wrote: > On 02/24/2014 10:07 AM, Vince Weaver wrote: > >> > >> Anyway I've attached the full tail end of the trace if you want to see > >> everything that happens. > > > > and then I note there are *two* kernel page faults. > > > > perf_fuzzer-2979 [000] 161.475924: page_fault_kernel: address=irq_stack_union ip=copy_user_generic_string error_code=0x0 > > address=0x1 ip=0xffffffff812a7d9c error_code=0x0 > > perf_fuzzer-2979 [000] 161.475924: function: __do_page_fault > > perf_fuzzer-2979 [000] 161.475924: function: bad_area_nosemaphore > > perf_fuzzer-2979 [000] 161.475925: function: __bad_area_nosemaphore > > perf_fuzzer-2979 [000] 161.475925: function: no_context > > perf_fuzzer-2979 [000] 161.475925: function: fixup_exception > > perf_fuzzer-2979 [000] 161.475926: function: search_exception_tables > > perf_fuzzer-2979 [000] 161.475926: function: search_extable > > perf_fuzzer-2979 [000] 161.475927: function: copy_user_handle_tail > > perf_fuzzer-2979 [000] 161.475927: function: trace_do_page_fault > > perf_fuzzer-2979 [000] 161.475928: page_fault_kernel: address=irq_stack_union ip=copy_user_handle_tail error_code=0x0 > > address=0x1 ip=0xffffffff812a92bb error_code=0x0 > > perf_fuzzer-2979 [000] 161.475928: function: __do_page_fault > > perf_fuzzer-2979 [000] 161.475928: function: bad_area_nosemaphore > > perf_fuzzer-2979 [000] 161.475929: function: __bad_area_nosemaphore > > perf_fuzzer-2979 [000] 161.475929: function: no_context > > perf_fuzzer-2979 [000] 161.475929: function: fixup_exception > > perf_fuzzer-2979 [000] 161.475929: function: search_exception_tables > > perf_fuzzer-2979 [000] 161.475930: function: search_extable > > perf_fuzzer-2979 [000] 161.475931: function: perf_output_begin > > perf_fuzzer-2979 [000] 161.475931: function: perf_output_copy > > > > That second one is in copy_user_handle_tail() > > > > Either way, it really seems like we have a case of CR2 leakage out of > the NMI context. Ah, and x86_64 saves off the cr2 register when entering NMI and restores it before returning. But it seems to be missing from the i386 code. -- Steve -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/