From patchwork Fri May 17 14:13:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiangfeng Xiao X-Patchwork-Id: 13667053 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B50A9C25B79 for ; Fri, 17 May 2024 14:41:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=bCE6H+CXXxSGqUEdzPDvf4GQkQYdcuEhcV9MfzxhYjQ=; b=JgDZxw3Q3gDjiA 9PP7vzljdlwED30zt46RS20Y0S98aLFLC2hJWLxigSM2y8IOuAVyf0w0HtiNPyaJHlvVuYUn3M6mx 1j+wKDN/vxzFZyJdoC8kMzcswQsgs7xaJJOvbHoC/8aVXO0hGHxe9F9p5V+ZS84OB8Hj9ogbl+kWx xjXR26NnphXcu8kmJIJPwso1MKTraX2qLg7FVrWIyYoaMm6brn9/EKJMacuGhkC4ele4cEtxHZyU+ ISCMBgXB+U6LrNZUxJ4jp9emV3Q3d0S3QOiGkR5bHzJ3uKbZiPAGgZ4f8ySZbKpsrdupmN7h85Pa8 v11sXUkssljKwJJAUIDA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1s7ylu-0000000867Z-142q; Fri, 17 May 2024 14:41:22 +0000 Received: from szxga01-in.huawei.com ([45.249.212.187]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1s7ylo-0000000860z-3LUL for linux-arm-kernel@lists.infradead.org; Fri, 17 May 2024 14:41:20 +0000 Received: from mail.maildlp.com (unknown [172.19.162.254]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4VgqLD2xrZzvYx9; Fri, 17 May 2024 22:37:24 +0800 (CST) Received: from canpemm500010.china.huawei.com (unknown [7.192.105.118]) by mail.maildlp.com (Postfix) with ESMTPS id 5372C1800C7; Fri, 17 May 2024 22:40:56 +0800 (CST) Received: from huawei.com (10.67.189.167) by canpemm500010.china.huawei.com (7.192.105.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Fri, 17 May 2024 22:40:56 +0800 From: Jiangfeng Xiao To: , , , , CC: , , , , , , , Subject: [PATCH] arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY Date: Fri, 17 May 2024 22:13:28 +0800 Message-ID: <1715955208-17109-1-git-send-email-xiaojiangfeng@huawei.com> X-Mailer: git-send-email 1.8.5.6 MIME-Version: 1.0 X-Originating-IP: [10.67.189.167] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500010.china.huawei.com (7.192.105.118) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240517_074117_310055_4B5F9B3C X-CRM114-Status: GOOD ( 15.34 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org I'm using the latest linux kernel mainline code, with the default arm64 configuration: make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- defconfig, and set CONFIG_EXPERT=y, CONFIG_DEBUG_BUGVERBOSE=n, CONFIG_PANIC_ON_OOPS=y. Loading the following kernel module will cause kernel panic. The call stack is as follows: root@(none):/# /root/insmod hello.ko [ 6.035003] hello: loading out-of-tree module taints kernel. [ 6.039129] ------------[ cut here ]------------ [ 6.039287] hello [ 6.039704] Unexpected kernel BRK exception at EL1 [ 6.040059] Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP [ 6.040457] Modules linked in: hello(O+) [ 6.041311] CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 [ 6.041755] Hardware name: linux,dummy-virt (DT) [ 6.042238] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 6.042594] pc : buginit+0x18/0x1000 [hello] [ 6.043601] lr : buginit+0x18/0x1000 [hello] [ 6.043852] sp : ffff800080533ae0 [ 6.044121] x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 [ 6.044523] x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 [ 6.044961] x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 [ 6.045503] x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 [ 6.046124] x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 [ 6.046387] x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 [ 6.046829] x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 [ 6.047293] x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 [ 6.047739] x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 [ 6.047955] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 [ 6.048366] Call trace: [ 6.048653] buginit+0x18/0x1000 [hello] [ 6.048922] do_one_initcall+0x80/0x1c8 [ 6.049333] do_init_module+0x60/0x218 [ 6.049475] load_module+0x1ba4/0x1d70 [ 6.049755] __do_sys_init_module+0x198/0x1d0 [ 6.049959] __arm64_sys_init_module+0x1c/0x28 [ 6.050160] invoke_syscall+0x48/0x114 [ 6.050334] el0_svc_common.constprop.0+0x40/0xe0 [ 6.050468] do_el0_svc+0x1c/0x28 [ 6.050635] el0_svc+0x34/0xd8 [ 6.050852] el0t_64_sync_handler+0x120/0x12c [ 6.051088] el0t_64_sync+0x190/0x194 [ 6.051433] Code: d0ffffe0 910003fd 91000000 9400000b (d4210000) [ 6.052212] ---[ end trace 0000000000000000 ]--- [ 6.052473] Kernel panic - not syncing: BRK handler: Fatal exception The kernel module source code is as follows: ``` static int __init buginit(void) { WARN(1, "hello\n"); return 0; } static void __exit bugexit(void) { } module_init(buginit); module_exit(bugexit); MODULE_LICENSE("GPL"); ``` When CONFIG_DEBUG_BUGVERBOSE macro is disabled, the size of "__bug_table" section in hello.ko is only 6 bytes instead of the expected 8 bytes. As a result, mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry) = 6 / 8 = 0 calculated in module_bug_finalize when the kernel loads ko is incorrect. When running `WARN()`, the following backtrace is triggered: module_find_bug() at lib/bug.c find_bug() at lib/bug.c __report_bug() at lib/bug.c report_bug() at lib/bug.c call_break_hook() at arch/arm64/kernel/debug-monitors.c brk_handler() at arch/arm64/kernel/debug-monitors.c It will return -EFAULT because hello.ko's mod->num_bugs is 0. Finally, the kernel OOPS is triggered. Add .align 2 to the end of __BUG_ENTRY to make the object layout generated by the assembly code consistent with that of the C struct bug_entry. Fixes: 9fb7410f955f ("arm64/BUG: Use BRK instruction for generic BUG traps") Signed-off-by: Yuanbin Xie Signed-off-by: Jiangfeng Xiao Reviewed-by: Mark Rutland --- arch/arm64/include/asm/asm-bug.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h index c762038..6e73809 100644 --- a/arch/arm64/include/asm/asm-bug.h +++ b/arch/arm64/include/asm/asm-bug.h @@ -28,6 +28,7 @@ 14470: .long 14471f - .; \ _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ .short flags; \ + .align 2; \ .popsection; \ 14471: #else