From: Linus Torvalds <torvalds@linux-foundation.org>
To: Peter Hurley <peter@hurleysoftware.com>
Cc: Jiri Slaby <jslaby@suse.cz>, Greg KH <gregkh@linuxfoundation.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
stable <stable@vger.kernel.org>,
lwn@lwn.net, Steven Rostedt <rostedt@goodmis.org>
Subject: Re: BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2]
Date: Fri, 26 Feb 2016 10:05:26 -0800 [thread overview]
Message-ID: <CA+55aFxXAiJe=NPuxJ3vQFn6T12_nVV2+Yz4yChYbavtB+1caw@mail.gmail.com> (raw)
On Fri, Feb 26, 2016 at 9:52 AM, Peter Hurley <peter@hurleysoftware.com> wrote:
>
> So more analysis would seem to confirm that RSP has been bumped +8
> while in ttwu_stat() so when the epilog executed, register restore
> was off by 1 qword. However, there's nothing in ttwu_stat() that
> results in stack pointer offset by +1 qword from prolog.
I agree.
That's why I'm actually starting to suspect that it's an AMD microcode
bug that we know very little about. There's apparently register
corruption (the guess being from NMI handling, but virtualization was
also involved) under some circumstances.
Of course, if Jiri isn't actually running this on an AMD CPU, that
theory flies right out the window. But we do have a reported oops on
the security list that looks totally different in the big picture, but
shares the exact same "corrupted stack pointer register state
resulting in crazy instruction pointer, resulting in NX fault"
behavior in the end.
In the other case, microcode patchlevel 0x0600081c was fine, and
0x06000832 is the one exhibiting the corruption problem.
I've contacted Robert Święcki (who found the microcode problem) in
case he wants to weigh in in this thread.. He was talking to some AMD
people, but I don't know the exactly who.
Linus
next reply other threads:[~2016-02-26 18:05 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-26 18:05 Linus Torvalds [this message]
2016-02-26 18:17 ` BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2] Borislav Petkov
2016-02-26 18:18 ` Peter Hurley
2016-02-26 19:44 ` Linus Torvalds
2016-02-26 19:59 ` Robert Święcki
2016-02-29 7:39 ` Jiri Slaby
2016-02-29 12:43 ` Henrique de Moraes Holschuh
-- strict thread matches above, loose matches on Subject: below --
2016-02-17 20:37 Linux 4.4.2 Greg KH
2016-02-25 10:12 ` BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2] Jiri Slaby
2016-02-25 18:40 ` Peter Hurley
2016-02-25 19:09 ` Linus Torvalds
2016-02-25 19:23 ` Steven Rostedt
2016-02-26 8:25 ` Jiri Slaby
2016-02-25 20:32 ` Peter Hurley
2016-02-25 20:51 ` Linus Torvalds
2016-02-25 21:32 ` Jiri Slaby
2016-02-25 22:33 ` Peter Hurley
2016-02-26 0:38 ` Peter Hurley
2016-02-26 8:45 ` Jiri Slaby
2016-02-26 0:38 ` Linus Torvalds
2016-02-26 8:56 ` Jiri Slaby
2016-02-26 9:23 ` Jiri Slaby
2016-02-26 9:50 ` Jiri Slaby
2016-02-26 16:34 ` Greg KH
2016-02-26 17:12 ` Linus Torvalds
2016-02-29 15:45 ` Paolo Bonzini
2016-02-26 17:52 ` Peter Hurley
2016-02-25 21:43 ` Peter Hurley
2016-02-25 22:00 ` Jiri Kosina
2016-02-26 8:31 ` Jiri Slaby
2016-02-26 8:15 ` Jiri Slaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CA+55aFxXAiJe=NPuxJ3vQFn6T12_nVV2+Yz4yChYbavtB+1caw@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=akpm@linux-foundation.org \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lwn@lwn.net \
--cc=peter@hurleysoftware.com \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).