calling getcpu with misaligned address causes kernel panic

Colin Ian King writes via Kernel.org Bugzilla:

Passing a read-only incorrectly aligned address into getcpu() causes a kernel panic.  I originally found this issue when testing stress-ng using stress-ng --sysbadaddr 1, I've managed to make a short reproducer that can panic the kernel on every invocation of the program.

I can reproduce this on mainline kernels (in Debian), tested and reproduced on kernels 6.6.15, 6.9.7 and 6.10.6, so it's been around a while and it's still reproducible on recent kernels.

This only occurs on PA-RISC (hppa) kernels and only tested in a QEMU VM since I don't have access to real H/W.

cking@hppa:~$ cat crash.c

#define _GNU_SOURCE
#include <sched.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>

void main(void)
{
	char *addr;
	
	addr = mmap(NULL, 4096, PROT_READ, MAP_ANONYMOUS | MAP_SHARED, -1, 0);
	if (addr != MAP_FAILED)
		getcpu((int *)addr, (int *)(1 + addr));
}

cking@hppa:~$ gcc crash.c -o crash
cking@hppa:~$ ./crash 

[  361.158650] Backtrace:
[  361.159621]  [<10413c78>] handle_unaligned+0x590/0x710
[  361.159621]  [<10409354>] handle_interruption+0x1dc/0x7b8
[  361.159621]  [<104545d8>] sys_getcpu+0x30/0x74
[  361.159621] 
[  361.159621] 
[  361.159621] Page fault: bad address: Code=26 (Data memory access rights trap) at addr f9000000
[  361.159621] CPU: 2 PID: 749 Comm: crash Not tainted 6.6.15-parisc #1  Debian 6.6.15-2
[  361.159621] Hardware name: 9000/778/B160L
[  361.159621] 
[  361.159621]      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
[  361.159621] PSW: 00000000000001000000000000001111 Not tainted
[  361.159621] r00-03  0004000f 00000000 10413c78 142903c0
[  361.159621] r04-07  14290080 12a08000 fc000000 f9000001
[  361.159621] r08-11  00000000 0f3dd280 f9099c20 f9096e58
[  361.159621] r12-15  00011008 0119c228 00000000 00000001
[  361.159621] r16-19  14290080 00138428 011b4e00 ff000000
[  361.159621] r20-23  00000000 00000000 00000000 00000011
[  361.159621] r24-27  00000000 00000000 14290080 110dd848
[  361.159621] r28-31  f9000000 00000000 14290400 000003c3
[  361.159621] sr00-03  000003c3 000003c3 00000000 000003c3
[  361.159621] sr04-07  00000000 00000000 00000000 00000000
[  361.159621] 
[  361.159621] IASQ: 00000000 00000000 IAOQ: 104135ac 104135b0
[  361.170517]  IIR: 0f945280    ISR: 000003c3  IOR: f9000000
[  361.170517]  CPU:        2   CR30: 12a08000 CR31: 00000000
[  361.170517]  ORIG_R28: 12a08000
[  361.170517]  IAOQ[0]: emulate_stw+0x5c/0x94
[  361.170517]  IAOQ[1]: emulate_stw+0x60/0x94
[  361.170517]  RP(r2): handle_unaligned+0x590/0x710
[  361.170517] Backtrace:
[  361.170517]  [<10413c78>] handle_unaligned+0x590/0x710
[  361.170517]  [<10409354>] handle_interruption+0x1dc/0x7b8
[  361.170517]  [<104545d8>] sys_getcpu+0x30/0x74
[  361.170517] 
[  361.170517] Kernel panic - not syncing: Page fault: bad address
[  361.170517] ---[ end Kernel panic - not syncing: Page fault: bad address ]---

View: https://bugzilla.kernel.org/show_bug.cgi?id=219339#c0
You can reply to this message to join the discussion.
-- 
Deet-doot-dot, I am a bot.
Kernel.org Bugzilla (bugspray 0.1-dev)