stress-ng sysinfo stressor trips kernel oops on ppc64el with 5.4.0.7-8

[Colin Ian King]

stress-ng on ppc64el with 5.4.0.7-8, sysinfo stressor seems to tickle a bug:

06:26:02 DEBUG| [stdout] sysinfo FAILED (kernel oopsed)
06:26:02 DEBUG| [stdout] [ 7262.965483] kernel tried to execute exec-protected page (c000000017407ce0) - exploit attempt? (uid: 0)
06:26:02 DEBUG| [stdout] [ 7262.968030] BUG: Unable to handle kernel instruction fetch
06:26:02 DEBUG| [stdout] [ 7262.968121] Faulting instruction address: 0xc000000017407ce0
06:26:02 DEBUG| [stdout] [ 7262.968224] Oops: Kernel access of bad area, sig: 11 [#1]
06:26:02 DEBUG| [stdout] [ 7262.968292] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
06:26:02 DEBUG| [stdout] [ 7262.968403] Modules linked in: unix_diag sctp zfs(PO) zunicode(PO) zavl(PO) icp(PO) zlua(PO) zcommon(PO) znvpair(PO) spl(O) snd_seq snd_seq_device snd_timer snd soundcore vhost_vsock vmw_vsock_virtio_transport_common vsock kvm_pr kvm hci_vhci bluetooth ecdh_generic ecc userio uhid hid vhost_net vhost tap cuse dccp_ipv4 dccp psnap llc algif_rng aegis128 algif_aead anubis fcrypt khazad seed sm4_generic tea crc32_generic md4 michael_mic nhpoly1305 poly1305_generic rmd128 rmd160 rmd256 rmd320 sha3_generic sm3_generic streebog_generic tgr192 wp512 xxhash_generic algif_hash blowfish_generic blowfish_common cast5_generic des_generic libdes salsa20_generic chacha_generic camellia_generic cast6_generic cast_common serpent_generic twofish_generic twofish_common algif_skcipher af_alg aufs binfmt_misc af_packet_diag tcp_diag udp_diag raw_diag inet_diag iptable_mangle xt_TCPMSS xt_tcpudp bpfilter dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmx_crypto crct10dif_vpmsum sch_fq_codel ip_tables
06:26:02 DEBUG| [stdout] [ 7262.969078] x_tables autofs4 btrfs xor zstd_compress raid6_pq libcrc32c crc32c_vpmsum virtio_net virtio_blk net_failover failover [last unloaded: trace_printk]
06:26:02 DEBUG| [stdout] [ 7262.970416] CPU: 1 PID: 2613531 Comm: fuse_mnt Tainted: P OE 5.4.0-7-generic #8-Ubuntu
06:26:02 DEBUG| [stdout] [ 7262.970532] NIP: c000000017407ce0 LR: c00000000063e968 CTR: c000000017407ce0
06:26:02 DEBUG| [stdout] [ 7262.970623] REGS: c0000001d8393810 TRAP: 0400 Tainted: P OE (5.4.0-7-generic)
06:26:02 DEBUG| [stdout] [ 7262.970737] MSR: 8000000010009033 <SF,EE,ME,IR,DR,RI,LE> CR: 88002440 XER: 20000000
06:26:02 DEBUG| [stdout] [ 7262.970850] CFAR: c00000000063e964 IRQMASK: 0
06:26:02 DEBUG| [stdout] GPR00: c00000000063e944 c0000001d8393aa0 c000000001a5bf00 c00000003d95ec00
06:26:02 DEBUG| [stdout] GPR04: c000000017407c18 0000000000000000 0000000000000000 0000000000000000
06:26:02 DEBUG| [stdout] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
06:26:02 DEBUG| [stdout] GPR12: c000000017407ce0 c00000003fffee00 00007c8ab4814410 0000000000000000
06:26:02 DEBUG| [stdout] GPR16: 00007c8ab4b90000 00007c8ab4810320 00007c8ab2f6f240 00007c8ab4814420
06:26:02 DEBUG| [stdout] GPR20: 0000000000000000 0000000000000000 00007c8aa8000b60 00007c8ab4aad3a0
06:26:02 DEBUG| [stdout] GPR24: c0000001f38f7da0 c0000001fbb81e4c c000000017407ce0 c0000001f38f7d80
06:26:02 DEBUG| [stdout] GPR28: c0000001f38f7da0 0000000000000000 c00000003d95ec00 c0000001f38f7d70
06:26:02 DEBUG| [stdout] [ 7262.971713] NIP [c000000017407ce0] 0xc000000017407ce0
06:26:02 DEBUG| [stdout] [ 7262.971804] LR [c00000000063e968] fuse_request_end+0x128/0x2f0
06:26:02 DEBUG| [stdout] [ 7262.971893] Call Trace:
06:26:02 DEBUG| [stdout] [ 7262.971930] [c0000001d8393aa0] [c00000000063e944] fuse_request_end+0x104/0x2f0 (unreliable)
06:26:02 DEBUG| [stdout] [ 7262.972035] [c0000001d8393af0] [c0000000006427cc] fuse_dev_do_write+0x2cc/0x5c0
06:26:02 DEBUG| [stdout] [ 7262.972138] [c0000001d8393b70] [c000000000642f64] fuse_dev_write+0x74/0xd0
06:26:02 DEBUG| [stdout] [ 7262.972221] [c0000001d8393c00] [c0000000004702b0] do_iter_readv_writev+0x240/0x290
06:26:02 DEBUG| [stdout] [ 7262.972334] [c0000001d8393c70] [c000000000472bc8] do_iter_write+0xc8/0x280
06:26:02 DEBUG| [stdout] [ 7262.972424] [c0000001d8393cc0] [c000000000472e90] vfs_writev+0xe0/0x180
06:26:02 DEBUG| [stdout] [ 7262.972508] [c0000001d8393dc0] [c000000000472fcc] do_writev+0x9c/0x1a0
06:26:02 DEBUG| [stdout] [ 7262.972588] [c0000001d8393e20] [c00000000000b278] system_call+0x5c/0x68
06:26:02 DEBUG| [stdout] [ 7262.972661] Instruction dump:
06:26:02 DEBUG| [stdout] [ 7262.972716] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
06:26:02 DEBUG| [stdout] [ 7262.972815] XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
06:26:02 DEBUG| [stdout] [ 7262.972919] ---[ end trace 5852d488fba4a06e ]---
06:26:02 DEBUG| [stdout]
06:26:02 DEBUG| [stdout]

[Colin Ian King (colin-king)]

Same on 5.4.0.4-5 too but not on 5.4.0.3.4

[Colin Ian King (colin-king)]

Same root corruption issue as bug 1854968