From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
To: Borislav Petkov <bp@alien8.de>
Cc: x86@kernel.org, Sean Christopherson <seanjc@google.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
"H. Peter Anvin" <hpa@zytor.com>,
linux-kernel@vger.kernel.org, Fuad Tabba <tabba@google.com>,
Marc Zyngier <maz@kernel.org>,
Shaoqin Huang <shahuang@redhat.com>,
David Matlack <dmatlack@google.com>,
Josh Poimboeuf <jpoimboe@kernel.org>,
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>,
Peter Zijlstra <peterz@infradead.org>,
Breno Leitao <leitao@debian.org>,
kvm@vger.kernel.org
Subject: Re: [BUG net-next] arch/x86/kernel/cpu/bugs.c:2935: "Unpatched return thunk in use. This should not happen!" [STACKTRACE]
Date: Wed, 20 Mar 2024 02:28:57 +0100 [thread overview]
Message-ID: <12619bd4-9e9e-4883-8706-55d050a4d11a@alu.unizg.hr> (raw)
In-Reply-To: <20240318202124.GCZfiiRGVV0angYI9j@fat_crate.local>
[-- Attachment #1: Type: text/plain, Size: 548 bytes --]
On 3/18/24 21:21, Borislav Petkov wrote:
> On Mon, Mar 18, 2024 at 08:47:26PM +0100, Mirsad Todorovac wrote:
>> With the latest net-next v6.8-5204-g237bb5f7f7f5 kernel, while running kselftest, there was this
>> trap and stacktrace:
>
> Send your kernel .config and how exactly you're triggering it, please.
>
> Thx.
Hi,
Please find the kernel .config attached.
I got another one of these "Unpatched thunk" and it seems connected with selftest/kvm.
But running selftests/kvm one by one did not trigger the bug.
Best regards,
Mirsad Todorovac
[-- Attachment #2: config-6.8.0-net-next-km-05204-g237bb5f7f7f5-dirty.xz --]
[-- Type: application/x-xz, Size: 59464 bytes --]
[-- Attachment #3: unpatched-return-thunk-decoded-02.log --]
[-- Type: text/x-log, Size: 10573 bytes --]
Mar 19 20:07:54 defiant kernel: [ 885.324733] ------------[ cut here ]------------
Mar 19 20:07:54 defiant kernel: [ 885.324737] Unpatched return thunk in use. This should not happen!
Mar 19 20:07:54 defiant kernel: [ 885.324740] WARNING: CPU: 14 PID: 7842 at arch/x86/kernel/cpu/bugs.c:2935 __warn_thunk (arch/x86/kernel/cpu/bugs.c:2935 (discriminator 3))
Mar 19 20:07:54 defiant kernel: [ 885.324746] Modules linked in: xfrm_user nf_tables nfnetlink nvme_fabrics binfmt_misc nls_iso8859_1 intel_rapl_msr amd_atl snd_hda_codec_realtek intel_rapl_common snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd snd_intel_sdw_acpi crct10dif_pclmul snd_hda_codec polyval_clmulni polyval_generic snd_hda_core ghash_clmulni_intel snd_hwdep sha512_ssse3 sha256_ssse3 amdgpu sha1_ssse3 snd_pcm aesni_intel snd_seq_midi crypto_simd snd_seq_midi_event cryptd snd_rawmidi amdxcp drm_exec joydev rapl gpu_sched wmi_bmof input_leds snd_seq drm_buddy drm_suballoc_helper drm_ttm_helper snd_seq_device ttm snd_timer k10temp drm_display_helper ccp cec snd drm_kms_helper soundcore i2c_algo_bit mac_hid tcp_bbr msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq hid_generic nvme ahci nvme_core xhci_pci r8169 crc32_pclmul i2c_piix4 nvme_auth libahci xhci_pci_renesas realtek video wmi gpio_amdpt
Mar 19 20:07:54 defiant kernel: [ 885.324811] CPU: 14 PID: 7842 Comm: cpuid_test Not tainted 6.8.0-torv-11167-g4438a810f396-dirty #34
Mar 19 20:07:54 defiant kernel: [ 885.324814] Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023
Mar 19 20:07:54 defiant kernel: [ 885.324815] RIP: 0010:__warn_thunk (arch/x86/kernel/cpu/bugs.c:2935 (discriminator 3))
Mar 19 20:07:54 defiant kernel: [ 885.324818] Code: 62 66 1d 01 83 e3 01 74 0e 48 8b 5d f8 c9 31 f6 31 ff e9 8e 99 3b 01 48 c7 c7 d8 11 81 b3 c6 05 f2 2f 8d 02 01 e8 00 ab 07 00 <0f> 0b 48 8b 5d f8 c9 31 f6 31 ff e9 6b 99 3b 01 90 90 90 90 90 90
All code
========
0: 62 66 1d 01 83 (bad)
5: e3 01 jrcxz 0x8
7: 74 0e je 0x17
9: 48 8b 5d f8 mov -0x8(%rbp),%rbx
d: c9 leave
e: 31 f6 xor %esi,%esi
10: 31 ff xor %edi,%edi
12: e9 8e 99 3b 01 jmp 0x13b99a5
17: 48 c7 c7 d8 11 81 b3 mov $0xffffffffb38111d8,%rdi
1e: c6 05 f2 2f 8d 02 01 movb $0x1,0x28d2ff2(%rip) # 0x28d3017
25: e8 00 ab 07 00 call 0x7ab2a
2a:* 0f 0b ud2 <-- trapping instruction
2c: 48 8b 5d f8 mov -0x8(%rbp),%rbx
30: c9 leave
31: 31 f6 xor %esi,%esi
33: 31 ff xor %edi,%edi
35: e9 6b 99 3b 01 jmp 0x13b99a5
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 48 8b 5d f8 mov -0x8(%rbp),%rbx
6: c9 leave
7: 31 f6 xor %esi,%esi
9: 31 ff xor %edi,%edi
b: e9 6b 99 3b 01 jmp 0x13b997b
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
Mar 19 20:07:54 defiant kernel: [ 885.324819] RSP: 0018:ffffadb65373bc30 EFLAGS: 00010046
Mar 19 20:07:54 defiant kernel: [ 885.324821] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
Mar 19 20:07:54 defiant kernel: [ 885.324822] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
Mar 19 20:07:54 defiant kernel: [ 885.324823] RBP: ffffadb65373bc38 R08: 0000000000000000 R09: 0000000000000000
Mar 19 20:07:54 defiant kernel: [ 885.324824] R10: 0000000000000000 R11: 0000000000000000 R12: ffff919b06ac8000
Mar 19 20:07:54 defiant kernel: [ 885.324825] R13: 0000000000000000 R14: 0000000000000000 R15: ffff919b06ac8780
Mar 19 20:07:54 defiant kernel: [ 885.324826] FS: 00007447cc59e740(0000) GS:ffff91a858100000(0000) knlGS:0000000000000000
Mar 19 20:07:54 defiant kernel: [ 885.324827] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Mar 19 20:07:54 defiant kernel: [ 885.324828] CR2: 0000000000000000 CR3: 00000002c68f6000 CR4: 0000000000f50ef0
Mar 19 20:07:54 defiant kernel: [ 885.324830] PKRU: 55555554
Mar 19 20:07:54 defiant kernel: [ 885.324831] Call Trace:
Mar 19 20:07:54 defiant kernel: [ 885.324831] <TASK>
Mar 19 20:07:54 defiant kernel: [ 885.324833] ? show_regs (arch/x86/kernel/dumpstack.c:479)
Mar 19 20:07:54 defiant kernel: [ 885.324836] ? __warn_thunk (arch/x86/kernel/cpu/bugs.c:2935 (discriminator 3))
Mar 19 20:07:54 defiant kernel: [ 885.324838] ? __warn (kernel/panic.c:677)
Mar 19 20:07:54 defiant kernel: [ 885.324841] ? __warn_thunk (arch/x86/kernel/cpu/bugs.c:2935 (discriminator 3))
Mar 19 20:07:54 defiant kernel: [ 885.324843] ? report_bug (lib/bug.c:201 lib/bug.c:219)
Mar 19 20:07:54 defiant kernel: [ 885.324846] ? irq_work_queue (kernel/irq_work.c:119)
Mar 19 20:07:54 defiant kernel: [ 885.324849] ? handle_bug (arch/x86/kernel/traps.c:218)
Mar 19 20:07:54 defiant kernel: [ 885.324853] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))
Mar 19 20:07:54 defiant kernel: [ 885.324855] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)
Mar 19 20:07:54 defiant kernel: [ 885.324860] ? __warn_thunk (arch/x86/kernel/cpu/bugs.c:2935 (discriminator 3))
Mar 19 20:07:54 defiant kernel: [ 885.324863] warn_thunk_thunk (arch/x86/entry/entry.S:48)
Mar 19 20:07:54 defiant kernel: [ 885.324867] svm_vcpu_enter_exit (./include/linux/kvm_host.h:543 arch/x86/kvm/svm/svm.c:4115)
Mar 19 20:07:54 defiant kernel: [ 885.324869] svm_vcpu_run (arch/x86/kvm/svm/svm.c:4187)
Mar 19 20:07:54 defiant kernel: [ 885.324872] kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:11003 arch/x86/kvm/x86.c:11184 arch/x86/kvm/x86.c:11410)
Mar 19 20:07:54 defiant kernel: [ 885.324877] ? kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4610)
Mar 19 20:07:54 defiant kernel: [ 885.324881] kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4447)
Mar 19 20:07:54 defiant kernel: [ 885.324883] ? vcpu_put (./arch/x86/include/asm/preempt.h:103 arch/x86/kvm/../../../virt/kvm/kvm_main.c:225)
Mar 19 20:07:54 defiant kernel: [ 885.324886] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324888] __x64_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:904 fs/ioctl.c:890 fs/ioctl.c:890)
Mar 19 20:07:54 defiant kernel: [ 885.324892] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
Mar 19 20:07:54 defiant kernel: [ 885.324893] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324895] ? trace_hardirqs_on_prepare (kernel/trace/trace_preemptirq.c:47 kernel/trace/trace_preemptirq.c:42)
Mar 19 20:07:54 defiant kernel: [ 885.324897] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324899] ? syscall_exit_to_user_mode (kernel/entry/common.c:215)
Mar 19 20:07:54 defiant kernel: [ 885.324901] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324903] ? do_syscall_64 (./arch/x86/include/asm/cpufeature.h:171 arch/x86/entry/common.c:98)
Mar 19 20:07:54 defiant kernel: [ 885.324904] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324906] ? irqentry_exit (kernel/entry/common.c:361)
Mar 19 20:07:54 defiant kernel: [ 885.324907] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:181)
Mar 19 20:07:54 defiant kernel: [ 885.324909] ? exc_page_fault (arch/x86/mm/fault.c:1567)
Mar 19 20:07:54 defiant kernel: [ 885.324911] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)
Mar 19 20:07:54 defiant kernel: [ 885.324913] RIP: 0033:0x7447cc31a94f
Mar 19 20:07:54 defiant kernel: [ 885.324933] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00
All code
========
0: 00 48 89 add %cl,-0x77(%rax)
3: 44 24 18 rex.R and $0x18,%al
6: 31 c0 xor %eax,%eax
8: 48 8d 44 24 60 lea 0x60(%rsp),%rax
d: c7 04 24 10 00 00 00 movl $0x10,(%rsp)
14: 48 89 44 24 08 mov %rax,0x8(%rsp)
19: 48 8d 44 24 20 lea 0x20(%rsp),%rax
1e: 48 89 44 24 10 mov %rax,0x10(%rsp)
23: b8 10 00 00 00 mov $0x10,%eax
28: 0f 05 syscall
2a:* 41 89 c0 mov %eax,%r8d <-- trapping instruction
2d: 3d 00 f0 ff ff cmp $0xfffff000,%eax
32: 77 1f ja 0x53
34: 48 8b 44 24 18 mov 0x18(%rsp),%rax
39: 64 fs
3a: 48 rex.W
3b: 2b .byte 0x2b
3c: 04 25 add $0x25,%al
3e: 28 00 sub %al,(%rax)
Code starting with the faulting instruction
===========================================
0: 41 89 c0 mov %eax,%r8d
3: 3d 00 f0 ff ff cmp $0xfffff000,%eax
8: 77 1f ja 0x29
a: 48 8b 44 24 18 mov 0x18(%rsp),%rax
f: 64 fs
10: 48 rex.W
11: 2b .byte 0x2b
12: 04 25 add $0x25,%al
14: 28 00 sub %al,(%rax)
Mar 19 20:07:54 defiant kernel: [ 885.324934] RSP: 002b:00007ffd611e2f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
Mar 19 20:07:54 defiant kernel: [ 885.324936] RAX: ffffffffffffffda RBX: 0000000012d56880 RCX: 00007447cc31a94f
Mar 19 20:07:54 defiant kernel: [ 885.324937] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007
Mar 19 20:07:54 defiant kernel: [ 885.324938] RBP: 00007447cc59e6c0 R08: 0000000000000000 R09: 0000000000000001
Mar 19 20:07:54 defiant kernel: [ 885.324939] R10: 000000000000001f R11: 0000000000000246 R12: 0000000012d56880
Mar 19 20:07:54 defiant kernel: [ 885.324940] R13: 0000000000000041 R14: 0000000000427e18 R15: 00007447cc601040
Mar 19 20:07:54 defiant kernel: [ 885.324943] </TASK>
next prev parent reply other threads:[~2024-03-20 1:29 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-18 19:47 [BUG net-next] arch/x86/kernel/cpu/bugs.c:2935: "Unpatched return thunk in use. This should not happen!" [STACKTRACE] Mirsad Todorovac
2024-03-18 20:21 ` Borislav Petkov
2024-03-20 1:28 ` Mirsad Todorovac [this message]
2024-03-26 10:16 ` Borislav Petkov
2024-03-26 19:15 ` Mirsad Todorovac
2024-03-28 12:38 ` Michael Roth
2024-04-02 10:15 ` bp
2024-04-02 13:38 ` Michael Roth
2024-04-03 12:14 ` Borislav Petkov
2024-04-03 12:48 ` Sean Christopherson
2024-04-04 13:44 ` Borislav Petkov
2024-04-17 15:52 ` Paolo Bonzini
[not found] ` <f497a833-f945-4907-b916-1739324de014@alu.unizg.hr>
2024-04-04 13:41 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12619bd4-9e9e-4883-8706-55d050a4d11a@alu.unizg.hr \
--to=mirsad.todorovac@alu.unizg.hr \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dmatlack@google.com \
--cc=hpa@zytor.com \
--cc=jpoimboe@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=leitao@debian.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=mingo@redhat.com \
--cc=pawan.kumar.gupta@linux.intel.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=seanjc@google.com \
--cc=shahuang@redhat.com \
--cc=tabba@google.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.