Sys oopsed with sysfs test in ubuntu_stress_smoke_test on X-hwe ARM64

This test passed on other 3 ARM64 nodes (appleton-kernel, ms10-34-mcdivittB0-kernel, wright-kernel)

This appears to specific to one machine - I suspect this is due to a particular ACPI table. If I can get full access to hotdog I'll check if this is a regression and debug this further.

Giving that colin has already acknowledged this bug and confirmed it appears to be isolated to only one machine, i'm removing the kqa-blocker tag.

Colin,

I have your keys imported and locked the system.
Please access it with ubuntu@hotdog-kernel
Thanks

This is not a regression, it also occurs on 4.15.0-88-generic

Reproducer occurs when doing odd sized reads that are > 1 byte:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>

int main(void)
{
        int fd;
        char buffer[3];
        ssize_t n;

        fd = open("/sys/firmware/acpi/tables/data/BERT", O_RDONLY);
        if (fd < 0) {
                fprintf(stderr, "open failed: %d (%s)\n", errno, strerror(errno));
                return -1;
        }
        do {
                n = read(fd, buffer, sizeof(buffer));
        } while (n > 0);

        return 0;
}

Issue occurs with linux 5.6-rc5 too.

Replacing memcpy with unoptimized char copying avoids this issue, so it seems to be a misaligned read issue.

diff --git a/fs/libfs.c b/fs/libfs.c
index 77709c5923a8..f99e265b6d81 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -786,6 +786,8 @@ ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
                                const void *from, size_t available)
 {
        loff_t pos = *ppos;
+ char *p1, *p2;
+ size_t i;

        if (pos < 0)
                return -EINVAL;
@@ -798,8 +800,14 @@ ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
                        (unsigned long long)available,
                        (unsigned long long)pos,
                        (unsigned long long)count);
+
+ p1 = to;
+ p2 = from + pos;
+
+ for (i = 0; i < count; i++,p1++,p2++)
+ *p1 = *p2;

- memcpy(to, from + pos, count);
+ //memcpy(to, from + pos, count);
        *ppos = pos + count;

        return count;

This is called from acpi_data_show() which does:

rc = memory_read_from_buffer(buf, count, &offset, base,
                                     data_attr->attr.size);

On a second read, the contents of offset is odd making base + offset odd on the source address of a memcpy(). I thought memcpy could handle that.

Ah, looks like the source memory is mapped as I/O memory, so this works OK on x86 but probably unaligned I/O reads fail on this platform.

Fix sent upstream for review: https://lkml.org/lkml/2020/3/12/370

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1866772

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

This bug was fixed in the package linux - 5.4.0-21.25

---------------
linux (5.4.0-21.25) focal; urgency=medium

  * CVE-2020-8835
    - SAUCE: bpf: undo incorrect __reg_bound_offset32 handling

 -- Thadeu Lima de Souza Cascardo <email address hidden> Thu, 26 Mar 2020 17:51:28 -0300

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-eoan' to 'verification-done-eoan'. If the problem still exists, change the tag 'verification-needed-eoan' to 'verification-failed-eoan'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Tested on Eoan with kernel 5.3.0-47-generic #39-Ubuntu with reproducer and stress-ng sysfs test, fix worked fine.

Tested on Focal with kernel 5.4.0-23-generic #27-Ubuntu with reproducer and it works fine. There is another issue with the sysfs test, need to debug that and I'll file another bug for that.

Focal passes autotest stress-ng tests:

14:06:30 INFO | Summary:
14:06:30 INFO | Stressors run: 191
14:06:30 INFO | Skipped: 1, binderfs
14:06:30 INFO | Failed: 0,
14:06:30 INFO | Oopsed: 0,
14:06:30 INFO | Oomed: 0,
14:06:30 INFO | Passed: 190, access af-alg affinity aio aiol bad-altstack bigheap branch brk cache cap chattr chdir chmod chown chroot clock close context cpu crypt cyclic daemon dccp dentry dev dev-shm dir dirdeep dnotify dup dynlib enosys env epoll eventfd fallocate fanotify fault fcntl fiemap fifo file-ioctl filename flock fork fp-error fstat full funcret futex get getdent getrandom handle hdd hrtimers icache icmp-flood inode-flags inotify io iomix ioprio ipsec-mb itimer judy key kill klog lease link locka lockbus lockf lockofd loop madvise malloc mcontend membarrier memfd memhotplug memrate memthrash mergesort mincore mknod mlock mmap mmapaddr mmapfixed mmapfork mmapmany mq mremap msg msync netdev netlink-proc netlink-task nice null open personality physpage pidfd pipe pipeherd pkey poll prctl procfs pthread ptrace pty radixsort ramfs rawdev rawsock readahead reboot rename revio rlimit rmap rtc schedpolicy sctp seal seccomp seek sem sem-sysv sendfile set shellsort shm shm-sysv sigfd sigfpe sigio sigpending sigpipe sigq sigrt sigsegv sigsuspend skiplist sleep sock sockabuse sockdiag sockmany softlockup splice stackmmap stream swap switch symlink sync-file sysbadaddr sysfs tee timer timerfd tlb-shootdown tmpfs tree tsearch tun udp udp-flood unshare urandom userfaultfd utime vdso vfork vm vm-addr vm-rw vm-segv vm-splice wait x86syscall yield zero zombie
14:06:30 INFO | Badret: 0,
14:06:30 INFO |
14:06:30 INFO | Tests took 972 seconds to run

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Tested on Bionic with kernel 4.15.0-97-generic #98 with reproducer and stress-ng sysfs test, fix worked fine.

Hello Colin, I can see this issue with 5.0 kernel (5.0.0-47.51~18.04.1) as well, with the same node hotdog-kernel.

Do you think if we should fix this in 5.0 as well?
Thanks

 sysfs FAILED (kernel oopsed)
 [ 1108.615397] Unable to handle kernel paging request at virtual address ffff000046afa6a6
 [ 1108.617127] Unable to handle kernel paging request at virtual address ffff000046afd2d7
 [ 1108.623317] Mem abort info:
 [ 1108.627466] Unable to handle kernel paging request at virtual address ffff000046affffd
 [ 1108.627469] Mem abort info:
 [ 1108.627470] ESR = 0x96000021
 [ 1108.627473] Exception class = DABT (current EL), IL = 32 bits
 [ 1108.627477] SET = 0, FnV = 0
 [ 1108.627480] EA = 0, S1PTW = 0
 [ 1108.627482] Data abort info:
 [ 1108.627485] ISV = 0, ISS = 0x00000021
 [ 1108.627487] CM = 0, WnR = 0
 [ 1108.627490] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000815ac000
 [ 1108.627495] [ffff000046affffd] pgd=000000bffcfff003, pud=0000009f28e05003, pmd=0000009de53f9003, pte=006800008028f703
 [ 1108.627507] Internal error: Oops: 96000021 [#1] SMP
 [ 1108.627515] Modules linked in: unix_diag binfmt_misc snd_seq snd_seq_device snd_timer snd soundcore userio cuse hci_vhci bluetooth ecdh_generic vfio_iommu_type1 vfio uhid vhost_vsock vmw_vsock_virtio_transport_common vsock vhost_net vhost tap dccp_ipv4 dccp atm algif_rng aegis128 aegis128l aegis256 morus1280 morus640 algif_aead anubis fcrypt khazad seed sm4_generic tea crc32_generic md4 michael_mic nhpoly1305_neon nhpoly1305 poly1305_generic rmd128 rmd160 rmd256 rmd320 sha3_generic sm3_generic streebog_generic tgr192 wp512 algif_hash blowfish_generic blowfish_common cast5_generic des_generic salsa20_generic chacha_neon chacha_generic camellia_generic cast6_generic cast_common serpent_generic twofish_generic twofish_common algif_skcipher af_alg nls_iso8859_1 ipmi_ssif joydev input_leds ipmi_devintf ipmi_msghandler thunderx2_pmu sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456
 [ 1108.627576] async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 multipath linear i2c_smbus aes_ce_blk aes_ce_cipher uas ast i2c_algo_bit ttm drm_kms_helper syscopyarea crct10dif_ce usb_storage ghash_ce sysfillrect qede sha2_ce sysimgblt mpt3sas fb_sys_fops qed sha256_arm64 sha1_ce raid_class drm scsi_transport_sas ahci crc8 gpio_xlp i2c_xlp9xx hid_generic usbhid hid aes_neon_bs aes_neon_blk crypto_simd cryptd aes_arm64
 [ 1108.627607] Process stress-ng-sysfs (pid: 203940, stack limit = 0x0000000047d7ff87)
 [ 1108.627612] CPU: 93 PID: 203940 Comm: stress-ng-sysfs Not tainted 5.0.0-47-generic #51~18.04.1-Ubuntu
 [ 1108.627614] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL027 07/01/2019
 [ 1108.627616] pstate: 80400009 (Nzcv daif +PAN -UAO)
 [ 1108.627623] pc : __memcpy+0x9c/0x180
 [ 1108.627629] lr : memory_read_from_buffer+0x64/0x88
 [ 1108.627630] sp : ffff000059933c90
 [ 1108.627631] x29: ffff000059933c90 x28: ffff809e4d35ac40
 [ 1108.627634] x27: 0000000000000000 x26: 0000000000000000
 [ 1108.627636] x25: 00000000560000...

This bug was fixed in the package linux - 5.3.0-51.44

---------------
linux (5.3.0-51.44) eoan; urgency=medium

  * CVE-2020-11884
    - SAUCE: s390/mm: fix page table upgrade vs 2ndary address mode accesses

 -- Thadeu Lima de Souza Cascardo <email address hidden> Wed, 22 Apr 2020 17:35:41 -0300

This bug was fixed in the package linux - 4.15.0-99.100

---------------
linux (4.15.0-99.100) bionic; urgency=medium

  * CVE-2020-11884
    - SAUCE: s390/mm: fix page table upgrade vs 2ndary address mode accesses

 -- Marcelo Henrique Cerri <email address hidden> Wed, 22 Apr 2020 15:31:14 -0300