On Wed, 18 Jun 2025 08:40:22 +0900 Masami Hiramatsu (Google) mhiramat@kernel.org wrote:
I would add more of what you found above in the change log. And the issue that was triggered I don't think was because of a buffer overflow. It was because an entry was added to the text_poke_array out of order causing the bsearch to fail.
There are two patterns of bugs I saw, one is "Oops: int3" and another is "#PF in smp_text_poke_batch_finish (or smp_text_poke_int3_handler)". The latter comes from buffer overflow.
[ 164.164215] BUG: unable to handle page fault for address: ffffffff32c00000 [ 164.166999] #PF: supervisor read access in kernel mode [ 164.169096] #PF: error_code(0x0000) - not-present page [ 164.171143] PGD 8364b067 P4D 8364b067 PUD 0 [ 164.172954] Oops: Oops: 0000 [#1] SMP PTI [ 164.174581] CPU: 4 UID: 0 PID: 2702 Comm: sh Tainted: G W 6.15.0-next-20250606-00002-g75b4e49588c2 #239 PREEMPT(voluntary) [ 164.179193] Tainted: [W]=WARN [ 164.180926] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 164.184696] RIP: 0010:smp_text_poke_batch_finish+0xb9/0x400 [ 164.186873] Code: e4 4c 8d 6d c2 85 c9 74 39 48 63 03 b9 01 00 00 00 4c 89 ea 41 83 c4 01 48 c7 c7 d0 f7 f7 b2 48 83 c3 10 48 8d b0 00 00 c0 b2 <0f> b6 80 00 00 c0 b2 88 43 ff e8 68 e3 ff ff 44 3b 25 d1 29 5f 02
This is because smp_text_poke_single() overwrites the text_poke_array.vec[TEXT_POKE_ARRAY_MAX], which is nr_entries (and the variables next to text_poke_array.)
Interesting. It must be that the stress test was able to get in and add a bunch of individual entries while a batch was being performed.
Still, both are a bug and solved by the same solution ;-)
(Two for the price of one!)
-- Steve