From: Masami Hiramatsu (Google) mhiramat@kernel.org
An Oops caused by a stray INT3 is reported by LKFT.
## Test log ftrace-stress-test: <12>[ 21.971153] /usr/local/bin/kirk[277]: starting test ftrace-stress-test (ftrace_stress_test.sh 90) <4>[ 58.997439] Oops: int3: 0000 [#1] SMP PTI <4>[ 58.998089] CPU: 0 UID: 0 PID: 323 Comm: sh Not tainted 6.15.0-next-20250605 #1 PREEMPT(voluntary) <4>[ 58.998152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 <4>[ 58.998260] RIP: 0010:_raw_spin_lock+0x5/0x50 <4>[ 58.998563] Code: 5d e9 ff 12 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f <1f> 44 00 00 55 48 89 e5 53 48 89 fb bf 01 00 00 00 e8 15 12 e4 fe
But INT3(cc) is not shown in the dumped code. This means there is a chance to handle an INT3 exception when the INT3 is replaecd with the original instruction.
To evacuate the kernel from this stuation, when the kernel failed to handle the INT3, check whether there is an INT3 at the trapped address. If there isn't, retry executing the new instruction.
Reported-by: Linux Kernel Functional Testing lkft@linaro.org Closes: https://lore.kernel.org/all/CA+G9fYsLu0roY3DV=tKyqP7FEKbOEETRvTDhnpPxJGbA=Cg... Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org --- arch/x86/kernel/traps.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index c5c897a86418..f489e86c1b5e 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -880,6 +880,29 @@ static void do_int3_user(struct pt_regs *regs) cond_local_irq_disable(regs); }
+static int handle_disappeared_int3(struct pt_regs *regs) +{ + unsigned long addr = instruction_pointer(regs) - INT3_INSN_SIZE; + unsigned char opcode; + int ret; + + /* + * Evacuate the kernel from disappeared int3, which was there when + * the exception happens, but it is removed now by another CPU. + */ + ret = copy_from_kernel_nofault(&opcode, (void *)addr, INT3_INSN_SIZE); + if (ret < 0) + return ret; + if (opcode == INT3_INSN_OPCODE) + return -EFAULT; + + /* There is no INT3 here. Retry with the new instruction. */ + WARN_ONCE(1, "A disappeared INT3 was handled at %pS.", (void *)addr); + instruction_pointer_set(regs, addr); + + return 0; +} + DEFINE_IDTENTRY_RAW(exc_int3) { /* @@ -907,7 +930,7 @@ DEFINE_IDTENTRY_RAW(exc_int3) irqentry_state_t irq_state = irqentry_nmi_enter(regs);
instrumentation_begin(); - if (!do_int3(regs)) + if (!do_int3(regs) && handle_disappeared_int3(regs) < 0) die("int3", regs, 0); instrumentation_end(); irqentry_nmi_exit(regs, irq_state);