WARNING: can't access registers at asm_sysvec_call_function_single

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f4d51dff Linux 5.9-rc4
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1455d4f9900000
kernel config: https://syzkaller.appspot.com/x/.config?x=a9075b36a6ae26c9
dashboard link: https://syzkaller.appspot.com/bug?extid=bc9dbf05dcc151e9b972
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc9dbf...@syzkaller.appspotmail.com

WARNING: can't access registers at asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:589


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Thomas Gleixner]

On Tue, Sep 08 2020 at 13:16, syzbot wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: f4d51dff Linux 5.9-rc4
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1455d4f9900000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a9075b36a6ae26c9
> dashboard link: https://syzkaller.appspot.com/bug?extid=bc9dbf05dcc151e9b972
> compiler: gcc (GCC) 10.1.0-syz 20200507
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+bc9dbf...@syzkaller.appspotmail.com
>
> WARNING: can't access registers at asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:589

That's the ORC unwinder complaining, but I have no idea why...

[Josh Poimboeuf]

0000000000000cd0 <asm_sysvec_call_function_single>:
cd0: 90 nop
cd1: 90 nop
cd2: 90 nop
cd3: 6a ff pushq $0xffffffffffffffff
cd5: e8 b6 03 00 00 callq 1090 <error_entry>
cda: 48 89 e7 mov %rsp,%rdi
cdd: e8 00 00 00 00 callq ce2 <asm_sysvec_call_function_single+0x12>
cde: R_X86_64_PLT32 sysvec_call_function_single-0x4
ce2: e9 69 04 00 00 jmpq 1150 <error_return>
ce7: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
cee: 00 00

This is a head scratcher. The ORC data looks ok, at least when I build
it on my system. It's expecting to find pt_regs at the top of the stack
after returning from sysvec_call_function_single(). But it can't
dereference the regs for some reason.

So either it's a bug in ORC data or unwinder (not likely) or the stack
pointer got corrupted somehow (also seems unlikely)...

--
Josh

[Josh Poimboeuf]

The true bug may be revealed elsewhere on the stack... I probably need
to start enabling ORC stack dumps like I did for FP.

--
Josh

[Dmitry Vyukov]

Hi Josh,

Is there a config for this? We could enable it on syzbot. More
informative kernel diagnostics are always better.

[Josh Poimboeuf]

Unfortunately the ORC dump code doesn't exist upstream yet. I need to
dust the patches off and post.

--
Josh

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.