kexec is not working in 6.15-rc1

kexec is not working in 6.15-rc1

[Sourabh Jain]

Hello All,

I noticed that kexec is broken on the upstream v6.15-rc1 kernel.

My testing was limited to PowerPC (pSeries), but it's possible that 
other architectures may have a similar issue.

Both the first and kexec kernel are v6.15-rc1.

Distro: RHEL

Kexec command to load kexec kernel:
-------------------------------------------------------
kexec --initrd=/boot/initramfs-`uname -r`.img /boot/vmlinuz-`uname -r` 
--append="`cat /proc/cmdline`" -lsd

To kexec into new kernel:
------------------------------------
reboot


Console log:
-----------------

[   90.405318] dracut: Disassembling device-mapper devices
[   90.892608] Removing IBM Power 842 compression device
[   90.892635] Kernel attempted to read user page (4fbcaf0008) - exploit 
attempt? (uid: 0)
[   90.892642] BUG: Unable to handle kernel data access on read at 
0x4fbcaf0008
[   90.892647] Faulting instruction address: 0xc000000000845eb0
[   90.892652] Oops: Kernel access of bad area, sig: 11 [#1]
[   90.892655] LE PAGE_SIZE=64K MMU=Radix  SMP NR_CPUS=2048 NUMA pSeries
[   90.892661] Modules linked in: xsk_diag nft_fib_inet nft_fib_ipv4 
nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 
nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 
nf_defrag_ipv4 bonding tls rfkill ip_set nf_tables nfnetlink binfmt_misc 
pseries_rng vmx_crypto drm drm_panel_orientation_quirks xfs sd_mod sg 
ibmvscsi ibmveth scsi_transport_srp pseries_wdt dm_mirror dm_region_hash 
vfio_pci dm_log vfio_pci_core irqbypass dm_mod vfio_iommu_spapr_tce vfio 
iommufd fuse
[   90.892714] CPU: 14 UID: 0 PID: 6192 Comm: kexec Kdump: loaded Not 
tainted 6.15.0-rc1 #10 VOLUNTARY
[   90.892723] Hardware name: IBM,9824-42A Power11 (architected) 
0x820200 0xf000007 of:IBM,FW1110.00 (NL1110_015) hv:phyp pSeries
[   90.892730] NIP:  c000000000845eb0 LR: c000000000845ee0 CTR: 
c000000000845f2c
[   90.892734] REGS: c00000019964f6e0 TRAP: 0300   Not tainted (6.15.0-rc1)
[   90.892741] MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 
48088288  XER: 2004000a
[   90.892752] CFAR: c000000000845ef4 DAR: 0000004fbcaf0008 DSISR: 
40000000 IRQMASK: 0
[   90.892752] GPR00: c00000000082e808 c00000019964f980 c000000001b38100 
0000000000000000
[   90.892752] GPR04: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   90.892752] GPR08: 0000000000000000 0000004fbcaf0000 0000000000000000 
0000000000008000
[   90.892752] GPR12: c000000000845f2c c000004fbfff2480 0000000000000000 
0000000000000000
[   90.892752] GPR16: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   90.892752] GPR20: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   90.892752] GPR24: 0000000000000000 0000000000000000 0000000000000000 
c0000000015e11d8
[   90.892752] GPR28: 0000000000000000 c000000002c5b8b0 c000000002cc6bc0 
0000000000000000
[   90.892796] NIP [c000000000845eb0] scomp_free_streams+0x6c/0xe8
[   90.892803] LR [c000000000845ee0] scomp_free_streams+0x9c/0xe8
[   90.892808] Call Trace:
[   90.892810] [c00000019964f980] [c00000019964f988] 0xc00000019964f988 
(unreliable)
[   90.892816] [c00000019964f9d0] [c00000000082e808] 
crypto_destroy_alg+0x48/0x7c
[   90.892822] [c00000019964fa00] [c000000000832ec4] 
crypto_unregister_alg+0x104/0x180
[   90.892829] [c00000019964faa0] [c0000000008460bc] 
crypto_unregister_scomp+0x24/0x38
[   90.892834] [c00000019964fac0] [c000000000cce9d8] nx842_remove+0x88/0x120
[   90.892841] [c00000019964fb50] [c000000000112a2c] 
vio_bus_remove+0x58/0xcc
[   90.892848] [c00000019964fb90] [c000000000b0853c] 
device_shutdown+0x220/0x3b4
[   90.892856] [c00000019964fc20] [c0000000001a2f14] 
kernel_restart_prepare+0x54/0x68
[   90.892863] [c00000019964fc40] [c0000000002af1dc] kernel_kexec+0x84/0x118
[   90.892869] [c00000019964fcb0] [c0000000001a35e4] 
__do_sys_reboot+0x210/0x2c4
[   90.892877] [c00000019964fe10] [c0000000000308f4] 
system_call_exception+0x124/0x320
[   90.892885] [c00000019964fe50] [c00000000000cedc] 
system_call_vectored_common+0x15c/0x2ec
[   90.892893] --- interrupt: 3000 at 0x7fffa40cf970
[   90.892898] NIP:  00007fffa40cf970 LR: 00007fffa40cf970 CTR: 
0000000000000000
[   90.892902] REGS: c00000019964fe80 TRAP: 3000   Not tainted (6.15.0-rc1)
[   90.892909] MSR:  800000000280f033 
<SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 48022884  XER: 00000000
[   90.892919] IRQMASK: 0
[   90.892919] GPR00: 0000000000000058 00007fffe2c644d0 0000000116c37f00 
fffffffffee1dead
[   90.892919] GPR04: 0000000028121969 0000000045584543 0000000000000000 
0000000000000003
[   90.892919] GPR08: 0000000000100000 0000000000000000 0000000000000000 
0000000000000000
[   90.892919] GPR12: 0000000000000000 00007fffa433b2e0 0000000116c2f568 
ffffffffffffffff
[   90.892919] GPR16: 0000000116c10b98 0000000000000000 0000000000000002 
0000000000000000
[   90.892919] GPR20: 0000000137e81060 0000000000008913 0000000000000000 
0000000000008914
[   90.892919] GPR24: 0000000000000001 0000000000000003 0000000000000003 
00007fffe2c64590
[   90.892919] GPR28: 0000000116c0ade0 0000000116c0add8 00007fffa41c19c0 
0000000137e81080
[   90.892959] NIP [00007fffa40cf970] 0x7fffa40cf970
[   90.892963] LR [00007fffa40cf970] 0x7fffa40cf970
[   90.892966] --- interrupt: 3000
[   90.892968] Code: 3d22ffab 3b6990d8 f8010010 f821ffb1 f8410018 
eb4301a0 7f5cd378 48000034 3d220119 3929a268 7d29502a 7d29e214 
<e8690008> 2c230000 41820040 e99d0008
[   90.892982] ---[ end trace 0000000000000000 ]---
[   90.895452] pstore: backend (nvram) writing error (-1)
[   90.895456]
[   91.895460] Kernel panic - not syncing: Fatal exception
[   91.903894] Rebooting in 10 seconds..


Git bisect identified the first bad commit as:
---------------------------------------------------------------

27b13425349e94ad77b174b032674097cab241c8 is the first bad commit
commit 27b13425349e94ad77b174b032674097cab241c8
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Sun Mar 16 17:50:24 2025 +0800

     crypto: api - Call crypto_alg_put in crypto_unregister_alg

     Instead of calling cra_destroy by hand, call it through
     crypto_alg_put so that the correct unwinding functions are called
     through crypto_destroy_alg.

     Fixes: 3d6979bf3bd5 ("crypto: api - Add cra_type->destroy hook")
     Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

  crypto/algapi.c | 3 +--
  1 file changed, 1 insertion(+), 2 deletions(-)


Git bisect log:
-------------------

[root@root linux]# git bisect log
git bisect start
# status: waiting for both good and bad commits
# bad: [0af2f6be1b4281385b618cb86ad946eded089ac8] Linux 6.15-rc1
git bisect bad 0af2f6be1b4281385b618cb86ad946eded089ac8
# status: waiting for good commit(s), bad commit known
# good: [e3185ee438c28ee926cb3ef26f3bfb0aae510606] powerpc/crash: use 
generic crashkernel reservation
git bisect good e3185ee438c28ee926cb3ef26f3bfb0aae510606
# good: [a9fc2304972b1db28b88af8203dffef23e1e92ba] Merge tag 
'soc-drivers-6.15-1' of 
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
git bisect good a9fc2304972b1db28b88af8203dffef23e1e92ba
# bad: [1c83601b8ffc1b4ba8dc7f35151131707a8a5ae7] Merge tag 'mips_6.15' 
of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
git bisect bad 1c83601b8ffc1b4ba8dc7f35151131707a8a5ae7
# good: [a82866fbecca6961c00edb2035ad66478571012c] Merge tag 
'amd-drm-next-6.15-2025-03-21' of 
https://gitlab.freedesktop.org/agd5f/linux into drm-next
git bisect good a82866fbecca6961c00edb2035ad66478571012c
# good: [f174ac5ba2d0c77b406b3f73bdcde819d6ed6704] Merge tag 
'ipe-pr-20250324' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe
git bisect good f174ac5ba2d0c77b406b3f73bdcde819d6ed6704
# good: [7d06015d936c861160803e020f68f413b5c3cd9d] Merge tag 
'pci-v6.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
git bisect good 7d06015d936c861160803e020f68f413b5c3cd9d
# bad: [0ccff074d6aa45835ccb7c0e4a995a32e4c90b5a] Merge tag 
'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
git bisect bad 0ccff074d6aa45835ccb7c0e4a995a32e4c90b5a
# good: [c3e054dbdb08fef653ea3ef9e6dca449a214c976] crypto: api - Move 
struct crypto_type into internal.h
git bisect good c3e054dbdb08fef653ea3ef9e6dca449a214c976
# good: [b03d542c3c9569f549b1ba0cf7f4d90151fbf8ab] PM: hibernate: Use 
crypto_acomp interface
git bisect good b03d542c3c9569f549b1ba0cf7f4d90151fbf8ab
# good: [7e9dd0d1e9c50cedef403d4bef6a2c1dc22ac79d] pds_core: add new 
fwctl auxiliary_device
git bisect good 7e9dd0d1e9c50cedef403d4bef6a2c1dc22ac79d
# good: [fce8b8d5986b76a4fdd062e3eec1bb6420fee6c5] crypto: remove 
obsolete 'comp' compression API
git bisect good fce8b8d5986b76a4fdd062e3eec1bb6420fee6c5
# bad: [8b54e6a8f4156ed43627f40300b0711dc977fbc1] crypto: testmgr - Add 
multibuffer hash testing
git bisect bad 8b54e6a8f4156ed43627f40300b0711dc977fbc1
# bad: [27b13425349e94ad77b174b032674097cab241c8] crypto: api - Call 
crypto_alg_put in crypto_unregister_alg
git bisect bad 27b13425349e94ad77b174b032674097cab241c8
# good: [5a06ef1f8da226b2de587e22c17f88b72cede3be] crypto: scompress - 
Fix incorrect stream freeing
git bisect good 5a06ef1f8da226b2de587e22c17f88b72cede3be
# first bad commit: [27b13425349e94ad77b174b032674097cab241c8] crypto: 
api - Call crypto_alg_put in crypto_unregister_alg


Thanks,
Sourabh Jain

[PATCH] crypto: scomp - Fix null-pointer deref when freeing streams

[Herbert Xu]

On Mon, Apr 07, 2025 at 11:49:27PM +0530, Sourabh Jain wrote:
>
> [   90.892796] NIP [c000000000845eb0] scomp_free_streams+0x6c/0xe8
> [   90.892803] LR [c000000000845ee0] scomp_free_streams+0x9c/0xe8

Looks like I never tested 842 which curiously does not have a
self-test.  Please try this patch:

---8<---
As the scomp streams are freed when an algorithm is unregistered,
it is possible that the algorithm has never been used at all (e.g.,
an algorithm that does not have a self-test).  So test whether the
streams exist before freeing them.

Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Fixes: 3d72ad46a23a ("crypto: acomp - Move stream management into scomp layer")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/scompress.c b/crypto/scompress.c
index d435d4b24469..f67ce38d203d 100644
--- a/crypto/scompress.c
+++ b/crypto/scompress.c
@@ -111,6 +111,9 @@ static void scomp_free_streams(struct scomp_alg *alg)
 	struct crypto_acomp_stream __percpu *stream = alg->stream;
 	int i;
 
+	if (!stream)
+		return;
+
 	for_each_possible_cpu(i) {
 		struct crypto_acomp_stream *ps = per_cpu_ptr(stream, i);
 
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] crypto: scomp - Fix null-pointer deref when freeing streams

[Sourabh Jain]

Hello Herbert,


On 08/04/25 09:50, Herbert Xu wrote:
> On Mon, Apr 07, 2025 at 11:49:27PM +0530, Sourabh Jain wrote:
>> [   90.892796] NIP [c000000000845eb0] scomp_free_streams+0x6c/0xe8
>> [   90.892803] LR [c000000000845ee0] scomp_free_streams+0x9c/0xe8
> Looks like I never tested 842 which curiously does not have a
> self-test.  Please try this patch:
>
> ---8<---
> As the scomp streams are freed when an algorithm is unregistered,
> it is possible that the algorithm has never been used at all (e.g.,
> an algorithm that does not have a self-test).  So test whether the
> streams exist before freeing them.
>
> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
> Fixes: 3d72ad46a23a ("crypto: acomp - Move stream management into scomp layer")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> diff --git a/crypto/scompress.c b/crypto/scompress.c
> index d435d4b24469..f67ce38d203d 100644
> --- a/crypto/scompress.c
> +++ b/crypto/scompress.c
> @@ -111,6 +111,9 @@ static void scomp_free_streams(struct scomp_alg *alg)
>   	struct crypto_acomp_stream __percpu *stream = alg->stream;
>   	int i;
>   
> +	if (!stream)
> +		return;
> +
>   	for_each_possible_cpu(i) {
>   		struct crypto_acomp_stream *ps = per_cpu_ptr(stream, i);
>   

The above fix resolves the reported issue.

Thanks for the fix.

Feel free to add:

Tested-by: Sourabh Jain <sourabhjain@linux.ibm.com>

Thanks,
Sourabh Jain

Re: [PATCH] crypto: scomp - Fix null-pointer deref when freeing streams

[Sourabh Jain]

Hi Herbert,


On 08/04/25 09:50, Herbert Xu wrote:
> On Mon, Apr 07, 2025 at 11:49:27PM +0530, Sourabh Jain wrote:
>> [   90.892796] NIP [c000000000845eb0] scomp_free_streams+0x6c/0xe8
>> [   90.892803] LR [c000000000845ee0] scomp_free_streams+0x9c/0xe8
> Looks like I never tested 842 which curiously does not have a
> self-test.  Please try this patch:
>
> ---8<---
> As the scomp streams are freed when an algorithm is unregistered,
> it is possible that the algorithm has never been used at all (e.g.,
> an algorithm that does not have a self-test).  So test whether the
> streams exist before freeing them.
>
> Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
> Fixes: 3d72ad46a23a ("crypto: acomp - Move stream management into scomp layer")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> diff --git a/crypto/scompress.c b/crypto/scompress.c
> index d435d4b24469..f67ce38d203d 100644
> --- a/crypto/scompress.c
> +++ b/crypto/scompress.c
> @@ -111,6 +111,9 @@ static void scomp_free_streams(struct scomp_alg *alg)
>   	struct crypto_acomp_stream __percpu *stream = alg->stream;
>   	int i;
>   
> +	if (!stream)
> +		return;
> +
>   	for_each_possible_cpu(i) {
>   		struct crypto_acomp_stream *ps = per_cpu_ptr(stream, i);


The above fix doesn't apply cleanly on next-20250409.

Your changes are part of scomp_free_streams function but this function 
is not
their in next-20250409.


Also the issue reproducible on next-20250409, here is the backtrace:

5.955234] systemd-shutdown[1]: Syncing /dev/dm-1.
[   36.014414] systemd-shutdown[1]: Not all DM devices detached, 1 left.
[   36.014521] systemd-shutdown[1]: Detaching DM devices.
[   36.014789] systemd-shutdown[1]: Not all DM devices detached, 1 left.
[   36.014798] systemd-shutdown[1]: Cannot finalize remaining DM 
devices, continuing.
[   36.348709] systemd-shutdown[1]: Successfully changed into root pivot.
[   36.348726] systemd-shutdown[1]: Entering exitrd...
[   36.369754] dracut Warning: Killing all remaining processes
dracut Warning: Killing all remaining processes
[48;1R^[[48;213R[   36.389749] XFS (dm-0): Unmounting Filesystem 
256d3d13-3884-4ddd-a72e-82e0ebbd9475
[   36.392895] dracut Warning: Unmounted /oldroot.
dracut Warning: Unmounted /oldroot.
[   36.407513] dracut: Disassembling device-mapper devices
[   36.816091] Removing IBM Power 842 compression device
[   36.816132] ------------[ cut here ]------------
[   36.816137] WARNING: CPU: 47 PID: 2725 at kernel/workqueue.c:4205 
__flush_work+0x74/0x590
[   36.816150] Modules linked in: bonding tls rfkill ibmveth pseries_rng 
vmx_crypto sg fuse loop nfnetlink vsock_loopback 
vmw_vsock_virtio_transport_common vsock xfs sd_mod ibmvscsi 
scsi_transport_srp pseries_wdt dm_mirror dm_region_hash dm_log dm_mod
[   36.816180] CPU: 47 UID: 0 PID: 2725 Comm: kexec Not tainted 
6.15.0-rc1-next-20250409kexec-crypto-fix #19 VOLUNTARY
[   36.816188] Hardware name: IBM,9080-HEX POWER10 (architected) 
0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries
[   36.816195] NIP:  c000000000250384 LR: c00000000025035c CTR: 
0000000000000000
[   36.816200] REGS: c00000009e7eb5d0 TRAP: 0700   Not tainted 
(6.15.0-rc1-next-20250409kexec-crypto-fix)
[   36.816206] MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 
24088280  XER: 2004000a
[   36.816217] CFAR: c000000000180724 IRQMASK: 0
[   36.816217] GPR00: 0000000000000001 c00000009e7eb870 c000000001d58100 
c00000009e7eb890
[   36.816217] GPR04: 0000000000000000 0000000000000000 c00000009e7eb8d8 
0000000000000000
[   36.816217] GPR08: 0000000000000000 0000000000000001 0000000000000000 
0000000044088282
[   36.816217] GPR12: c00000000093c840 c0000003fdd81880 0000000000000000 
0000000000000000
[   36.816217] GPR16: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   36.816217] GPR20: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   36.816217] GPR24: 0000000000000000 0000000000000000 0000000000000000 
c0000000030365f8
[   36.816217] GPR28: 0000000000000001 c000000002c06898 c000000002cca628 
c000000002cca628
[   36.816266] NIP [c000000000250384] __flush_work+0x74/0x590
[   36.816272] LR [c00000000025035c] __flush_work+0x4c/0x590
[   36.816276] Call Trace:
[   36.816279] [c00000009e7eb870] [c00000000024e694] 
__cancel_work+0xa4/0x180 (unreliable)
[   36.816286] [c00000009e7eb910] [c000000000251664] 
cancel_work_sync+0xa4/0xe0
[   36.816292] [c00000009e7eb940] [c00000000093af84] 
crypto_acomp_free_streams+0x44/0x120
[   36.816300] [c00000009e7eb990] [c00000000093c860] 
crypto_scomp_destroy+0x20/0x40
[   36.816306] [c00000009e7eb9b0] [c0000000009284a4] 
crypto_unregister_alg+0xf4/0x160
[   36.816314] [c00000009e7eba50] [c00000000093ca10] 
crypto_unregister_scomp+0x20/0x40
[   36.816320] [c00000009e7eba70] [c000000000e375b8] nx842_remove+0x8c/0x114
[   36.816328] [c00000009e7ebaf0] [c0000000001d3db0] 
vio_bus_remove+0x50/0xc0
[   36.816334] [c00000009e7ebb20] [c000000000c6bf4c] 
device_shutdown+0x21c/0x39c
[   36.816342] [c00000009e7ebbb0] [c0000000002657b0] 
kernel_restart_prepare+0x50/0x70
[   36.816349] [c00000009e7ebbd0] [c00000000038bf48] kernel_kexec+0xa8/0x110
[   36.816358] [c00000009e7ebc40] [c000000000265e44] 
__do_sys_reboot+0x204/0x2d0
[   36.816364] [c00000009e7ebda0] [c000000000030be8] 
system_call_exception+0x138/0x2d0
[   36.816372] [c00000009e7ebe50] [c00000000000cedc] 
system_call_vectored_common+0x15c/0x2ec
[   36.816380] --- interrupt: 3000 at 0x7fffb0c99d70
[   36.816389] NIP:  00007fffb0c99d70 LR: 00007fffb0c99d70 CTR: 
0000000000000000
[   36.816393] REGS: c00000009e7ebe80 TRAP: 3000   Not tainted 
(6.15.0-rc1-next-20250409kexec-crypto-fix)
[   36.816398] MSR:  800000000280f033 
<SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 48022484  XER: 00000000
[   36.816413] IRQMASK: 0
[   36.816413] GPR00: 0000000000000058 00007fffe7ba4e50 0000000000100000 
fffffffffee1dead
[   36.816413] GPR04: 0000000028121969 0000000045584543 0000000000000000 
0000000000000003
[   36.816413] GPR08: 0000000000000004 0000000000000000 0000000000000000 
0000000000000000
[   36.816413] GPR12: 0000000000000000 00007fffb0f0b3c0 ffffffffffffffff 
0000000000000000
[   36.816413] GPR16: 0000000000000001 0000000000000002 0000000000000001 
0000000000000001
[   36.816413] GPR20: 0000000123c8f520 0000000000000000 0000000000000000 
0000000000000001
[   36.816413] GPR24: 0000000139a80480 0000000000000003 0000000000000003 
00007fffe7ba4f20
[   36.816413] GPR28: 0000000123c6a7b0 0000000123c6a7a8 00007fffb0d818d0 
0000000139a804a0
[   36.816460] NIP [00007fffb0c99d70] 0x7fffb0c99d70
[   36.816464] LR [00007fffb0c99d70] 0x7fffb0c99d70
[   36.816468] --- interrupt: 3000
[   36.816471] Code: 39200000 4bf302f1 60000000 3d22010c 8929b344 
69290001 0b090000 2c090000 408202e0 e95e0018 7d490074 7929d182 
<0b090000> 2c2a0000 418202c8 fba10088
[   36.816486] ---[ end trace 0000000000000000 ]---
[   36.816491] Kernel attempted to read user page (3faee0008) - exploit 
attempt? (uid: 0)
[   36.816498] BUG: Unable to handle kernel data access on read at 
0x3faee0008
[   36.816503] Faulting instruction address: 0xc00000000093afe0
[   36.816511] Oops: Kernel access of bad area, sig: 11 [#1]
[   36.816514] LE PAGE_SIZE=64K MMU=Radix  SMP NR_CPUS=8192 NUMA pSeries
[   36.816519] Modules linked in: bonding tls rfkill ibmveth pseries_rng 
vmx_crypto sg fuse loop nfnetlink vsock_loopback 
vmw_vsock_virtio_transport_common vsock xfs sd_mod ibmvscsi 
scsi_transport_srp pseries_wdt dm_mirror dm_region_hash dm_log dm_mod
[   36.816539] CPU: 47 UID: 0 PID: 2725 Comm: kexec Tainted: G        
W           6.15.0-rc1-next-20250409kexec-crypto-fix #19 VOLUNTARY
[   36.816546] Tainted: [W]=WARN
[   36.816549] Hardware name: IBM,9080-HEX POWER10 (architected) 
0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries
[   36.816554] NIP:  c00000000093afe0 LR: c00000000093afb4 CTR: 
0000000000000000
[   36.816558] REGS: c00000009e7eb6a0 TRAP: 0300   Tainted: G 
W            (6.15.0-rc1-next-20250409kexec-crypto-fix)
[   36.816563] MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 
44088280  XER: 2004000a
[   36.816572] CFAR: c000000000a42b14 DAR: 00000003faee0008 DSISR: 
40000000 IRQMASK: 0
[   36.816572] GPR00: c00000000093af84 c00000009e7eb940 c000000001d58100 
0000000000000000
[   36.816572] GPR04: 0000000000000080 0000000000000000 0000000000000000 
ffffffffffffffff
[   36.816572] GPR08: c0000000017d11d8 00000003faee0000 0000000000000000 
0000000000008000
[   36.816572] GPR12: c000000000e37640 c0000003fdd81880 0000000000000000 
0000000000000000
[   36.816572] GPR16: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   36.816572] GPR20: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[   36.816572] GPR24: 0000000000000000 0000000000000000 0000000000000000 
c0000000017d11d8
[   36.816572] GPR28: 0000000000000000 c000000000e37640 c000000002d5c0f0 
0000000000000000
[   36.816620] NIP [c00000000093afe0] crypto_acomp_free_streams+0xa0/0x120
[   36.816624] LR [c00000000093afb4] crypto_acomp_free_streams+0x74/0x120
[   36.816630] Call Trace:
[   36.816632] [c00000009e7eb940] [c00000000093af84] 
crypto_acomp_free_streams+0x44/0x120 (unreliable)
[   36.816638] [c00000009e7eb990] [c00000000093c860] 
crypto_scomp_destroy+0x20/0x40
[   36.816644] [c00000009e7eb9b0] [c0000000009284a4] 
crypto_unregister_alg+0xf4/0x160
[   36.816650] [c00000009e7eba50] [c00000000093ca10] 
crypto_unregister_scomp+0x20/0x40
[   36.816656] [c00000009e7eba70] [c000000000e375b8] nx842_remove+0x8c/0x114
[   36.816662] [c00000009e7ebaf0] [c0000000001d3db0] 
vio_bus_remove+0x50/0xc0
[   36.816667] [c00000009e7ebb20] [c000000000c6bf4c] 
device_shutdown+0x21c/0x39c
[   36.816674] [c00000009e7ebbb0] [c0000000002657b0] 
kernel_restart_prepare+0x50/0x70
[   36.816680] [c00000009e7ebbd0] [c00000000038bf48] kernel_kexec+0xa8/0x110
[   36.816685] [c00000009e7ebc40] [c000000000265e44] 
__do_sys_reboot+0x204/0x2d0
[   36.816692] [c00000009e7ebda0] [c000000000030be8] 
system_call_exception+0x138/0x2d0
[   36.816698] [c00000009e7ebe50] [c00000000000cedc] 
system_call_vectored_common+0x15c/0x2ec
[   36.816705] --- interrupt: 3000 at 0x7fffb0c99d70
[   36.816708] NIP:  00007fffb0c99d70 LR: 00007fffb0c99d70 CTR: 
0000000000000000
[   36.816713] REGS: c00000009e7ebe80 TRAP: 3000   Tainted: G 
W            (6.15.0-rc1-next-20250409kexec-crypto-fix)
[   36.816719] MSR:  800000000280f033 
<SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 48022484  XER: 00000000
[   36.816730] IRQMASK: 0
[   36.816730] GPR00: 0000000000000058 00007fffe7ba4e50 0000000000100000 
fffffffffee1dead
[   36.816730] GPR04: 0000000028121969 0000000045584543 0000000000000000 
0000000000000003
[   36.816730] GPR08: 0000000000000004 0000000000000000 0000000000000000 
0000000000000000
[   36.816730] GPR12: 0000000000000000 00007fffb0f0b3c0 ffffffffffffffff 
0000000000000000
[   36.816730] GPR16: 0000000000000001 0000000000000002 0000000000000001 
0000000000000001
[   36.816730] GPR20: 0000000123c8f520 0000000000000000 0000000000000000 
0000000000000001
[   36.816730] GPR24: 0000000139a80480 0000000000000003 0000000000000003 
00007fffe7ba4f20
[   36.816730] GPR28: 0000000123c6a7b0 0000000123c6a7a8 00007fffb0d818d0 
0000000139a804a0
[   36.816776] NIP [00007fffb0c99d70] 0x7fffb0c99d70
[   36.816780] LR [00007fffb0c99d70] 0x7fffb0c99d70
[   36.816784] --- interrupt: 3000
[   36.816786] Code: 48107aa1 60000000 813e0000 7faceb78 7c7f1b78 
7c6a1ef4 7c091840 4081005c 3d2200ff 39292568 7d29502a 7d29e214 
<e8690008> 2c230000 41820010 7fa903a6
[   36.816802] ---[ end trace 0000000000000000 ]---
[   36.819332] pstore: backend (nvram) writing error (-1)
[   36.819336]
[   37.819340] Kernel panic - not syncing: Fatal exce


It could be possible that the below commit is causing the conflict:

commit 42d9f6c774790d290c175e8775ce9f1366438098
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Mar 19 14:04:52 2025 +0800

     crypto: acomp - Move scomp stream allocation code into acomp

     Move the dynamic stream allocation code into acomp and make it
     available as a helper for acomp algorithms.

     Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>


The above commit actually removes the scomp_free_streams function.

Thoughts?

Thanks,
Sourabh Jain

Re: [PATCH] crypto: scomp - Fix null-pointer deref when freeing streams

[Herbert Xu]

On Thu, Apr 10, 2025 at 09:15:56AM +0530, Sourabh Jain wrote:
>
> The above fix doesn't apply cleanly on next-20250409.

It should be fixed in the latest cryptodev tree:

https://web.git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/commit/?id=5322584385d938773cbb562db64d8423dd5fd026

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt