Re: [PATCH] powerpc/970: fix nap return address corruption on async interrupt exit

[John Ogness <john.ogness@linutronix.de>]

On 2026-07-16, John Ogness <john.ogness@linutronix.de> wrote:
> On 2026-07-07, "Mukesh Kumar Chaurasiya (IBM)" <mkchauras@gmail.com> wrote:
>> On PowerMac G5 (PPC970, CONFIG_PPC_970_NAP) the system panics shortly
>> after boot with symptoms including instruction fetch faults, kernel data
>> access faults, and stack corruption, predominantly on SMP and always
>> somewhere inside softirq processing.
>>
>> The PPC970 idle path works by setting _TLF_NAPPING in the current
>> thread's local flags before entering the MSR_POW nap loop.  When any
>> async interrupt wakes the CPU, nap_adjust_return() is expected to detect
>> _TLF_NAPPING, clear it, and rewrite regs->NIP to power4_idle_nap_return
>> so that the interrupt returns cleanly to the caller of power4_idle_nap()
>> rather than back into the nap spin loop.
>>
>> DEFINE_INTERRUPT_HANDLER_ASYNC generates the following sequence:
>>
>>     irq_enter_rcu();
>>     ____func(regs);           /* timer_interrupt / do_IRQ body */
>>     irq_exit_rcu();           /* softirqs run here, irqs re-enabled */
>>     arch_interrupt_async_exit_prepare(regs); /* nap_adjust_return was here */
>>     irqentry_exit(regs, state);
>>
>> irq_exit_rcu() calls invoke_softirq() -> do_softirq_own_stack(), which
>> runs softirqs with hardware interrupts re-enabled.  A nested async
>> interrupt can therefore arrive while _TLF_NAPPING is still set.  That
>> nested interrupt reaches nap_adjust_return() in its own
>> arch_interrupt_async_exit_prepare() call, finds _TLF_NAPPING set, and
>> redirects *its own* regs->NIP to power4_idle_nap_return.  Returning via
>> that blr with an unrelated LR on the softirq stack jumps to a garbage
>> address, causing the observed crashes.
>>
>> The comment that previously lived in arch_interrupt_async_exit_prepare()
>> even described this exact hazard ("must come before irq_exit()"), but
>> nap_adjust_return() was placed after irq_exit_rcu() in the macro, so
>> the protection was never effective.
>>
>> Fix this by calling nap_adjust_return() inside DEFINE_INTERRUPT_HANDLER_ASYNC
>> immediately before irq_exit_rcu(), ensuring _TLF_NAPPING is cleared and
>> regs->NIP is adjusted before any code that can re-enable interrupts or
>> invoke softirqs runs.  Move the explanatory comment into
>> nap_adjust_return() itself and remove it from arch_interrupt_async_exit_prepare().
>>
>> Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
>> Closes: https://lore.kernel.org/all/87wlvazrdy.fsf@igel.home/
>> Reported-by: Andreas Schwab <schwab@linux-m68k.org>
>> Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
>
> Tested-by: John Ogness <john.ogness@linutronix.de>

Is there a reason this is not being queued for 7.2? Without this fix,
PPC970 machines cannot boot 7.2.

John Ogness