Re: [BUG] WARNING in do_sve_acc in Linux kernel v6.6

[Mark Rutland]

On Wed, Jun 04, 2025 at 12:57:30PM +0800, Luka wrote:
> Dear Kernel Maintainers,
> 
> I am writing to report a potential vulnerability identified in the
> upstream Linux Kernel version v6.6, corresponding to the following
> commit in the mainline repository:
> 
> Git Commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa (tag: v6.6)

For clarity, that's literally the v6.6 tag from 2023, not a recent
stable v6.6.y tag.

That also doesn't match the commit ID in the bug report linked below,
where the kernel reports itself as:

   6.6.30-android15-8-4k #1 dc911bbdaa9a863c41e12d277ee63ecb446e0526

... which implies that the kernel you're using is derived from the
v6.6.30 stable tag, i.e. commit:

  5697d159afef8c475f13a0b7b85f09bd4578106c (tag v6.6.30)

... in the upstream stable tree.

> This issue was discovered during the testing of the Android 15 AOSP
> kernel, which is based on Linux kernel version 6.6, specifically from
> the AOSP kernel branch:
> 
> AOSP kernel branch: android15-6.6
> Manifest path: kernel/common.git
> Source URL:  https://android.googlesource.com/kernel/common/+/refs/heads/android15-6.6

The commit ID reported by the kernel in the linked bug report, i.e:

  dc911bbdaa9a863c41e12d277ee63ecb446e0526

... does not match anything in this tree, and the latest commits in that
branch are based on v6.6.87.

Is that a kernel you've built yourself, or something shipped by the
hardware vendor?

I suspect that this is whatever the vendor shipped, and you've guessed
as to what exactly it's built from?

> Although this kernel branch is used in Android 15 development, its
> base is aligned with the upstream Linux v6.6 release. I observed this
> issue while conducting stability and fuzzing tests on the Android 15
> platform and identified that the root cause lies in the upstream
> codebase.
> 
> 
> Bug Location:  do_sve_acc+0x17c/0x3f4 arch/arm64/kernel/fpsimd.c:1479

Looking at this and the report, I believe that you're running an old
kernel, and hitting an issue which has already has a fix upstream, where
that fix has already been backported to stable trees and the
android15-6.6 branch.

Specifically, I believe you're hitting the issue fixed by upstream
commit:

  751ecf6afd65 ("arm64/sve: Discard stale CPU state when handling SVE traps")

... which was backported to the v6.6.y stable branch as commit:

  51d11ea0250d ("arm64/sve: Discard stale CPU state when handling SVE traps")

... landing in v6.6.61:

  f1ab3a1bcbbc (tag v6.6.61)

... which was merged into the android15-6.6 branch in commit:

  cf775c9332b1 ("Merge 6.6.61 into android15-6.6-lts")

... back in November 2024.

Mark.
 
> Bug Report: https://hastebin.com/share/calarosado.css
> 
> Entire Log: https://hastebin.com/share/efepocaxoh.perl
> 
> 
> Thank you very much for your time and attention. I sincerely apologize
> that I am currently unable to provide a reproducer for this issue.
> However, I am actively working on reproducing the problem, and I will
> make sure to share any findings or reproducing steps with you as soon
> as they are available.
> 
> I greatly appreciate your efforts in maintaining the Linux kernel and
> your attention to this matter.
> 
> Best regards,
> Luka
>