On Thu, Nov 12, 2026 at 05:37:09PM +0100, Christian Brauner wrote:
> A capture kernel reads the memory of the crashed kernel, and that memory
> may well have uncorrectable errors. That is after all what the first
> kernel often died of. Every architecture that maps a page of the old
> kernel and copies it out does so with copy_to_iter(), and a machine
> check in that copy takes the capture kernel down.
>
> On x86 a machine check in the kernel is only recovered from if the
> instruction that took it has a machine check safe exception table entry
> or copies from userspace (cf. error_context()). The copy of an old page
> is neither. Its source is kernel memory, whether it goes to the buffer
> of a read() or, since commit 4a22fd20379c ("vmcore: convert
> __read_vmcore to use an iov_iter"), into a kernel page for splice(),
> sendfile() and copy_file_range(). So a read of /proc/vmcore that runs
> into a poisoned page panics the capture kernel, and so do vmcore's own
> reads of the ELF headers and notes. Breno sees the result on a fleet:
> the first kernel dies of a machine check and the capture kernel produces
> no usable vmcore at all (cf. [1]).
>
> On book3s64 a machine check in the kernel is recovered from if the
> instruction that took it has an exception table entry (cf.
> mce_common_process_ue()). The user copy has them, so a read() comes up
> short there and read_from_oldmem() returns -EFAULT. The copies into
> kernel pages have none and panic the same way. Other powerpc platforms
> don't recover from a machine check in such a copy at all.
>
> Copy with _copy_mc_to_iter() instead. x86_64 and PPC64 select
> ARCH_HAS_COPY_MC, and on x86_64 and book3s64 the machine check safe copy
> turns the machine check into a short copy, which read_from_oldmem()
> turns into -EFAULT like any other short copy. On x86 that holds for the
> fragile and the enhanced fast string variant, a CPU with neither gets
> the plain copy it has today. Everywhere else _copy_mc_to_iter() is
> _copy_to_iter(). Put the call into a helper, copy_oldmem_to_iter(), so
> that the copy of a page of the old kernel lives in one place and an
> architecture that gains a machine check safe copy later gets this for
> free. The helper does the same check_copy_size() as copy_to_iter(), so
> hardened usercopy keeps checking the copy.
>
> With a v7.4-rc1 capture kernel reading /proc/vmcore and a machine check
> injected into the copy of an old page the capture kernel is gone. A
> machine check panic prints no trace of its own, this one comes from
> panic_sys_info=all_bt:
>
> [ 0.580568] mce: [Hardware Error]: CPU 0: Machine Check Exception: 7 Bank
> 1: bd80000000000134
> [ 0.580574] mce: [Hardware Error]: RIP 10:<ffffffff81909b11>
> {_copy_to_iter+0x81/0x850}
> [ 0.580584] mce: [Hardware Error]: TSC 202f2117f ADDR 10000000 MISC 8c
> [ 0.580587] mce: [Hardware Error]: PROCESSOR 2:aa0f02 TIME 1794493617
> SOCKET 0 APIC 0 microcode aa0021c
> [ 0.580589] mce: [Hardware Error]: Machine check: Uncorrected
> unrecoverable error in kernel context
> [ 0.580591] Kernel panic - not syncing: Fatal local machine check
> [ 0.582587] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted
> 7.4.0-rc1-g6628e7d4c6b2 #1 PREEMPT(lazy)
> [ 0.583101] Call Trace:
> [ 0.583198] <#MC>
> [ 0.583279] dump_stack_lvl+0x4d/0x70
> [ 0.583419] nmi_cpu_backtrace.cold+0x18/0x6e
> [ 0.583584] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
> [ 0.583772] nmi_trigger_cpumask_backtrace+0xba/0xf0
> [ 0.583955] sys_info+0x83/0xb0
> [ 0.584075] vpanic+0x1b4/0x303
> [ 0.584197] panic+0x66/0x70
> [ 0.584488] mce_panic+0x19e/0x290
> [ 0.584799] do_machine_check+0x627/0x9a0
> [ 0.584953] ? _copy_to_iter+0x81/0x850
> [ 0.585099] exc_machine_check+0x68/0xb0
> [ 0.585246] asm_exc_machine_check+0x1e/0x40
> [ 0.587747] </#MC>
> [ 0.587831] <TASK>
> [ 0.588092] ? iomem_map_sanity_check+0x98/0xb0
> [ 0.588430] ? __ioremap_caller.isra.0+0x1a9/0x300
> [ 0.588604] ? __copy_oldmem_page+0x3d/0xb0
> [ 0.588928] __copy_oldmem_page+0x5e/0xb0
> [ 0.589079] read_from_oldmem.part.0+0xe3/0x140
> [ 0.589247] read_vmcore+0x137/0x280
> [ 0.589381] proc_reg_read_iter+0x49/0x90
> [ 0.589533] vfs_read+0x348/0x490
> [ 0.589666] ksys_read+0x76/0x100
> [ 0.589792] do_syscall_64+0xde/0x4b0
> [ 0.590103] entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> With this patch the same injection ends the read() with -EFAULT, the
> capture kernel logs the machine check and keeps running.
>
> [1]: https://lore.kernel.org/all/[email protected]/
>
> Reported-by: Chris Mason <[email protected]>
> Suggested-by: Breno Leitao <[email protected]>
> Fixes: 4ae362be5093 ("[PATCH] kdump: read previous kernel's memory")
> Fixes: 54c32021eb6f ("[PATCH] powerpc: Add arch-dependent copy_oldmem_page")
> Fixes: 4a22fd20379c ("vmcore: convert __read_vmcore to use an iov_iter")
> Cc: [email protected]
> Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Reviewed-by: Breno Leitao <[email protected]>
