RISC-V Bug Hunting
summary
Syzbot triage shows an occasional kernel OOPS where the SUM bit isn’t preserved across a context switch; investigation with QEMU, kernel disassembly and a small watcher thread reveals the scheduler isn’t saving that CSR and a reorder of the put_user sequence fixes it syzbot report. A fleet-wide SIGILL points to a disabled CSR illegal CSR readcycle inside libabsl (and a vendored copy in gRPC) resolved by upgrading and by a temporary kernel emulation via the illegal-instruction handler using hand-built binaries and objdump+as to decode the faulting bytes.
AI-written summary · about
chapters (6)
- 0:00RISC-V bug hunting intro
- 2:05Kernel use-after-access bug
- 13:51Illegal instruction failure
- 22:53Big-endian stack corruption
- 29:11Debugging strategies
- 31:00Q&A
related talks
20mDebugging RISC-V Kernel Crashes: KDUMP, vmcore, and Crash Utility Enhancements
37mSyzbot: 7 years of continuous kernel fuzzing
27mTuning in-kernel routines on RISC-V
53mHow to make syzbot reports easier to debug?
03mIntroduction
32mRISC-V ftrace: working with preemption
18mThe Big-endian RISC-V Linux Adventure
24mReliability, Availability, and Serviceability (RAS) on ARM64 status