Root Cause Analysis

1. Functions, Structs, and Files Involved

• drivers/pci/pci-sysfs.c: pci_mmap_resource(), pci_dev_resource##_bar##_uc_attr (sysfs binary attributes /sys/bus/pci/devices/<pci_id>/resource<n>).
• kernel/resource.c: iomem_is_exclusive(), resource_is_exclusive().
• arch/arm64/mm/fault.c: do_sea() (Synchronous External Abort handler).
• kernel/sched/core.c: schedule_debug(), task_stack_end_corrupted().
• include/linux/sched/task_stack.h: end_of_stack(), STACK_END_MAGIC.

2. Trigger Mechanism and Lifecycle / Invariant Violation

1. Unrestricted MMIO Resource Mapping (drivers/pci/pci-sysfs.c, kernel/resource.c):

   • The test program (running as root, UID: 0) mounts sysfs and opens /sys/bus/pci/devices/0000:00:02.0/resource0 (mode 0600), representing BAR 0 MMIO space of PCI device 0000:00:02.0.
   • The program invokes mmap(0x20001000, 0x2000, PROT_READ|PROT_WRITE, MAP_FIXED|MAP_SHARED, fd, 0), which enters pci_mmap_resource().
   • pci_mmap_resource() calls iomem_is_exclusive(pci_resource_start(pdev, bar)) to verify if userspace is permitted to map this physical I/O memory range.
   • In kernel/resource.c:

     if (IS_ENABLED(CONFIG_IO_STRICT_DEVMEM) || p->flags & IORESOURCE_EXCLUSIVE) {
         err = true;
         break;
     }
     

     Because CONFIG_IO_STRICT_DEVMEM is disabled in this kernel build and device drivers typically do not explicitly set IORESOURCE_EXCLUSIVE when requesting regions, resource_is_exclusive() returns false despite the resource being active and marked IORESOURCE_BUSY. As a result, userspace successfully establishes a direct, writable mapping to the live hardware MMIO registers.

2. MMIO Overwrite & Hardware Abort (arch/arm64/mm/fault.c):

   • The reproducer writes fuzzed data into the range 0x20001b00–0x200023f8, which falls directly within the 0x20001000–0x20003000 mmapped MMIO page.
   • Accessing undefined/unimplemented register offsets in the device's MMIO aperture causes the bus interconnect to return an error response, triggering an ARM64 Synchronous External Abort (SEA).
   • This abort is processed by do_sea() in arch/arm64/mm/fault.c, which calls add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK), explaining the Tainted: [M]=MACHINE_CHECK taint flag on the system.

3. Rogue DMA and Kernel Stack Corruption (kernel/sched/core.c):

   • Writing garbage to control, queue descriptor, or doorbell registers of an active PCI device (a bus-mastering network controller servicing network traffic on the VM) corrupts the device's internal state machine and DMA descriptor rings.
   • As the device attempts to process receive or transmit traffic (such as DHCP packets handled by dhcpcd), it initiates rogue DMA transfers into arbitrary physical memory addresses.
   • One or more writes land on the physical page hosting the bottom of the kernel stack for PID 4402 (dhcpcd), corrupting the STACK_END_MAGIC canary (0x57AC6E9D) stored at end_of_stack(task).
   • When dhcpcd subsequently blocks during ppoll (poll_schedule_timeout -> schedule -> __schedule), schedule_debug() evaluates task_stack_end_corrupted(prev), detects that *end_of_stack(prev) != STACK_END_MAGIC, and triggers the kernel panic: "Kernel panic - not syncing: corrupted stack end detected inside scheduler".