The kernel crashes in read_tsc() due to a possible single bit-flip error

Issue

• System was panicked inside read_tsc() function. Below variants of the issue were seen so far:

• Example 1: The kernel crashes in read_tsc() due to a possible single bit-flip error.

  [906165.686714] BUG: unable to handle kernel paging request at ffffbfffbd035470
  [906165.693799] IP: [<ffffffffbd035470>] read_tsc+0x0/0x20
  [906165.699041] PGD 0 
  [906165.701167] Oops: 0010 [#1] SMP 
  [906165.704523] Modules linked in: mpt2sas raid_class scsi_transport_sas mptctl mptbase bonding 8021q garp mrp stp llc dell_rbu vfat fat xfs libcrc32c iTCO_wdt iTCO_vendor_support dell_smbios dell_wmi_descriptor dcdbas i10nm_edac nfit libnvdimm coretemp intel_rapl iosf_mbi kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd pcspkr i2c_i801 sg mei_me mei wmi ipmi_si ipmi_devintf ipmi_msghandler pinctrl_lewisburg pinctrl_intel tpm_crb acpi_power_meter onload(OE) sfc_char(OE) sfc_resource(OE) sfc_affinity(OE) binfmt_misc auth_rpcgss sunrpc ip_tables ext4 mbcache jbd2 megaraid_sas crc32c_intel sfc(OE) mdio mtd i2c_algo_bit drm_kms_helper tg3 syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm ptp pps_core drm_panel_orientation_quirks sd_mod crc_t10dif
  [906165.776519]  crct10dif_generic crct10dif_pclmul crct10dif_common ahci libahci libata dm_mirror dm_region_hash dm_log dm_mod
  [906165.786566] CPU: 9 PID: 1779 Comm: user9 Kdump: loaded Tainted: G           OE  ------------   3.10.0 1160.62.1.el7.x86_64 #1
  [906165.797920] Hardware name: Dell Inc. PowerEdge R750/0WT8Y6, BIOS 1.5.4 12/17/2021
  [906165.805466] task: ffff96ffec4a9080 ti: ffff96ff87bc0000 task.ti: ffff96ff87bc0000
  [906165.813015] RIP: 0010:[<ffffffffbd035470>]  [<ffffffffbd035470>] read_tsc+0x0/0x20
  [906165.820675] RSP: 0000:ffff97013f303f10  EFLAGS: 00010007
  [906165.826062] RAX: ffffffffbd035470 RBX: ffffffffbdc2f200 RCX: 00033a1855f6dd80
  [906165.833264] RDX: 0000000000000000 RSI: 00033a1855f6dd80 RDI: ffffffffbdc2f200
  [906165.840468] RBP: ffff97013f303f38 R08: 00033a1855f6dd80 R09: ffff97013f303de0
  [906165.847669] R10: 000000000000b3ff R11: 0000000000000005 R12: 00000000000ddc0c
  [906165.854871] R13: 0000000000000000 R14: 000000006c44c73c R15: ffff97013f315ad8
  [906165.862074] FS:  00007f25bf3f4700(0000) GS:ffff97013f300000(0000) knlGS:0000000000000000
  [906165.870229] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [906165.876047] CR2: ffffbfffbd035470 CR3: 0000003e4231c000 CR4: 0000000000760fe0
  [906165.883249] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [906165.890453] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [906165.897655] PKRU: 55555554
  [906165.900447] Call Trace:
  [906165.902982]  <IRQ> 
  [906165.904999]  [<ffffffffbd107d82>] ? ktime_get+0x52/0xe0
  [906165.910497]  [<ffffffffbd10e499>] clockevents_program_event+0x39/0x100
  [906165.917093]  [<ffffffffbd110173>] tick_program_event+0x23/0x30
  [906165.923000]  [<ffffffffbd0ca952>] hrtimer_interrupt+0xf2/0x1d0
  [906165.928921]  [<ffffffffbd05ce2b>] local_apic_timer_interrupt+0x3b/0x60
  [906165.935520]  [<ffffffffbd79ea23>] smp_apic_timer_interrupt+0x43/0x60
  [906165.941941]  [<ffffffffbd79afba>] apic_timer_interrupt+0x16a/0x170
  [906165.948191]  <EOI> 
  [906165.950206] Code: 
  [906165.952333] d1 00 48 89 e5 5d c3 0f 1f 40 00 55 8b 05 c9 c0 d1 00 48 89 e5 5d c3 0f 1f 40 00 55 b8 ed ff ff ff 48 89 e5 5d c3 0f 1f 44 00 00 <55> 48 89 e5 0f ae e8 0f 31 89 c0 48 c1 e2 20 48 09 c2 48 89 d0 
  [906165.970881] RIP  [<ffffffffbd035470>] read_tsc+0x0/0x20
  [906165.976208]  RSP <ffff97013f303f10>
  [906165.979777] CR2: ffffbfffbd035470
  

• Example 2: System was panicked inside read_tsc() function because of invalid memory address.

  [767391.203303] BUG: unable to handle kernel paging request at 000000003449869a
  [767391.287656] PGD 0 
  [767391.312726] Oops: 0002 [#1] SMP NOPTI
  [767391.357555] CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Not tainted  4.18.0-305.49.1.el8_4.x86_64 #1
  [767391.466867] Hardware name: Cisco Systems Inc UCSC-C240-M6SX/UCSC-C240-M6SX, BIOS C240M6.4.3.2d.0.0825231000 08/25/2023
  [767391.595942] RIP: 0010:read_tsc+0x1/0x10
  [767391.642854] Code: 90 90 90 90 90 90 90 90 90 8b 05 86 18 7f 01 c3 66 0f 1f 84 00 00 00 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f <ae> e8 0f 31 48 c1 e2 20 48 09 d0 c3 0f 1f 00 8b 05 4a fc 7e 01 83
  [767391.868646] RSP: 0018:ff6d8adb8007cf98 EFLAGS: 00010046
  [767391.932195] RAX: ffffffffb7a2a3f0 RBX: 0002b9f133966809 RCX: 000000003449869a
  [767392.018624] RDX: ff1366b187c7ebe0 RSI: ffffffffb7b70ae6 RDI: ffffffffb9027d20
  [767392.105057] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
  [767392.191488] R10: 0000000000000000 R11: 0000000000000000 R12: 000000005b78d044
  [767392.277920] R13: ffffffffb99e5100 R14: 0000000000000000 R15: 0000000000000000
  [767392.364350] FS:  0000000000000000(0000) GS:ff1366efff640000(0000) knlGS:0000000000000000
  [767392.462219] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [767392.532010] CR2: 000000003449869a CR3: 000000751c210002 CR4: 0000000000773ee0
  [767392.618439] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [767392.704871] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [767392.791301] PKRU: 55555554
  [767392.824694] Call Trace:
  [767392.854966]  <IRQ>
  [767392.880041]  ? tick_irq_enter+0x29/0xa0
  [767392.926955]  ? irq_enter+0x51/0x60
  [767392.968665]  ? smp_apic_timer_interrupt+0x1c/0x130
  [767393.027013]  ? apic_timer_interrupt+0xf/0x20
  [767393.079122]  </IRQ>
  [767393.105237]  ? cpuidle_enter_state+0xd9/0x3c0
  [767393.158384]  ? cpuidle_enter_state+0xb4/0x3c0
  [767393.211536]  ? cpuidle_enter+0x2c/0x40
  [767393.257407]  ? do_idle+0x234/0x260
  [767393.299126]  ? cpu_startup_entry+0x6f/0x80
  [767393.349167]  ? start_secondary+0x199/0x1e0
  [767393.399198]  ? secondary_startup_64_no_verify+0xc2/0xcb
  [767393.462747] Modules linked in: overlay 8021q garp mrp sch_ingress bonding tun nls_utf8 isofs cdrom nf_log_ipv6 nf_log_ipv4 nf_log_common nft_limit nft_counter xt_LOG xt_limit xt_multiport xt_comment xt_state xt_conntrack nft_compat nf_tables nfnetlink vfat fat intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm rapl ipmi_ssif intel_uncore pcspkr isst_if_mbox_pci ses enclosure vfio_pci scsi_transport_sas vfio_virqfd irqbypass isst_if_mmio isst_if_common joydev mei_me mei ioatdma wmi acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler acpi_cpufreq acpi_power_meter acpi_pad vfio_iommu_type1 vfio openvswitch nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge auth_rpcgss stp llc xfs libcrc32c dm_multipath i40iw ib_uverbs ib_core sd_mod t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel megaraid_sas ahci libahci ixgbe mgag200 igb libata drm_kms_helper syscopyarea sysfillrect
  [767393.462785]  sysimgblt fb_sys_fops drm i40e i2c_algo_bit dca mdio sunrpc dm_mirror dm_region_hash dm_log dm_mod be2iscsi bnx2i cnic uio cxgb4i cxgb4 libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse 
  [767394.771345] CR2: 000000003449869a