linux-kernel - Re: Regression in 2.6.25-rc3: s2ram segfaults before suspending

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 3 Mar 2008 16:40:01 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Pavel Machek <pavel@....cz>
Cc:	"Klaus S. Madsen" <ksm@...rnemadsen.org>,
	Suspend-devel list <suspend-devel@...ts.sourceforge.net>,
	Ingo Molnar <mingo@...e.hu>, "H. Peter Anvin" <hpa@...or.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Regression in 2.6.25-rc3: s2ram segfaults before suspending

On Monday, 3 of March 2008, Pavel Machek wrote:
> Hi!
> 
> > > > Klaus S. Madsen wrote:
> > > >> open("/dev/mem", O_RDWR)                = 5
> > > >> mmap2(NULL, 1282, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_FIXED, 5, 0) = 0
> > > >> mmap2(0xa0000, 393216, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0xa0) = 0xa0000
> > > >                          ^^^^^^^^^^^^^^^^^^^^
> > > >> close(5)                                = 0
> > > >> ioperm(0, 0x400, 0x1)                   = 0
> > > >> iopl(0x3)                               = 0
> > > >> access("/sys/bus/pci", R_OK)            = 0
> > > >> write(1, "Calling get_mode\n", 17)      = 17
> > > >> vm86(0x1, 0xb7f14ccc, 0xb7f14830, 0xc000, 0x18b6 <unfinished ...>
> > > >> --- SIGSEGV (Segmentation fault) @ 0 (0) ---
> > > >> +++ killed by SIGSEGV (core dumped) +++
> > > >
> > > > This is the VGA BIOS being mapped, it's mapped PROT_READ|PROT_WRITE, but  
> > > > no PROT_EXEC; if the kernel is NX-capable it *should* segfault trying to 
> > > > execute out of this area, which is exactly what will happen when vm86 
> > > > executes INT 10h.
> > > >
> > > > If we can find that mmap() in the s2ram source code and add PROT_EXEC 
> > > > to it, it would be interesting.
> > > 
> > > Klaus, could you send your .config as well? Lets make sure that NX is 
> > > even relevant in this context.
> > Allright. The mmap in question is in the x86-common.c file in libx86,
> > and adding PROT_EXEC to it solves the problem.
> 
> Ok, sw should probably fix that in s2ram... can you mail a patch to
> me, and suspend-devel?
> 
> > I have attached my .config.
> > 
> > The only thing I don't understand is why this is suddenly a problem with
> > 2.6.25, and not with 2.6.24? Is there a bug in 2.6.24 and previously
> > that allows real-mode execution of non-executable pages?
> 
> It is strange indeed... Should it be traced as an regression?

I'm tracing it FWIW.  However, it would be good to know if all of the previous
kernels were buggy and 2.6.25 fixed the problem or it's the other way around.

Thanks,
Rafael
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/