linux-kernel - Re: [PATCH] pstore: Avoid kcore oops by vmap()ing with VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon,  5 Dec 2022 16:16:15 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Tony Luck <tony.luck@...el.com>, swboyd@...omium.org,
        anton@...msg.org, ccross@...roid.com
Cc:     Kees Cook <keescook@...omium.org>,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        patches@...ts.linux.dev, linux-kernel@...r.kernel.org,
        rppt@...nel.org, bgeffon@...gle.com
Subject: Re: [PATCH] pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP

On Mon, 5 Dec 2022 15:31:36 -0800, Stephen Boyd wrote:
> An oops can be induced by running 'cat /proc/kcore > /dev/null' on
> devices using pstore with the ram backend because kmap_atomic() assumes
> lowmem pages are accessible with __va().
> 
>  Unable to handle kernel paging request at virtual address ffffff807ff2b000
>  Mem abort info:
>  ESR = 0x96000006
>  EC = 0x25: DABT (current EL), IL = 32 bits
>  SET = 0, FnV = 0
>  EA = 0, S1PTW = 0
>  FSC = 0x06: level 2 translation fault
>  Data abort info:
>  ISV = 0, ISS = 0x00000006
>  CM = 0, WnR = 0
>  swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000
>  [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000
>  Internal error: Oops: 96000006 [#1] PREEMPT SMP
>  Modules linked in: dm_integrity
>  CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba
>  Hardware name: Google Lazor (rev3 - 8) (DT)
>  pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>  pc : __memcpy+0x110/0x260
>  lr : vread+0x194/0x294
>  sp : ffffffc013ee39d0
>  x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000
>  x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000
>  x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000
>  x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000
>  x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60
>  x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001
>  x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b
>  x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000
>  x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78
>  x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000
>  Call trace:
>  __memcpy+0x110/0x260
>  read_kcore+0x584/0x778
>  proc_reg_read+0xb4/0xe4
> 
> [...]

Applied to for-next/pstore, thanks!

[1/1] pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
      https://git.kernel.org/kees/c/e6b842741b4f

-- 
Kees Cook