linux-kernel - Re: [RFC BUG?] dereference PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 May 2007 00:51:40 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	"Dan Kruchinin" <dubalom@...il.com>
Cc:	linux-kernel@...r.kernel.org,
	Jeremy Fitzhardinge <jeremy@...source.com>,
	Andi Kleen <ak@...e.de>, William Irwin <bill.irwin@...cle.com>,
	Ingo Molnar <mingo@...e.hu>
Subject: Re: [RFC BUG?] dereference PAGE_OFFSET address (rc7-mm2)

On Wed, 2 May 2007 07:26:13 +0400 "Dan Kruchinin" <dubalom@...il.com> wrote:

> Hi.
> 
> I don't know why, but when I'm dereferencing PAGE_OFFSET(0xC0000000 on
> x86) address from user space on rc7-mm2 I don't receive SIGSEGV signal
> and there is no any core dump.
> btw: on poor rc-7 all is ok.
> 
> test_code:
> ---
> #include <stdio.h>
> #include <stdlib.h>
> #include <errno.h>
> #include <unistd.h>
> #include <sys/wait.h>
> #include <sys/time.h>
> #include <sys/resource.h>
> #include <sys/types.h>
> 
> #define PAGE_OFFSET 0xC0000000
> 
> static void _error(const char *msg)
> {
>   int errcode = errno;
> 
>   fprintf(stderr, "ERROR:\n--> %s [%s]\n", msg, strerror(errcode));
>   exit(EXIT_FAILURE);
> }
> 
> int main(void)
> {
>   int pid;
>   struct rlimit rl;
>   int status;
> 
>   printf("Trying to cause ELF core dump...\n");
> 
>   rl.rlim_cur = rl.rlim_max = 0x10000000;
> 
>   if(setrlimit(RLIMIT_CORE, &rl) < 0)
> 	_error("setrlim error!");
>   if((pid = fork()) < 0)
> 	_error("fork error!");
>   else if(pid == 0) {
> 	*((long*) PAGE_OFFSET ) = 0; /* trying to dereference kernel start address */
> 	_exit(EXIT_SUCCESS);
>   }
> 
>   if(waitpid(pid, &status, 0) < 0)
> 	_error("waitpid error!");
>   if(WCOREDUMP(status))
> 	printf("All is ok. We receive SIGSEGV and core dump has occured.\n");
>   else
> 	printf("All is bad. We don't receive SIGSEGV and core dump hasn't
> occured. (WHY?!)\n"); /* here I just get SIGCHLD, this means that
> child process have made it's work success... */
> 
>   exit(EXIT_SUCCESS);
> }
> ---
> 
> [asgard@...gard]$ uname -a
> Linux midgard 2.6.21-rc7-mm2 #5 SMP Wed May 2 04:15:09 MSD 2007 i686 GNU/Linux
> 
> [asgard@...gard]$ ./a.out
> Trying to cause ELF core dump...
> All is bad. We don't receive SIGSEGV and core dump hasn't occured. (WHY?!)
> 
> ---
> 
> [asgard@...gard]$ uname -a
> Linux midgard 2.6.21-rc7 #5 SMP Wed May 2 02:11:50 MSD 2007 i686 GNU/Linux
> 
> [asgard@...gard]$ ./a.out
> Trying to cause ELF core dump...
> All is ok. We receive SIGSEGV and core dump has occured.
> 

Thanks for the report.  I can reproduce it.

Bisection shows that x86_64-mm-paravirt-initial-pagetable.patch caused
this.

I didn't check whether the patch actually permits us to read kernel
memory.  Probably it does.  Probably we'd prefer that it didn't ;)




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/