linux-kernel - Re: [RFC BUG?] dereference PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070502100600.GZ26598@holomorphy.com>
Date:	Wed, 2 May 2007 03:06:00 -0700
From:	Bill Irwin <bill.irwin@...cle.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Bill Irwin <bill.irwin@...cle.com>,
	Dan Kruchinin <dubalom@...il.com>,
	linux-kernel@...r.kernel.org,
	Jeremy Fitzhardinge <jeremy@...source.com>,
	Andi Kleen <ak@...e.de>, Ingo Molnar <mingo@...e.hu>,
	wli@...omorphy.com
Subject: Re: [RFC BUG?] dereference PAGE_OFFSET address (rc7-mm2)

On Wed, May 02, 2007 at 12:51:40AM -0700, Andrew Morton wrote:
>> Thanks for the report.  I can reproduce it.
>> Bisection shows that x86_64-mm-paravirt-initial-pagetable.patch caused
>> this.
>> I didn't check whether the patch actually permits us to read kernel
>> memory.  Probably it does.  Probably we'd prefer that it didn't ;)

On Wed, May 02, 2007 at 01:46:17AM -0700, Bill Irwin wrote:
> Brown paper bag time. I don't know how it got past me.

Brain dump before crashing for the night:

The patch refuses to clobber already-present pagetable entries of
whatever origin. There are pagetables prior to this setup covering the
address range just above PAGE_OFFSET. If this theory is correct, you
should only be able to go a few MB above PAGE_OFFSET before encountering
unreadable kernel memory. IIRC those pagetables are a statically
allocated array in assembly; altering that array to set supervisor bits
may resolve it, though it may also be freed as initmem.

-- wli
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/