lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 1 Mar 2008 02:18:39 +0100 From: "Rafael J. Wysocki" <rjw@...k.pl> To: "H. Peter Anvin" <hpa@...or.com> Cc: "Klaus S. Madsen" <ksm@...rnemadsen.org>, Ingo Molnar <mingo@...e.hu>, LKML <linux-kernel@...r.kernel.org>, Pavel Machek <pavel@....cz>, Thomas Gleixner <tglx@...utronix.de> Subject: Re: Regression in 2.6.25-rc3: s2ram segfaults before suspending On Friday, 29 of February 2008, H. Peter Anvin wrote: > Klaus S. Madsen wrote: > > open("/dev/mem", O_RDWR) = 5 > > mmap2(NULL, 1282, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_FIXED, 5, 0) = 0 > > mmap2(0xa0000, 393216, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0xa0) = 0xa0000 > ^^^^^^^^^^^^^^^^^^^^ > > close(5) = 0 > > ioperm(0, 0x400, 0x1) = 0 > > iopl(0x3) = 0 > > access("/sys/bus/pci", R_OK) = 0 > > write(1, "Calling get_mode\n", 17) = 17 > > vm86(0x1, 0xb7f14ccc, 0xb7f14830, 0xc000, 0x18b6 <unfinished ...> > > --- SIGSEGV (Segmentation fault) @ 0 (0) --- > > +++ killed by SIGSEGV (core dumped) +++ > > This is the VGA BIOS being mapped, it's mapped PROT_READ|PROT_WRITE, but > no PROT_EXEC; if the kernel is NX-capable it *should* segfault trying > to execute out of this area, which is exactly what will happen when vm86 > executes INT 10h. > > If we can find that mmap() in the s2ram source code and add PROT_EXEC to > it, it would be interesting. This is in radeontool.c, line 91, AFAICS. Thanks, Rafael -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists