linux-kernel - Re: [git pull] core, x86: make LIST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Jul 2008 12:30:04 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Andi Kleen <andi@...stfloor.org>
cc:	Ingo Molnar <mingo@...e.hu>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Avi Kivity <avi@...ranet.com>
Subject: Re: [git pull] core, x86: make LIST_POISON less deadly



On Mon, 14 Jul 2008, Andi Kleen wrote:
> 
> How about if the page fault handler checks for the value and prints
> a obvious string? It could do this reliably, unlike the "grep
> all registers for poison on #GP" method that was earlier proposed.

The GP handler, you mean.

Sure, that might work. I'm not convinced it's worth it, but it's certainly 
not difficult to do either. Something like this (TOTALLY UNTESTED!) might 
work.

It puts it in the general "__die()" routine because it was easier this way 
(we do want it below the "oops" thing, so that it gets captured by Arjan's 
scripts!), in case the deathnotes are useful for other cases too.

It could perhaps be extended to allow negative offsets off the 0xdead000.. 
pointer (right now those would be ignored because the '0xdead00..' part 
would turns into '0xdeacff..') but that would not matter for the 
particular case of the list poisoning (since that one adds the 0x0100100 
thing to it anyway).

Again: totally untested.

			Linus

---
 arch/x86/kernel/traps_64.c |   24 ++++++++++++++++++++++++
 1 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
index f1a95d1..7487ce2 100644
--- a/arch/x86/kernel/traps_64.c
+++ b/arch/x86/kernel/traps_64.c
@@ -434,6 +434,29 @@ void dump_stack(void)
 
 EXPORT_SYMBOL(dump_stack);
 
+/*
+ * This depends intimately on the layout of pt_regs to
+ * show deathnotes in the GP registers.
+ */
+static void show_deathnotes(struct pt_regs *regs)
+{
+	static const char *names[16] = {
+		"r15", "r14", "r13", "r12",
+		"rbp", "rbx", "r11", "r10",
+		"r9",  "r8",  "rax", "rcx",
+		"rdx", "rsi", "rdi",
+	};
+	const unsigned long *r = &regs->r15;
+	int i;
+
+	for (i = 0; i < 15; i++) {
+		unsigned long value = r[i];
+		if ((value >> 48) != 0xdead)
+			continue;
+		printk("Deathnote %lx in register %s\n", value, names[i]);
+	}
+}
+
 void show_registers(struct pt_regs *regs)
 {
 	int i;
@@ -554,6 +577,7 @@ int __kprobes __die(const char * str, struct pt_regs * regs, long err)
 	printk("\n");
 	if (notify_die(DIE_OOPS, str, regs, err, current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
 		return 1;
+	show_deathnotes(regs);
 	show_registers(regs);
 	add_taint(TAINT_DIE);
 	/* Executive summary in case the oops scrolled away */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/