linux-kernel - Re: Fw: hwinfo problem since 2.6.28

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090109222552.GB6472@linux-os.sc.intel.com>
Date:	Fri, 9 Jan 2009 14:25:53 -0800
From:	Suresh Siddha <suresh.b.siddha@...el.com>
To:	Ingo Molnar <mingo@...e.hu>, Daniel.Beschorner@...ton.com
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Arjan van de Ven <arjan@...radead.org>,
	"Pallipadi, Venkatesh" <venkatesh.pallipadi@...el.com>,
	"Siddha, Suresh B" <suresh.b.siddha@...el.com>,
	Yinghai Lu <yinghai@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>, spender@...ecurity.net,
	pageexec@...email.hu, linux-kernel@...r.kernel.org
Subject: Re: Fw: hwinfo problem since 2.6.28

> > Date: Tue, 6 Jan 2009 09:53:14 +0100
> > From: "Beschorner Daniel" <Daniel.Beschorner@...ton.com>
> > To: <linux-kernel@...r.kernel.org>
> > Subject: hwinfo problem since 2.6.28
> > 
> > 
> > Since 2.6.28 my hwinfo tool crashes badly on 2 years old OpenSuSE 10.2
> > x64/SMP.
> > Older kernels run fine, I did a "make oldconfig" and rather used
> > defaults (just skipping low-64k checks).
> > This seems to be the only affected binary as far I can see.
> > Did I miss a new legacy/compat option or is it a bug?
> > 
> > Thank you!
> > Daniel
> > 
> > hwinfo: Corrupted page table at address 7fd04de3ec00
> > PGD 7dc33067 PUD 3efe067 PMD 27b83067 PTE fffffffffffffbff
> > Bad pagetable: 000d [#9] SMP

Daniel, Can you please check and ack if the appended patch fixes this
page table corruption issue? We tried to reproduce your issue
locally here but didn't succeed because of different hwinfo versions.

thanks,
suresh
---

From: Suresh Siddha <suresh.b.siddha@...el.com>
Subject: x86: fix PTE corruption issue while mapping RAM using /dev/mem 

Beschorner Daniel reported:
> hwinfo problem since 2.6.28, showing this in the oops:
> 	Corrupted page table at address 7fd04de3ec00

PaX Team reported a regression with this commit:

>	commit 9542ada803198e6eba29d3289abb39ea82047b92
>	Author: Suresh Siddha <suresh.b.siddha@...el.com>
>	Date:   Wed Sep 24 08:53:33 2008 -0700
>
>	    x86: track memtype for RAM in page struct

This commit breaks mapping any RAM page through /dev/mem, as the
reserve_memtype() was not initializing the return attribute type and as such
corrupting the PTE entry that was setup with the return attribute type.

Because of this bug, application mapping this RAM page through /dev/mem
will die with "Corrupted page table at address xxxx" message in the kernel
log and also the kernel identity mapping which maps the underlying RAM
page gets converted to UC.

Fix this by initializing the return attribute type before calling
reserve_ram_pages_type()

Reported-and-bisected-by: PaX Team <pageexec@...email.hu>
Reported-by: Beschorner Daniel <Daniel.Beschorner@...ton.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@...el.com>
Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@...el.com>
Cc: <stable@...nel.org>
---

diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 85cbd3c..d52ba1a 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -333,6 +333,9 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
 					      req_type & _PAGE_CACHE_MASK);
 	}
 
+	if (new_type)
+		*new_type = actual_type;
+
 	is_range_ram = pagerange_is_ram(start, end);
 	if (is_range_ram == 1)
 		return reserve_ram_pages_type(start, end, req_type, new_type);
@@ -347,9 +350,6 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
 	new->end	= end;
 	new->type	= actual_type;
 
-	if (new_type)
-		*new_type = actual_type;
-
 	spin_lock(&memtype_lock);
 
 	if (cached_entry && start >= cached_start)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/