linux-kernel - Re: /proc/kcore has a unreasonable size(281474974617600) in x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090611050929.GA2706@cr0.nay.redhat.com>
Date:	Thu, 11 Jun 2009 13:09:29 +0800
From:	Amerigo Wang <xiyou.wangcong@...il.com>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Américo Wang <xiyou.wangcong@...il.com>,
	Tao Ma <tao.ma@...cle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, Alexey Dobriyan <adobriyan@...il.com>
Subject: Re: /proc/kcore has a unreasonable size(281474974617600) in x86_64
	2.6.30-rc8.

On Mon, Jun 08, 2009 at 09:10:10PM -0700, Eric W. Biederman wrote:
>Américo Wang <xiyou.wangcong@...il.com> writes:
>
>> On Mon, Jun 8, 2009 at 4:00 PM, Tao Ma<tao.ma@...cle.com> wrote:
>>>>>
>>>>> But the result is the same
>>>>
>>>> Yes?
>>>> Your printk() shows kcore size is: 5301604352, and in your subject it is
>>>> 281474974617600...
>>>>
>>>> Or they happened in the same time?
>>>
>>> yes. the same box and the same linux version.
>>> A bit strange.
>>>
>>> [taoma@...s2-test2 ~]$ dmesg|grep "high memory"
>>> high memory ffff88013c000000, size 5301604352
>>> [taoma@...s2-test2 ~]$ ll /proc/kcore
>>> -r-------- 1 root root 281474974617600 Jun  8 15:20 /proc/kcore
>>
>> Really weird...
>> They should be the same. This means we have some problem in our procfs.
>>
>> And, we have no problem on i386, I, myself, even can't reproduce this on my
>> x86_64 box...
>>
>> Drop Cc to x86 people, add some Cc to proc people. :)
>>
>> Eric, Alexey, any ideas?
>>
>> Tao, would you like to send us your .config? Thanks.
>
>Short of some strange patch applied I would guess that a non-sense /proc/kcore
>size is related to a kernel memory stomp, stepping on the high_memory variable.

Hello, Eric.

I see the problem now, I think the documentation of /proc/kcore
is wrong, the size of kcore can be more than the size of physical
memory, because it also contains the info of kernel modules which
stay above the mapping of phy memory, see arch/x86/mm/init_64.c.

What do you think?

Thanks!

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/