linux-kernel - Re: [tip:x86/mm] x86, mm: NX protection for kernel data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <817ecb6f1003020713l20c17091kdcb1652dcf504ea0@mail.gmail.com>
Date:	Tue, 2 Mar 2010 10:13:26 -0500
From:	Siarhei Liakh <sliakh.lkml@...il.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	mingo@...hat.com, hpa@...or.com, jmorris@...ei.org,
	linux-kernel@...r.kernel.org, arjan@...ux.intel.com,
	tglx@...utronix.de, jiang@...ncsu.edu,
	linux-tip-commits@...r.kernel.org
Subject: Re: [tip:x86/mm] x86, mm: NX protection for kernel data

On Mon, Feb 22, 2010 at 5:54 AM, Ingo Molnar <mingo@...e.hu> wrote:
>
> * tip-bot for Siarhei Liakh <sliakh.lkml@...il.com> wrote:
>
>> Commit-ID:  01ab31371da90a795b774d87edf2c21bb3a64dda
>> Gitweb:     http://git.kernel.org/tip/01ab31371da90a795b774d87edf2c21bb3a64dda
>> Author:     Siarhei Liakh <sliakh.lkml@...il.com>
>> AuthorDate: Sun, 31 Jan 2010 18:27:55 -0500
>> Committer:  H. Peter Anvin <hpa@...or.com>
>> CommitDate: Wed, 17 Feb 2010 10:11:24 -0800
>>
>> x86, mm: NX protection for kernel data
>>
>> This patch expands functionality of CONFIG_DEBUG_RODATA to set main
>> (static) kernel data area as NX.
>
> -tip testing is seeing boot hangs along the lines of:
>
> [   15.568108] EXT3-fs (sda1): recovery complete
> [   15.573064] EXT3-fs (sda1): mounted filesystem with ordered data mode
> [   15.580313] VFS: Mounted root (ext3 filesystem) readonly on device 8:1.
> [   15.584021] async_waiting @ 1
> [   15.588008] async_continuing @ 1 after 0 usec
> [   15.592163] Freeing unused kernel memory: 540k freed
> [   15.600126] NX-protecting the kernel data: c15ab000, 2919 pages
>
> which i suspect could be due to the commit above.
>
> Config attached. Athlon64 testbox.

I have been looking at this issue for several days now and my best
theory is that we are indeed trying to execute something in .data.
Here is what I discovered so far:
1. This patch definitely causes this issue
2. Kernel boots just fine when NX is set from _stext through _sdata
(notes, exception table, ro-data).
3. Kernel crashes when NX is set from _stext through _edata, which
covers init task data, nosave data, page/cache aligned data, data
data, constructors and read-mostly data.
4. Each side of .text, .rodata and .data is page-aligned, so the patch
is not setting NX on any neighbouring sections.
5. The crash happens on some asynchronous event, AFTER we kernel
initialisation is complete and INIT process have been kicked off in
the userspace.
6. From what I see, the actual crash is caused by a double fault.

In the boot log attached, you can see that crash happens after page
tables have been dumped by my custom INIT process and the system has
booted into shell (you can see root@(none):/# before the crash dump).
Only about a second later we get a crash dump.

At this point I need some help and guidance on how to track down what
exactly happens there, as I am not very familiar with what goes into
.data and why are we trying to execute it.

Thank you.

View attachment "tip-debug.log" of type "text/x-log" (114357 bytes)