linux-kernel - Re: [171/197] module: fix __module_ref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100428165201.3d7d6b4a@griffin.suse.cz>
Date:	Wed, 28 Apr 2010 16:52:01 +0200
From:	Jiri Benc <jbenc@...e.cz>
To:	Greg KH <gregkh@...e.de>
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org,
	Greg KH <greg@...ah.com>, stable-review@...nel.org,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	alan@...rguk.ukuu.org.uk,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Eric Dumazet <dada1@...mosbay.com>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Tejun Heo <tj@...nel.org>, Ingo Molnar <mingo@...e.hu>,
	Steven Rostedt <rostedt@...dmis.org>,
	Jiri Kosina <jkosina@...e.cz>
Subject: Re: [171/197] module: fix __module_ref_addr()

On Thu, 22 Apr 2010 12:10:22 -0700, Greg KH wrote:
> __module_ref_addr() should use per_cpu_ptr() to obfuscate the pointer
> (RELOC_HIDE is needed for per cpu pointers).

Hi,

this patch triggers NaT consumption exception on IA64, at least with
gcc 4.3.4:

------------
modprobe[151]: NaT consumption 2216203124768 [1]
Modules linked in:
Supported: Yes
Pid: 151, CPU 2, comm:             modprobe
psr : 0000121009526030 ifs : 8000000000001430 ip  : [<a000000100129871>]    Not tainted (2.6.32.12-0.2-default)
ip is at load_module+0xdd1/0x2300
unat: 0000000000000000 pfs : 0000000000001430 rsc : 0000000000000003
rnat: a000000100b45e28 bsps: 0000000000000000 pr  : 0000000000165a59
ldrs: 0000000000000000 ccv : 0000000000000000 fpsr: 0009804c0270033f
csd : 0000000000000000 ssd : 0000000000000000
b0  : a000000100129830 b6  : a000000100122ae0 b7  : a000000100011370
f6  : 000000000000000000000 f7  : 1003ee21a291c077975b9
f8  : 1003e0000000000000089 f9  : 1003e0000000000000001
f10 : 1003e0000000000000089 f11 : 000000000000000000000
r1  : a0000001015befe0 r2  : 0000000000000000 r3  : 0000000000001000
r8  : 0000000000000000 r9  : a0000001013dcc70 r10 : a0000001013dcc70
r11 : 0000000000000008 r12 : e00000018b26fdc0 r13 : e00000018b260000
r14 : 0000000000000008 r15 : 0000000000000fc0 r16 : 0000000000000000
r17 : 0000000000000000 r18 : 0000000000000000 r19 : 0000000000000000
r20 : 00000000000000fe r21 : 0000000000000008 r22 : 0000000000004a68
r23 : 0000000000004a68 r24 : 0000000000004a68 r25 : 00000000ffff4a68
r26 : e0000001820f1ec0 r27 : 0000000000000000 r28 : 0000000000000000
r29 : 0000000000000003 r30 : 0000000000000004 r31 : 0000000000000002

Call Trace:
 [<a000000100017a80>] show_stack+0x80/0xa0
                                sp=e00000018b26f910 bsp=e00000018b261438
 [<a0000001000180e0>] show_regs+0x640/0x920
                                sp=e00000018b26fae0 bsp=e00000018b2613d8
 [<a000000100029470>] die+0x190/0x2e0
                                sp=e00000018b26faf0 bsp=e00000018b261398
 [<a000000100029610>] die_if_kernel+0x50/0x80
                                sp=e00000018b26faf0 bsp=e00000018b261368
 [<a0000001008ea750>] ia64_fault+0xf0/0xda0
                                sp=e00000018b26faf0 bsp=e00000018b261320
 [<a00000010000cb60>] ia64_native_leave_kernel+0x0/0x270
                                sp=e00000018b26fbf0 bsp=e00000018b261320
 [<a000000100129870>] load_module+0xdd0/0x2300
                                sp=e00000018b26fdc0 bsp=e00000018b261198
 [<a00000010012ae70>] sys_init_module+0xd0/0x620
                                sp=e00000018b26fe30 bsp=e00000018b261120
 [<a00000010000c9c0>] ia64_ret_from_syscall+0x0/0x20
                                sp=e00000018b26fe30 bsp=e00000018b261120
 [<a000000000010720>] __kernel_syscall_via_break+0x0/0x20
                                sp=e00000018b270000 bsp=e00000018b261120
------------

It's dying here:

static inline local_t *__module_ref_addr(struct module *mod, int cpu)
{
#ifdef CONFIG_SMP
--->        return (local_t *) (mod->refptr + per_cpu_offset(cpu));
#else
        return &mod->ref;
#endif
}

This particular instance of __module_ref_addr is inlined in
module_unload_init, which is inlined in load_module.

I don't know whether this is a gcc or a kernel bug but the code
produced on IA64 is not what has been intended.

Comparing the code generated by gcc -S [1]. For the working case, i.e.
(local_t *) (mod->refptr + per_cpu_offset(cpu)),
per_cpu_offset(cpu) translates to:

ld8.mov r35 = [r83], __per_cpu_offset#  // tmp2056, tmp2056,
...
sxt4 r18 = r8   // cpu, cpu
...
shladd r17 = r18, 3, r35        // tmp1140, cpu,, tmp2056

For the crashing case, i.e.
(local_t *) per_cpu_ptr(mod->refptr, cpu),
per_cpu_offset(cpu) translates to:

sxt4 r17 = r8   // cpu, cpu
...
shladd r11 = r17, 3, r0 // tmp1140, cpu,

Note that r0 is always zero, which means __per_cpu_offset is considered
to be always NULL.

The problem seems to be triggered by RELOC_HIDE. I don't understand gcc
well enough to be able to tell what's going on here. Any ideas?

Thanks,

 Jiri

[1] http://labs.suse.cz/jbenc/kernel/reloc_hide-ia64-crash/

-- 
Jiri Benc
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/