linux-kernel - Re: oops during modprobe (3.2.0-rc6+)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111220023550.GB9308@joshcartwright.net>
Date:	Mon, 19 Dec 2011 21:35:50 -0500
From:	Josh Cartwright <joshc@...ux.com>
To:	Ralf Hildebrandt <Ralf.Hildebrandt@...rite.de>
Cc:	linux-kernel@...r.kernel.org, linux-watchdog@...r.kernel.org
Subject: Re: oops during modprobe (3.2.0-rc6+)

(CC'ing linux-watchdog)

On Sat, Dec 17, 2011 at 10:36:45PM +0100, Ralf Hildebrandt wrote:
> Todya I pulled 3.2.0-rc6+ from git and built it for my machine. After
> booting I found this in dmesg:
> 
> ...
> [    6.322632] bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011)
> [    6.324608] hpwdt 0000:01:04.0: PCI INT A -> GSI 21 (level, low) -> IRQ 21
> [    6.324680] hpwdt: New timer passed in is 30 seconds.
> [    6.324725] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
> [    6.324798] BUG: unable to handle kernel paging request at c00f0000
> [    6.324917] IP: [<c00f0000>] 0xc00effff
> [    6.325002] *pdpt = 00000000013b1001 *pde = 00000000013de067 *pte = 80000000000f0163 
> [    6.325002] Oops: 0011 [#1] SMP 
> [    6.325002] Modules linked in: hpwdt(+) bnx2(+) container psmouse thermal button processor
> [    6.325002] 
> [    6.325002] Pid: 668, comm: modprobe Not tainted 3.2.0-rc6+ #16 HP ProLiant DL360 G5
> [    6.325002] EIP: 0060:[<c00f0000>] EFLAGS: 00010286 CPU: 3
> [    6.325002] EIP is at 0xc00f0000
> [    6.325905] EAX: 55524324 EBX: 00000000 ECX: 00000000 EDX: 00000000
> [    6.325905] ESI: 00000000 EDI: 00000000 EBP: f00cddd8 ESP: f00cdda8
> [    6.325905]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
> [    6.325905] Process modprobe (pid: 668, ti=f00cc000 task=f0028000 task.ti=f00cc000)
> [    6.325905] Stack:
> [    6.325905]  f8432020 00000060 c00e007b 00000286 c00ffee0 ffffffed f00cddd8 f00cddd8
> [    6.325905]  c00f0000 00000001 00000000 c00f0000 f2cdbc00 f8432558 f8434100 c00f0000
> [    6.325905]  f2c30564 ffffffff f8434030 000f0000 000f0000 f2d777e0 c0100000 c00f0000
> [    6.325905] Call Trace:
> [    6.325905]  [<f8432020>] ? asminline_call+0x20/0x46 [hpwdt]
> [    6.325905]  [<f8432558>] ? hpwdt_init_one+0x1a7/0x3c0 [hpwdt]
> [    6.325905]  [<c115dc36>] ? pci_device_probe+0x47/0x68
> [    6.325905]  [<c11aa0a7>] ? driver_probe_device+0x4a/0x13a
> [    6.325905]  [<c115db04>] ? pci_match_device+0xf/0x8a
> [    6.325905]  [<c11aa1f9>] ? __driver_attach+0x62/0x64
> [    6.325905]  [<c11aa197>] ? driver_probe_device+0x13a/0x13a
> [    6.325905]  [<c11a9543>] ? bus_for_each_dev+0x3e/0x62
> [    6.325905]  [<c115dba2>] ? pci_dev_put+0xd/0xd
> [    6.325905]  [<c11a9e69>] ? driver_attach+0x19/0x1e
> [    6.325905]  [<c11aa197>] ? driver_probe_device+0x13a/0x13a
> [    6.325905]  [<c11a9beb>] ? bus_add_driver+0x17d/0x24d
> [    6.325905]  [<c115dba2>] ? pci_dev_put+0xd/0xd
> [    6.325905]  [<c11aa3d9>] ? driver_register+0x57/0xec
> [    6.325905]  [<c115dfef>] ? __pci_register_driver+0x31/0x92
> [    6.325905]  [<c1001027>] ? do_one_initcall+0x27/0x150
> [    6.325905]  [<c101c97e>] ? set_memory_nx+0x57/0x5b
> [    6.325905]  [<f8410000>] ? 0xf840ffff
> [    6.325905]  [<c1054416>] ? sys_init_module+0xdff/0x1a14
> [    6.325905]  [<c126f717>] ? sysenter_do_call+0x12/0x26
> [    6.325905] Code: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
> [    6.329004]  90 80 fc d8 75 0d e9 da 06 00 00 69 04 00 00 ad 04 00 00 9c 
> [    6.329004] EIP: [<c00f0000>] 0xc00f0000 SS:ESP 0068:f00cdda8
> [    6.329004] CR2: 00000000c00f0000
> [    6.329004] ---[ end trace 239ff8fe19067483 ]---

I'm completely unfamiliar with this driver, but it looks like it ends up
executing a ioremap()'d region, which is being mapped NX.  I'll take a
stab at it with this completely untested patch.  Does it resolve your
issue?

diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 3774c9b..33e6c9a 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -227,6 +227,8 @@ static int __devinit cru_detect(unsigned long map_entry,
 	if (bios32_map == NULL)
 		return -ENODEV;
 
+	set_memory_x((unsigned long) bios32_map, 2 * PAGE_SIZE);
+
 	bios32_entrypoint = bios32_map + map_offset;
 
 	cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;

-- 
                           joshc
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/