linux-kernel - Re: [3.9-rc1 x86] Bug in ioremap code?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130305224432.GD27022@pd.tnic>
Date:	Tue, 5 Mar 2013 23:44:32 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	Dave Hansen <dave@...ux.vnet.ibm.com>,
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:	hpa@...ux.intel.com, linux-kernel@...r.kernel.org
Subject: Re: [3.9-rc1 x86] Bug in ioremap code?

On Tue, Mar 05, 2013 at 02:26:12PM -0800, Dave Hansen wrote:
> Just booted a qemu-kvm guest with this .config.  It didn't trip over
> anything, so I'm looking for some more ACPI tables to feed in to it.
> 
> Looking through the code, it looks like this is the __pa() that's
> hitting the BUG_ON():

Shouldn't it be this one:

#ifdef CONFIG_DEBUG_VIRTUAL
unsigned long __phys_addr(unsigned long x)
{
        unsigned long phys_addr = x - PAGE_OFFSET;
        /* VMALLOC_* aren't constants  */
        VIRTUAL_BUG_ON(x < PAGE_OFFSET);
        VIRTUAL_BUG_ON(__vmalloc_start_set && is_vmalloc_addr((void *) x));
        /* max_low_pfn is set early, but not _that_ early */
        if (max_low_pfn) {
                VIRTUAL_BUG_ON((phys_addr >> PAGE_SHIFT) > max_low_pfn);
                BUG_ON(slow_virt_to_phys((void *)x) != phys_addr); 		<--- **
        }
        return phys_addr;
}
EXPORT_SYMBOL(__phys_addr);
#endif

?

At least this is what the oops says:

> [    0.083350] ------------[ cut here ]------------
> [    0.084000] kernel BUG at arch/x86/mm/physaddr.c:79!
> [    0.084000] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC


Tetsuo says in some of the earlier mails:

"But I get VMware's virtual machine kernel stack fault (hardware reset)
as soon as kernel is loaded if CONFIG_DEBUG_VIRTUAL=y is added to the
config above."

> What kind of hardware is this?

[    0.084000] Pid: 0, comm: swapper/0 Not tainted 3.8.0-rc5-00105-g68d00bb #47 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform

I asked Tetsuo to confirm but it looks like 32-bit guest running in
vmware.

Ok, before we continue guessing stuff, Tetsuo, can you please explain
how exactly you're triggering this. More specifically, we need .config,
hypervisor version, I'm assuming kernel is 3.9-rc1, Linux is guest/host
etc, etc.

Basically everything one would need to know if one would like to
reproduce this bug in his environment.

Thanks.

-- 
Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/