linux-kernel - Re: perf_fuzzer compiled for x32 causes reboot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1402241130080.20170@vincent-weaver-1.um.maine.edu>
Date:	Mon, 24 Feb 2014 11:34:30 -0500 (EST)
From:	Vince Weaver <vincent.weaver@...ne.edu>
To:	Vince Weaver <vincent.weaver@...ne.edu>
cc:	"H. Peter Anvin" <hpa@...or.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>, "H.J. Lu" <hjl.tools@...il.com>
Subject: Re: perf_fuzzer compiled for x32 causes reboot

On Mon, 24 Feb 2014, Vince Weaver wrote:

> Just touching the mmap page with a write of a single byte (it doesn't 
> matter where) is enough to trigger the bug.

OK, investigating this more.

     perf_fuzzer-2971  [000]   154.944114: page_fault_user:       address=0xf7729000 ip=0x41efab error_code=0x6
     perf_fuzzer-2971  [000]   154.944118: function:              ip=0xffffffff810d40e7 parent_ip=0xffffffff810d0840
     perf_fuzzer-2971  [000]   154.944119: function:              ip=0xffffffff812a91a5 parent_ip=0xffffffff81013ff5
     perf_fuzzer-2971  [000]   154.944120: function:              ip=0xffffffff8153837c parent_ip=0xffffffff81535432
     perf_fuzzer-2971  [000]   154.944121: page_fault_kernel:     address=0x22e0 ip=0xffffffff812a7d5c error_code=0x0

It looks like there are two page faults.  The first is caused by the user
code accessing the mmap'd page.  It looks sort of normal and what you'd
expect if the perf_event mmap ring buffer is being accessed for the first
time.

What follows is a kernel page fault, and this is the one where for 
whatever reason CR2 has obtained the value of the userspace RBP register.

Vince


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/