linux-kernel - Re: [RFC PATCH] Fix: x86 unaligned _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Thu, 25 Jun 2015 00:33:52 +0000 (UTC)
From:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	the arch/x86 maintainers <x86@...nel.org>
Subject: Re: [RFC PATCH] Fix: x86 unaligned __memcpy to/from virtual memory

----- On Jun 24, 2015, at 7:54 PM, Mathieu Desnoyers mathieu.desnoyers@...icios.com wrote:
> ----- On Jun 24, 2015, at 3:15 PM, Linus Torvalds torvalds@...ux-foundation.org
> wrote:
> 
>> On Wed, Jun 24, 2015 at 11:49 AM, Mathieu Desnoyers
>> <mathieu.desnoyers@...icios.com> wrote:
>>>
>>> Here is the output. I added the printk just after the initial range
>>> check within vmalloc_fault.
>> 
>> Good. Can you add printk's to the error return paths too, so that we
>> see which one it is that triggers.
> 
> OK, see below. This time the fault occurred at an unaligned address.
> It fails on the !pte_present(*pte_ref) check.

I just tried to to a bytewise copy in C rather than call
memcpy, and I got the fault to trigger. So I guess I was on
the wrong track assuming __memcpy would be the culprit.
What is odd is that if I issue vmalloc_sync_all() after each
vmalloc call, the OOPS never triggers. It is clearly a test
case that ends up stressing vfree/vmalloc.

[   34.751984] DEBUG: vmalloc_fault at address 0xffffc90007290000
[   34.753188] DEBUG: !pte_present(*pte_ref) error
[   34.753188] BUG: unable to handle kernel paging request at ffffc90007290000
[   34.753188] IP: [<ffffffffa05c77c0>] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client]
[   34.753188] PGD 236c92067 PUD 236c93067 PMD b6964067 PTE 0
[   34.753188] Oops: 0000 [#1] SMP 
[   34.753188] Modules linked in: lttng_probe_workqueue(O) lttng_probe_vmscan(O) lttng_probe_udp(O) lttng_probe_timer(O) lttng_probe_sunrpc(O) lttng_probe_statedump(O) lttng_probe_sock(O) lttng_probe_skb(O) lttng_probe_signal(O) lttng_probe_scsi(O) lttng_probe_sched(O) lttng_probe_regmap(O) lttng_probe_rcu(O) lttng_probe_random(O) lttng_probe_power(O) lttng_probe_net(O) lttng_probe_napi(O) lttng_probe_module(O) lttng_probe_kmem(O) lttng_probe_jbd2(O) lttng_probe_irq(O) lttng_probe_ext4(O) lttng_probe_compaction(O) lttng_probe_block(O) lttng_types(O) lttng_ring_buffer_metadata_mmap_client(O) lttng_ring_buffer_client_mmap_overwrite(O) lttng_ring_buffer_client_mmap_discard(O) lttng_ring_buffer_metadata_client(O) lttng_ring_buffer_client_overwrite(O) lttng_ring_buffer_client_discard(O) lttng_tracer(O) lttng_statedump(O) lttng_kprobes(O) lttng_lib_ring_buffer(O) lttng_kretprobes(O) virtio_blk virtio_net virtio_pci virtio_ring virtio [last unloaded: lttng_statedump]
[   34.753188] CPU: 26 PID: 3563 Comm: lttng-consumerd Tainted: G           O    4.1.0+ #11
[   34.753188] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   34.753188] task: ffff880234d94880 ti: ffff88022af6c000 task.ti: ffff88022af6c000
[   34.753188] RIP: 0010:[<ffffffffa05c77c0>]  [<ffffffffa05c77c0>] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client]
[   34.753188] RSP: 0018:ffff88022af6fda8  EFLAGS: 00010212
[   34.753188] RAX: 000000000000009d RBX: 0000000000000fd8 RCX: 0000000000000025
[   34.753188] RDX: ffff8800b7681120 RSI: ffffc9000728ff63 RDI: 0000000000000000
[   34.753188] RBP: ffff88022af6fdb8 R08: 000000000000009d R09: ffff88022ea33025
[   34.753188] R10: 000000000000003b R11: 0000000000000246 R12: ffff88022af6fdc8
[   34.753188] R13: ffff880231565c00 R14: 0000000000000fd8 R15: 0000000000000fd8
[   34.753188] FS:  00007fd64b5f2700(0000) GS:ffff880237540000(0000) knlGS:0000000000000000
[   34.753188] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   34.753188] CR2: ffffc90007290000 CR3: 0000000233803000 CR4: 00000000000006e0
[   34.753188] Stack:
[   34.753188]  ffff880234cbff00 ffff880234cbff50 ffff88022af6fe48 ffffffffa048e060
[   34.753188]  ffff880231565c00 0000000000000000 0000000000000fd8 ffffffff00000001
[   34.753188]  ffff88023155d000 0000000000000fd8 0000000000004025 0000000000004025
[   34.753188] Call Trace:
[   34.753188]  [<ffffffffa048e060>] lttng_metadata_output_channel+0xd0/0x120 [lttng_tracer]
[   34.753188]  [<ffffffffa04905f9>] lttng_metadata_ring_buffer_ioctl+0x79/0xd0 [lttng_tracer]
[   34.753188]  [<ffffffff8117ba70>] do_vfs_ioctl+0x2e0/0x4e0
[   34.753188]  [<ffffffff812b3627>] ? file_has_perm+0x87/0xa0
[   34.753188]  [<ffffffff8117bcf1>] SyS_ioctl+0x81/0xa0
[   34.753188]  [<ffffffff810115d1>] ? syscall_trace_leave+0xd1/0xe0
[   34.753188]  [<ffffffff818bbdb7>] tracesys_phase2+0x84/0x89
[   34.753188] Code: d9 48 0f 47 cb 48 39 cb 75 46 48 8d 57 02 25 ff 0f 00 00 45 31 c0 48 89 c1 31 c0 48 c1 e2 04 4c 01 ca 66 0f 1f 84 00 00 00 00 00 <44> 0f b6 14 06 49 89 c9 4c 03 0a 41 83 c0 01 45 88 14 01 49 63 
[   34.753188] RIP  [<ffffffffa05c77c0>] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client]
[   34.753188]  RSP <ffff88022af6fda8>
[   34.753188] CR2: ffffc90007290000
[   34.753188] ---[ end trace 28951381246c3a2e ]---


-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/