| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20151016105229.GF31612@pd.tnic>
Date: Fri, 16 Oct 2015 12:52:29 +0200
From: Borislav Petkov <bp@...en8.de>
To: Andy Lutomirski <luto@...capital.net>
Cc: "linux-tip-commits@...r.kernel.org"
<linux-tip-commits@...r.kernel.org>,
"H. Peter Anvin" <hpa@...or.com>,
Andrew Lutomirski <luto@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Brian Gerst <brgerst@...il.com>,
Ingo Molnar <mingo@...nel.org>,
Denys Vlasenko <dvlasenk@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [tip:x86/asm] x86/entry/32: Switch INT80 to the new C syscall
path
On Thu, Oct 15, 2015 at 12:09:16PM -0700, Andy Lutomirski wrote:
> On Thu, Oct 15, 2015 at 11:09 AM, Borislav Petkov <bp@...en8.de> wrote:
> > On Fri, Oct 09, 2015 at 06:12:44AM -0700, tip-bot for Andy Lutomirski wrote:
> >> Commit-ID: 150ac78d63afb96360dab448b7b4d33c98c8266c
> >> Gitweb: http://git.kernel.org/tip/150ac78d63afb96360dab448b7b4d33c98c8266c
> >> Author: Andy Lutomirski <luto@...nel.org>
> >> AuthorDate: Mon, 5 Oct 2015 17:48:14 -0700
> >> Committer: Ingo Molnar <mingo@...nel.org>
> >> CommitDate: Fri, 9 Oct 2015 09:41:10 +0200
> >>
> >> x86/entry/32: Switch INT80 to the new C syscall path
> >>
> >> Signed-off-by: Andy Lutomirski <luto@...nel.org>
> >> Cc: Andy Lutomirski <luto@...capital.net>
> >> Cc: Borislav Petkov <bp@...en8.de>
> >> Cc: Brian Gerst <brgerst@...il.com>
> >> Cc: Denys Vlasenko <dvlasenk@...hat.com>
> >> Cc: H. Peter Anvin <hpa@...or.com>
> >> Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> >> Cc: Peter Zijlstra <peterz@...radead.org>
> >> Cc: Thomas Gleixner <tglx@...utronix.de>
> >> Cc: linux-kernel@...r.kernel.org
> >> Link: http://lkml.kernel.org/r/a7e8d8df96838eae3208dd0441023f3ce7a81831.1444091585.git.luto@kernel.org
> >> Signed-off-by: Ingo Molnar <mingo@...nel.org>
> >> ---
> >> arch/x86/entry/entry_32.S | 34 +++++++++++++---------------------
> >> 1 file changed, 13 insertions(+), 21 deletions(-)
> >
> > Just triggered this here on rc5+tip/master, 32-bit. Any ideas?
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 1 at /mnt/kernel/kernel/linux-2.6/kernel/locking/lockdep.c:2639 trace_hardirqs_off_caller+0xef/0x150()
> > DEBUG_LOCKS_WARN_ON(!irqs_disabled())
> > Modules linked in:
> >
> > CPU: 1 PID: 1 Comm: init Tainted: G W 4.3.0-rc5+ #1
> > Hardware name: LENOVO 30515QG/30515QG, BIOS 8RET30WW (1.12 ) 09/15/2011
> > 00000000 00000000 f44fbf34 c1301072 f44fbf74 f44fbf64 c105658d c1819094
> > f44fbf90 00000001 c181f838 00000a4f c10a284f c10a284f f4520000 c1662048
> > 00000009 f44fbf7c c10565f3 00000009 f44fbf74 c1819094 f44fbf90 f44fbf9c
> > Call Trace:
> > [<c1301072>] dump_stack+0x4b/0x79
> > [<c105658d>] warn_slowpath_common+0x8d/0xc0
> > [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
> > [<c10a284f>] ? trace_hardirqs_off_caller+0xef/0x150
> > [<c1662048>] ? entry_INT80_32+0x28/0x2f
>
> Can you turn that entry_INT80_32 address into either a line number of
> some assembly code? I'm not seeing the code path that could do this,
> and there are two unlikely choices.
Why, that's the TRACE_IRQS_OFF at the end of entry_INT80_32. It calls
trace_hardirqs_off_caller through the thunk. That's pretty obvious. Or
am I misunderstanding you?
c1662020 <entry_INT80_32>:
c1662020: 90 nop
c1662021: 90 nop
c1662022: 90 nop
c1662023: 50 push %eax
c1662024: fc cld
c1662025: 6a 00 push $0x0
c1662027: 0f a0 push %fs
c1662029: 06 push %es
c166202a: 1e push %ds
c166202b: 6a da push $0xffffffda
c166202d: 55 push %ebp
c166202e: 57 push %edi
c166202f: 56 push %esi
c1662030: 52 push %edx
c1662031: 51 push %ecx
c1662032: 53 push %ebx
c1662033: ba 7b 00 00 00 mov $0x7b,%edx
c1662038: 8e da mov %edx,%ds
c166203a: 8e c2 mov %edx,%es
c166203c: ba d8 00 00 00 mov $0xd8,%edx
c1662041: 8e e2 mov %edx,%fs
c1662043: e8 c8 ee 99 ff call c1000f10 <trace_hardirqs_off_thunk>
c1662048: 89 e0 mov %esp,%eax
c166204a: e8 61 f9 99 ff call c10019b0 <do_int80_syscall_32>
/*
* User mode is traced as though IRQs are on, and the interrupt gate
* turned them off.
*/
TRACE_IRQS_OFF
Sounds like the gate didn't disable IRQs, right? Or did the
irqs_disabled() check get tricked into looking at the wrong flags...?
But I don't see it. Hmmm..
> Based on the warning that triggered, I assume you have
> CONFIG_PROVE_LOCKING=y,
yes.
> which means that the obvious failures that would have blown up like
> this should also have warned earlier.
If you mean, earlier in the boot, the only splat before that one is (see
the "not tainted").
[ 2.703038] NX-protecting the kernel data: 5740k
[ 2.703822] ------------[ cut here ]------------
[ 2.703973] WARNING: CPU: 0 PID: 1 at /mnt/kernel/kernel/linux-2.6/arch/x86/mm/dump_pagetables.c:225 note_page+0x63e/0x800()
[ 2.704177] x86/mm: Found insecure W+X mapping at address c00a0000/0xc00a0000
[ 2.704324] Modules linked in:
[ 2.704461] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.3.0-rc5+ #1
...
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists