linux-kernel - Re: 4.4-rc0: 5 W+X pages found

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 23 Nov 2015 16:37:14 +0200
From:	Mihai Donțu <mihai.dontu@...il.com>
To:	Pavel Machek <pavel@....cz>
Cc:	linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>,
	Stephen Smalley <sds@...ho.nsa.gov>
Subject: Re: 4.4-rc0: 5 W+X pages found

On Sun, 15 Nov 2015 08:00:22 +0100 Pavel Machek wrote:
> Kernel complains:
> 
> [    5.256044] ------------[ cut here ]------------
> [    5.259267] WARNING: CPU: 0 PID: 1 at
> arch/x86/mm/dump_pagetables.c:225 note_page+0x5ec/0x790()
> [    5.262668] x86/mm: Found insecure W+X mapping at address
> ffe69000/0xffe69000
> [    5.267109] Modules linked in:
> [    5.271403] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.3.0+ #122
> [    5.275679] Hardware name: LENOVO 17097HU/17097HU, BIOS 7BETD8WW
> (2.19 ) 03/31/2011
> [    5.279957]  00000000 00000000 f5cffeac c42b9f18 f5cffed8 f5cffec8
> c404062b 000000e1
> [    5.284387]  c403ca9c f5cfff50 00000163 00000000 f5cffee0 c4040686
> 00000009 f5cffed8
> [    5.288815]  c4d268ac f5cffef4 f5cfff1c c403ca9c c4d1f494 000000e1
> c4d268ac ffe69000
> [    5.293314] Call Trace:
> [    5.297602]  [<c42b9f18>] dump_stack+0x41/0x59
> [    5.301864]  [<c404062b>] warn_slowpath_common+0x6b/0xa0
> [    5.306054]  [<c403ca9c>] ? note_page+0x5ec/0x790
> [    5.310209]  [<c4040686>] warn_slowpath_fmt+0x26/0x30
> [    5.314358]  [<c403ca9c>] note_page+0x5ec/0x790
> [    5.318440]  [<c403cd8f>] ptdump_walk_pgd_level_core+0x14f/0x230
> [    5.322578]  [<c403ce91>] ptdump_walk_pgd_level_checkwx+0x11/0x20
> [    5.326632]  [<c4034ead>] mark_rodata_ro+0xcd/0xf0
> [    5.330625]  [<c4a4aab7>] kernel_init+0x17/0xc0
> [    5.334585]  [<c4a511c9>] ret_from_kernel_thread+0x21/0x38
> [    5.338585]  [<c4a4aaa0>] ? rest_init+0xa0/0xa0
> [    5.342583] ---[ end trace bc9ac0874ad9a058 ]---
> [    5.346630] x86/mm: Checked W+X mappings: FAILED, 5 W+X pages
> found.
> 
> ...I'm not quite sure why it does backtrace, or how to debug this
> one...

That is a modest number.

[    2.493559] ------------[ cut here ]------------
[    2.493563] WARNING: CPU: 2 PID: 1 at arch/x86/mm/dump_pagetables.c:225 note_page+0x5e1/0x780()
[    2.493565] x86/mm: Found insecure W+X mapping at address ffff88000009d000/0xffff88000009d000
[    2.493565] Modules linked in:
[    2.493568] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.4.0-rc2 #2
[    2.493569] Hardware name: Dell Inc. Latitude E7440/07F3F4, BIOS A15 05/19/2015
[    2.493570]  0000000000000000 00000000c03551f4 ffff88040c7cbd48 ffffffffaa54851c
[    2.493572]  ffff88040c7cbd90 ffff88040c7cbd80 ffffffffaa13a662 ffff88040c7cbe90
[    2.493573]  8000000000000163 0000000000000004 0000000000000000 0000000000000000
[    2.493575] Call Trace:
[    2.493579]  [<ffffffffaa54851c>] dump_stack+0x4e/0x82
[    2.493582]  [<ffffffffaa13a662>] warn_slowpath_common+0x82/0xc0
[    2.493583]  [<ffffffffaa13a6fc>] warn_slowpath_fmt+0x5c/0x80
[    2.493585]  [<ffffffffaa0a3f61>] note_page+0x5e1/0x780
[    2.493587]  [<ffffffffaa0a43c4>] ptdump_walk_pgd_level_core+0x2c4/0x3f0
[    2.493588]  [<ffffffffaa0a4527>] ptdump_walk_pgd_level_checkwx+0x17/0x20
[    2.493591]  [<ffffffffaa09ad0f>] mark_rodata_ro+0xef/0x100
[    2.493594]  [<ffffffffaae75d00>] ? rest_init+0x90/0x90
[    2.493595]  [<ffffffffaae75d1d>] kernel_init+0x1d/0xe0
[    2.493596]  [<ffffffffaae7c52f>] ret_from_fork+0x3f/0x70
[    2.493598]  [<ffffffffaae75d00>] ? rest_init+0x90/0x90
[    2.493599] ---[ end trace e2aec56d15b94609 ]---
[    2.498994] x86/mm: Checked W+X mappings: FAILED, 104640 W+X pages found.

All the while I have:

$ zgrep NX /proc/config.gz 
CONFIG_DEBUG_SET_MODULE_RONX=y

I added to CC the people involved in pushing this feature to mainline,
maybe they can point me to a possible cause.

-- 
Mihai Donțu
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/