| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20170218050646.xx6woo3l2o5mei4i@wfg-t540p.sh.intel.com>
Date: Sat, 18 Feb 2017 13:06:46 +0800
From: Fengguang Wu <fengguang.wu@...el.com>
To: Stephen Smalley <sds@...ho.nsa.gov>
Cc: Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org,
LKP <lkp@...org>, the arch/x86 maintainers <x86@...nel.org>
Subject: [x86/mm] e1a58320a3 WARNING: CPU: 0 PID: 1 at
arch/x86/mm/dump_pagetables.c:225 note_page()
Greetings,
0day kernel testing robot got the below dmesg and the first bad commit is
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
commit e1a58320a38dfa72be48a0f1a3a92273663ba6db
Author: Stephen Smalley <sds@...ho.nsa.gov>
AuthorDate: Mon Oct 5 12:55:20 2015 -0400
Commit: Ingo Molnar <mingo@...nel.org>
CommitDate: Tue Oct 6 11:11:48 2015 +0200
x86/mm: Warn on W^X mappings
Warn on any residual W+X mappings after setting NX
if DEBUG_WX is enabled. Introduce a separate
X86_PTDUMP_CORE config that enables the code for
dumping the page tables without enabling the debugfs
interface, so that DEBUG_WX can be enabled without
exposing the debugfs interface. Switch EFI_PGT_DUMP
to using X86_PTDUMP_CORE so that it also does not require
enabling the debugfs interface.
On success it prints this to the kernel log:
x86/mm: Checked W+X mappings: passed, no W+X pages found.
On failure it prints a warning and a count of the failed pages:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:226 note_page+0x610/0x7b0()
x86/mm: Found insecure W+X mapping at address ffffffff81755000/__stop___ex_table+0xfa8/0xabfa8
[...]
Call Trace:
[<ffffffff81380a5f>] dump_stack+0x44/0x55
[<ffffffff8109d3f2>] warn_slowpath_common+0x82/0xc0
[<ffffffff8109d48c>] warn_slowpath_fmt+0x5c/0x80
[<ffffffff8106cfc9>] ? note_page+0x5c9/0x7b0
[<ffffffff8106d010>] note_page+0x610/0x7b0
[<ffffffff8106d409>] ptdump_walk_pgd_level_core+0x259/0x3c0
[<ffffffff8106d5a7>] ptdump_walk_pgd_level_checkwx+0x17/0x20
[<ffffffff81063905>] mark_rodata_ro+0xf5/0x100
[<ffffffff817415a0>] ? rest_init+0x80/0x80
[<ffffffff817415bd>] kernel_init+0x1d/0xe0
[<ffffffff8174cd1f>] ret_from_fork+0x3f/0x70
[<ffffffff817415a0>] ? rest_init+0x80/0x80
---[ end trace a1f23a1e42a2ac76 ]---
x86/mm: Checked W+X mappings: FAILED, 171 W+X pages found.
Signed-off-by: Stephen Smalley <sds@...ho.nsa.gov>
Acked-by: Kees Cook <keescook@...omium.org>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Arjan van de Ven <arjan@...ux.intel.com>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Mike Galbraith <efault@....de>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: linux-kernel@...r.kernel.org
Link: http://lkml.kernel.org/r/1444064120-11450-1-git-send-email-sds@tycho.nsa.gov
[ Improved the Kconfig help text and made the new option default-y
if CONFIG_DEBUG_RODATA=y, because it already found buggy mappings,
so we really want people to have this on by default. ]
Signed-off-by: Ingo Molnar <mingo@...nel.org>
+-------------------------------------------------------+------------+------------+------------+
| | 38a413cbc2 | e1a58320a3 | 9cad9cbdbe |
+-------------------------------------------------------+------------+------------+------------+
| boot_successes | 83 | 0 | 8 |
| boot_failures | 0 | 27 | 27 |
| WARNING:at_arch/x86/mm/dump_pagetables.c:#note_page() | 0 | 27 | |
| calltrace:mark_rodata_ro | 0 | 27 | |
| WARNING:at_arch/x86/mm/dump_pagetables.c:#note_page | 0 | 0 | 27 |
+-------------------------------------------------------+------------+------------+------------+
[ 8.115747] Write protecting the kernel read-only data: 3280k
[ 8.116626] NX-protecting the kernel data: 7824k
[ 8.118416] ------------[ cut here ]------------
[ 8.119156] WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:225 note_page+0x18f/0x51b()
[ 8.120705] x86/mm: Found insecure W+X mapping at address c00a0000/0xc00a0000
[ 8.121786] Modules linked in:
[ 8.122284] CPU: 0 PID: 1 Comm: swapper Not tainted 4.3.0-rc3-00013-ge1a5832 #119
[ 8.123424] 00000000 d5081ed0 d5081ea8 c13bc54f d5081ec0 c107dae0 c106e078 d5081f50
[ 8.124794] 00000163 00000002 d5081ed8 c107dbf5 00000009 d5081ed0 c1ad925a d5081eec
[ 8.126149] d5081f1c c106e078 c1ad9290 000000e1 c1ad925a c00a0000 c00a0000 00000000
[ 8.127520] Call Trace:
[ 8.127919] [<c13bc54f>] dump_stack+0x40/0x5e
[ 8.128606] [<c107dae0>] warn_slowpath_common+0xd4/0x115
[ 8.129425] [<c106e078>] ? note_page+0x18f/0x51b
[ 8.130170] [<c107dbf5>] warn_slowpath_fmt+0x42/0x54
[ 8.130956] [<c106e078>] note_page+0x18f/0x51b
[ 8.131662] [<c106e6aa>] ptdump_walk_pgd_level_core+0x2a6/0x46d
[ 8.132582] [<c106e8b8>] ptdump_walk_pgd_level_checkwx+0x1f/0x2f
[ 8.133515] [<c1061b4c>] mark_rodata_ro+0x1a4/0x1ba
[ 8.134287] [<c184f733>] kernel_init+0x4f/0x1e7
[ 8.135000] [<c185a240>] ret_from_kernel_thread+0x20/0x30
[ 8.135838] [<c184f6e4>] ? rest_init+0x158/0x158
[ 8.136562] ---[ end trace 01b3950ee29e5eb2 ]---
[ 8.137417] x86/mm: Checked W+X mappings: FAILED, 6893 W+X pages found.
git bisect start v4.4 v4.3 --
git bisect bad cd6caf550a2adc763c6301ecc0be01f422fb2aea # 01:50 0- 7 Merge tag 'for-linus-4.4' of git://git.code.sf.net/p/openipmi/linux-ipmi
git bisect bad 713009809681e5a7871e96e6992692c805b4480b # 02:01 0- 21 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
git bisect bad ccf21b69a83afaee4d5499e0d03eacf23946e08c # 02:08 0- 10 Merge branch 'for-4.4/reservations' of git://git.kernel.dk/linux-block
git bisect good b831ef2cad979912850e34f82415c0c5d59de8cb # 02:24 27+ 0 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad ccc9d4a6d640cbde05d519edeb727881646cf71b # 02:35 0- 1 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
git bisect good f323c49b300baf89e2cb4050b0def1856c0b1852 # 02:48 28+ 0 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 4302d506d5f3419109abdd0d6e400ed6e8148209 # 03:05 27+ 0 Merge branch 'x86-headers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect bad 639ab3eb38c6e92e27e061551dddee6dd3bbb5d2 # 03:17 0- 8 Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good 34437e67a6727885bdf6cbfd8441b1ac43a1ee65 # 03:28 28+ 0 x86/mm: Fix slow_virt_to_phys() to handle large PAT bit
git bisect good d551aaa2f7e1387fa66093ce9914c2e91f283a50 # 03:44 28+ 0 x86/mm: Fix __split_large_page() to handle large PAT bit
git bisect good 38a413cbc2b2834683b21823d964bc2d2f0abb82 # 04:05 28+ 0 Merge tag 'v4.3-rc3' into x86/mm, to pick up fixes before applying new changes
git bisect bad e1a58320a38dfa72be48a0f1a3a92273663ba6db # 04:11 0- 2 x86/mm: Warn on W^X mappings
# first bad commit: [e1a58320a38dfa72be48a0f1a3a92273663ba6db] x86/mm: Warn on W^X mappings
git bisect good 38a413cbc2b2834683b21823d964bc2d2f0abb82 # 04:21 78+ 0 Merge tag 'v4.3-rc3' into x86/mm, to pick up fixes before applying new changes
# extra tests with CONFIG_DEBUG_INFO_REDUCED
git bisect bad e1a58320a38dfa72be48a0f1a3a92273663ba6db # 04:29 0- 1 x86/mm: Warn on W^X mappings
# extra tests on HEAD of linux-devel/devel-catchup-201702172121
git bisect bad 9cad9cbdbedc6cc3196cb840bdf3785d77a15c7a # 04:29 0- 27 0day head guard for 'devel-catchup-201702172121'
# extra tests on tree/branch linus/master
git bisect bad 2fe1e8a7b2f4dcac3fcb07ff06b0ae7396201fd6 # 04:30 0- 2 Merge tag 'powerpc-4.10-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
# extra tests on tree/branch linus/master
git bisect bad 2fe1e8a7b2f4dcac3fcb07ff06b0ae7396201fd6 # 04:30 0- 2 Merge tag 'powerpc-4.10-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
# extra tests on tree/branch linux-next/master
git bisect bad 4ce4a759a3e221b5265ebd03c2f8888b69a7cf3e # 04:35 0- 28 Add linux-next specific files for 20170217
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/lkp Intel Corporation
Download attachment "dmesg-quantal-ivb41-143:20170218041522:i386-randconfig-s0-201707:4.3.0-rc3-00013-ge1a5832:119.gz" of type "application/gzip" (15196 bytes)
View attachment "config-4.3.0-rc3-00013-ge1a5832" of type "text/plain" (75438 bytes)
Powered by blists - more mailing lists