linux-kernel - Re: [PATCH] x86/ftrace: Make sure that ftrace trampolines are not RWX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 May 2017 19:34:43 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Kees Cook <keescook@...omium.org>,
        LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH] x86/ftrace: Make sure that ftrace trampolines are not
 RWX

On Thu, 25 May 2017 18:09:10 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> On Wed, 24 May 2017 18:25:47 -0400
> Steven Rostedt <rostedt@...dmis.org> wrote:
> 
> > On Wed, 24 May 2017 21:13:27 +0200 (CEST)
> > Thomas Gleixner <tglx@...utronix.de> wrote:
> > 
> > 
> > > > Oops: 0003 [#1] SMP
> > > > Modules linked in:
> > > > CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc2-test+ #42
> > > > Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6
> > > > 02/22/2014 task: ffff8802153a8000 task.stack: ffffc90000c74000
> > > > RIP: 0010:new_slab+0x1e8/0x2b4
> > > > RSP: 0000:ffffc90000c77b28 EFLAGS: 00010282
> > > > RAX: 0000000040040000 RBX: ffff880216003f00 RCX: ffff880214f5c058
> > > > RDX: 0000000000000000 RSI: ffff880214f5c000 RDI: ffff880216003f00
> > > > RBP: ffffc90000c77b70 R08: 000000000000002a R09: 0000000000000000
> > > > R10: 00000000000201e2 R11: 0000000000020190 R12: ffff880214f5c000
> > > > R13: 000000000000002e R14: 0000000000000001 R15: ffffea000853d700
> > > > FS:  0000000000000000(0000) GS:ffff88021eb80000(0000)
> > > > knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0:
> > > > 0000000080050033 CR2: ffff880214f5c000 CR3: 000000000221d000 CR4:
> > > > 00000000001406e0 Call Trace:
> > > >  ? interleave_nodes+0x29/0x40
> > > >  ___slab_alloc+0x2e8/0x49e  
> > > 
> > > That does not make any sense, but I'm digging into it.
> > 
> > The trampolines uses the module allocation, and it appears, that needs
> > to become rw before freeing again.
> 
> Oops, I also have to fix kprobes side, because it has same issue.

OK, I've ensured that following command hits same BUG.

grep t /proc/kallsyms  | cut -f3 -d" " | grep -v .*\\..* | \
head -n 256 | while read i; do echo p $i+5 ; done > tracing/kprobe_events

echo 1 > tracing/events/kprobes/enable 
echo 0 > tracing/events/kprobes/enable
echo > tracing/kprobe_events
sleep 5

I'll send a bugfix asap.

Thank,

-- 
Masami Hiramatsu <mhiramat@...nel.org>