lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Wed, 25 Oct 2017 08:37:14 +0200
From:   Fengguang Wu <fengguang.wu@...el.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     wfg@...ux.intel.com,
        "Steven Rostedt (VMware)" <rostedt@...dmis.org>,
        linux-kernel@...r.kernel.org, LKP <lkp@...org>
Subject: 6ee98ffeea ("x86/ftrace: Make sure that ftrace trampolines are not
 RWX"): BUG: kernel reboot-without-warning in test stage

Hi Thomas,

FYI this commit turns a warning into kernel crash:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

commit 6ee98ffeea0bc9e072e419497d78697d8afcdd6d
Author:     Thomas Gleixner <tglx@...utronix.de>
AuthorDate: Thu May 25 10:57:51 2017 +0200
Commit:     Steven Rostedt (VMware) <rostedt@...dmis.org>
CommitDate: Fri May 26 22:37:02 2017 -0400

     x86/ftrace: Make sure that ftrace trampolines are not RWX
     
     ftrace use module_alloc() to allocate trampoline pages. The mapping of
     module_alloc() is RWX, which makes sense as the memory is written to right
     after allocation. But nothing makes these pages RO after writing to them.
     
     Add proper set_memory_rw/ro() calls to protect the trampolines after
     modification.
     
     Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705251056410.1862@nanos
     
     Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
     Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>

a53276e282  x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range()
6ee98ffeea  x86/ftrace: Make sure that ftrace trampolines are not RWX
6cff0a118f  Merge tag 'platform-drivers-x86-v4.14-3' of git://git.infradead.org/linux-platform-drivers-x86
36ef71cae3  Add linux-next specific files for 20171018
+-----------------------------------------------------+------------+------------+------------+---------------+
|                                                     | a53276e282 | 6ee98ffeea | 6cff0a118f | next-20171018 |
+-----------------------------------------------------+------------+------------+------------+---------------+
| boot_successes                                      | 7          | 600        | 609        | 596           |
| boot_failures                                       | 1626       | 25         | 24         | 29            |
| WARNING:at_arch/x86/mm/dump_pagetables.c:#note_page | 1626       |            |            |               |
| BUG:unable_to_handle_kernel                         | 1          |            |            |               |
| Oops:#[##]                                          | 1          |            |            |               |
| BUG:kernel_reboot-without-warning_in_test_stage     | 0          | 25         | 24         | 29            |
+-----------------------------------------------------+------------+------------+------------+---------------+

[main] Setsockopt(1 20 2456000 4) on fd 378 [1:5:1]
[main] Setsockopt(1 22 2456000 4) on fd 379 [1:2:1]
[main] 375 sockets created based on info from socket cachefile.

<KERNEL REBOOT HERE>

The parent commit has this warning:

[   13.180002] Freeing unused kernel memory: 372K
[   13.180635] x86/mm: Found insecure W+X mapping at address ffffffffa0000000/0xffffffffa0000000
[   13.181499] ------------[ cut here ]------------
[   13.181946] WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:236 note_page+0x191/0x446
[   13.182928] Modules linked in:
[   13.183231] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc2-00004-ga53276e #1
[   13.183984] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   13.184782] task: ffff8800002b0000 task.stack: ffffc90000008000
[   13.185428] RIP: 0010:note_page+0x191/0x446
[   13.185848] RSP: 0000:ffffc9000000be10 EFLAGS: 00010282
[   13.186374] RAX: 0000000000000051 RBX: ffffc9000000be90 RCX: 0000000000000000
[   13.187053] RDX: ffffffff81a3f078 RSI: 0000000000000001 RDI: 0000000000000286
[   13.187742] RBP: ffffc9000000be40 R08: 0000000000000001 R09: 0000000000000001
[   13.188455] R10: 0000000000000001 R11: 0000000000000030 R12: 0000000000000000
[   13.189224] R13: 0000000000000004 R14: 0000000000000000 R15: ffffffff81a0f001
[   13.189919] FS:  0000000000000000(0000) GS:ffff88001e700000(0000) knlGS:0000000000000000
[   13.190681] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   13.191377] CR2: ffffc90000094000 CR3: 0000000001a0f000 CR4: 00000000000006a0
[   13.192374] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   13.193309] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   13.194296] Call Trace:
[   13.194637]  ptdump_walk_pgd_level_core+0x3d1/0x50a
[   13.195200]  ? 0xffffffff81000000
[   13.195695]  ptdump_walk_pgd_level_checkwx+0x17/0x19
[   13.196730]  mark_rodata_ro+0xec/0xf3
[   13.197234]  ? rest_init+0x15c/0x15c
[   13.197874]  kernel_init+0x35/0x16a
[   13.198316]  ret_from_fork+0x31/0x40
[   13.198799] Code: c7 00 73 ab 81 c6 05 43 48 9d 00 01 e8 af 4d 14 00 48 8b 73 10 48 c7 c7 93 7a 90 81 48 ff 05 e3 3f b0 00 48 89 f2 e8 82 b
1 18 00 <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 d0 72 ab 81
[   13.201397] ---[ end trace 8b1d34932c92c906 ]---
[   13.202109] x86/mm: Checked W+X mappings: FAILED, 1 W+X pages found.
[   13.202924] rodata_test: all tests were successful

                                                           # HH:MM RESULT GOOD BAD GOOD_BUT_DIRTY DIRTY_NOT_BAD
git bisect start v4.12 v4.11 --
git bisect good f3926e4c2a4b53c25a998de168d4eef6d0360369  # 02:53  G    621     0  619 619  Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
git bisect  bad 21c9eb7ca32be43a1c6fcb8194cf2d1aea771772  # 03:18  B     17     2    0   0  Merge tag 'staging-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
git bisect  bad 46356945fc2bc932dd224af60c12ece2672479be  # 03:48  B     20     2    0   0  Merge tag 'drm-dp-quirk-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux
git bisect  bad d024baa58a4a7e5eb6058017771d15b9e47b56db  # 04:20  B     72     1    0   0  Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
git bisect good be941bf2e6a32605935865972df7abf74087944f  # 07:38  G    625     0  624 624  Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
git bisect good 6ce47829113772b1d6b9046f5eaf00e154f0f9de  # 08:41  G    625     0  624 624  Merge tag 'pci-v4.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
git bisect good 6741d51699ac9ef21f1fac14c63ecd31d3a7c278  # 11:26  G    620     0  619 619  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
git bisect good c86daad2c25bfd4a33d48b7691afaa96d9c5ab46  # 16:55  G    625     0  624 624  Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
git bisect  bad 77d64656950b299f5e7c70f1e3a0bdc991b51497  # 17:17  B     24     3    0   0  Merge tag 'trace-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
git bisect good bdd7e3d68492bfb7ade574f8c64b87bea499ca2e  # 18:06  G    625     0  620 620  selftests/ftrace: Add a testcase for many kprobe events
git bisect  bad 6ee98ffeea0bc9e072e419497d78697d8afcdd6d  # 18:36  B      6     1    0   0  x86/ftrace: Make sure that ftrace trampolines are not RWX
git bisect good a53276e2826010338478ed94310874001a8097fa  # 19:27  G    625     0  623 623  x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range()
# first bad commit: [6ee98ffeea0bc9e072e419497d78697d8afcdd6d] x86/ftrace: Make sure that ftrace trampolines are not RWX
git bisect good a53276e2826010338478ed94310874001a8097fa  # 21:57  G   1004     0  997 1620  x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range()
# extra tests with CONFIG_DEBUG_INFO_REDUCED
git bisect  bad 6ee98ffeea0bc9e072e419497d78697d8afcdd6d  # 22:21  B      5     1    0   0  x86/ftrace: Make sure that ftrace trampolines are not RWX
# extra tests on HEAD of linux-devel/devel-catchup-201710230614
git bisect  bad b502be92f0c656835ef30a34897d2178699a7aaa  # 22:22  B     11     2    0   0  0day head guard for 'devel-catchup-201710230614'
# extra tests on tree/branch linus/master
git bisect  bad 6cff0a118f23b98c604a3604ea9de11338e24fbe  # 01:04  B    601    24    0   0  Merge tag 'platform-drivers-x86-v4.14-3' of git://git.infradead.org/linux-platform-drivers-x86
# extra tests with first bad commit reverted
git bisect good 602c4c756d28c7744f946fe6d3422835f3f3fbdb  # 06:14  G    625     0  621 621  Revert "x86/ftrace: Make sure that ftrace trampolines are not RWX"
# extra tests on tree/branch linux-next/master
git bisect  bad 36ef71cae353f88fd6e095e2aaa3e5953af1685d  # 11:22  B    596    29    0   0  Add linux-next specific files for 20171018

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/lkp                          Intel Corporation

Download attachment "dmesg-quantal-lkp-hsw01-11:20171024183016:x86_64-randconfig-s0-10221200:4.12.0-rc2-00005-g6ee98ff:1.gz" of type "application/gzip" (14686 bytes)

Download attachment "dmesg-quantal-lkp-hsw01-10:20171024184751:x86_64-randconfig-s0-10221200:4.12.0-rc2-00004-ga53276e:1.gz" of type "application/gzip" (17619 bytes)

View attachment "reproduce-quantal-lkp-hsw01-11:20171024183016:x86_64-randconfig-s0-10221200:4.12.0-rc2-00005-g6ee98ff:1" of type "text/plain" (888 bytes)

View attachment "config-4.12.0-rc2-00005-g6ee98ff" of type "text/plain" (85268 bytes)

Powered by blists - more mailing lists