| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 5 Jan 2018 14:41:04 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Guenter Roeck <linux@...ck-us.net>
Cc: linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
akpm@...ux-foundation.org, shuahkh@....samsung.com,
patches@...nelci.org, ben.hutchings@...ethink.co.uk,
lkft-triage@...ts.linaro.org, stable@...r.kernel.org,
Tao Wu <lepton@...gle.com>
Subject: Re: [PATCH 4.4 00/37] 4.4.110-stable review
On Thu, Jan 04, 2018 at 03:45:55PM -0800, Guenter Roeck wrote:
> On Wed, Jan 03, 2018 at 09:11:06PM +0100, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.4.110 release.
> > There are 37 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Fri Jan 5 19:50:38 UTC 2018.
> > Anything received after that time might be too late.
> >
>
> This is also reported to crash if loaded under qemu + haxm under windows.
> See https://www.spinics.net/lists/kernel/msg2689835.html for details.
> Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
> the same log is also seen with vanilla v4.4.110-rc1).
>
> [ 0.712750] Freeing unused kernel memory: 552K
> [ 0.721821] init: Corrupted page table at address 57b029b332e0
> [ 0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
> [ 0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
> [ 0.722761] Modules linked in:
> [ 0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
> [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
> [ 0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
> [ 0.722761] RIP: 0010:[<ffffffff83f4129e>] [<ffffffff83f4129e>] __clear_user+0x42/0x67
> [ 0.722761] RSP: 0000:ffff8800bc28fcf8 EFLAGS: 00010202
> [ 0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
> [ 0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
> [ 0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
> [ 0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
> [ 0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
> [ 0.722761] FS: 0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
> [ 0.722761] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
> [ 0.722761] Stack:
> [ 0.722761] 000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
> [ 0.722761] ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
> [ 0.722761] ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
> [ 0.722761] Call Trace:
> [ 0.722761] [<ffffffff83f4120c>] clear_user+0x2e/0x30
> [ 0.722761] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
> [ 0.722761] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
> [ 0.722761] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
> [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [ 0.722761] [<ffffffff83de40be>] do_execve+0x23/0x25
> [ 0.722761] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
> [ 0.722761] [<ffffffff844fec4d>] kernel_init+0x6d/0xda
> [ 0.722761] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
> [ 0.722761] [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [ 0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
> eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
> 48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
> [ 0.722761] RIP [<ffffffff83f4129e>] __clear_user+0x42/0x67
> [ 0.722761] RSP <ffff8800bc28fcf8>
> [ 0.722761] ---[ end trace def703879b4ff090 ]---
> [ 0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21
> [ 0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
> [ 0.722761] CPU: 1 PID: 1 Comm: init Tainted: G D 4.4.96 #31
> [ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
> [ 0.722761] 0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
> [ 0.722761] ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
> [ 0.722761] ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
> [ 0.722761] Call Trace:
> [ 0.722761] [<ffffffff83f34004>] dump_stack+0x4d/0x63
> [ 0.722761] [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c
> [ 0.722761] [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6
> [ 0.722761] [<ffffffff84502788>] down_read+0x20/0x31
> [ 0.722761] [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63
> [ 0.722761] [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16
> [ 0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
> [ 0.722761] [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c
> [ 0.802309] [<ffffffff83cac84e>] do_exit+0x39/0xe7f
> [ 0.802309] [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f
> [ 0.802309] [<ffffffff83d7bb95>] ? printk+0x57/0x73
> [ 0.802309] [<ffffffff83c46e25>] oops_end+0x80/0x85
> [ 0.802309] [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95
> [ 0.802309] [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352
> [ 0.802309] [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5
> [ 0.802309] [<ffffffff83ca821c>] do_page_fault+0xc/0xe
> [ 0.802309] [<ffffffff84507682>] page_fault+0x22/0x30
> [ 0.802309] [<ffffffff83f4129e>] ? __clear_user+0x42/0x67
> [ 0.802309] [<ffffffff83f4127f>] ? __clear_user+0x23/0x67
> [ 0.802309] [<ffffffff83f4120c>] clear_user+0x2e/0x30
> [ 0.802309] [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
> [ 0.802309] [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
> [ 0.802309] [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
> [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [ 0.802309] [<ffffffff83de40be>] do_execve+0x23/0x25
> [ 0.802309] [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
> [ 0.802309] [<ffffffff844fec4d>] kernel_init+0x6d/0xda
> [ 0.802309] [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
> [ 0.802309] [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [ 0.830559] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
> [ 0.830559]
> [ 0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> [ 0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
>
> The crash part of this problem may be solved with the following patch
> (thanks to Hugh for the hint). There is still another problem, though -
> with this patch applied, the qemu session aborts with "VCPU Shutdown
> request", whatever that means.
>
> Guenter
>
> ---
> From: Guenter Roeck <groeck@...omium.org>
> Date: Thu, 4 Jan 2018 13:41:55 -0800
> Subject: [PATCH 2/2] WIP: kaiser: Set _PAGE_NX only if supported
>
> Change-Id: Ie6ab566c1d725b24c4b3aa80a47c3ff3a5feddb9
> Signed-off-by: Guenter Roeck <groeck@...omium.org>
> ---
> arch/x86/mm/kaiser.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
> index 7d2f7eb6857f..e4706273d4a1 100644
> --- a/arch/x86/mm/kaiser.c
> +++ b/arch/x86/mm/kaiser.c
> @@ -421,7 +421,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
> * get out to userspace running on the kernel CR3,
> * userspace will crash instead of running.
> */
> - pgd.pgd |= _PAGE_NX;
> + if (__supported_pte_mask & _PAGE_NX)
> + pgd.pgd |= _PAGE_NX;
> }
> } else if (!pgd.pgd) {
> /*
Very good catch, this mirrors almost what is in 4.14 in this area. I'll
go queue this up for 4.9 and 4.4 stable trees.
thanks,
greg k-h
Powered by blists - more mailing lists