linux-kernel - ppc elf_map breakage with MAP_FIXED_NOREPLACE (was: Re: mmotm 2018-01-04-16-19 uploaded)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 7 Jan 2018 10:02:29 +0100
From:   Michal Hocko <mhocko@...nel.org>
To:     Anshuman Khandual <khandual@...ux.vnet.ibm.com>
Cc:     akpm@...ux-foundation.org, mm-commits@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        linux-fsdevel@...r.kernel.org, linux-next@...r.kernel.org,
        sfr@...b.auug.org.au, broonie@...nel.org
Subject: ppc elf_map breakage with MAP_FIXED_NOREPLACE (was: Re: mmotm
 2018-01-04-16-19 uploaded)

On Sun 07-01-18 12:19:32, Anshuman Khandual wrote:
> On 01/05/2018 02:16 PM, Michal Hocko wrote:
[...]
> > Could you give us more information about the failure please. Debugging
> > patch from http://lkml.kernel.org/r/20171218091302.GL16951@dhcp22.suse.cz
> > should help to see what is the clashing VMA.
> 
> Seems like its re-requesting the same mapping again.

It always seems to be the same mapping which is a bit strange as we
have multiple binaries here. Are these binaries any special? Does this
happen to all bianries (except for init which has obviously started
successfully)? Could you add an additional debugging (at the do_mmap
layer) to see who is requesting the mapping for the first time?

> [   23.423642] 9148 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   23.423706] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon

I also find it a bit unexpected that this is an anonymous mapping
because the elf loader should always map a file backed one.

> [   23.426089] 9151 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   23.426232] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon
> [   23.429048] 9154 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   23.429196] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon
> [   23.482766] 9164 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   23.482904] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon
> [   23.485849] 9167 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   23.485945] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon
> [   76.041836] 9262 (hostname): Uhuuh, elf segment at 0000000010020000 requested but the memory is mapped already
> [   76.041965] requested [10020000, 10030000] mapped [10020000, 10030000] 100073 anon
> [   76.207197] 9285 (pkg-config): Uhuuh, elf segment at 0000000010020000 requested but the memory is mapped already
> [   76.207326] requested [10020000, 10030000] mapped [10020000, 10030000] 100073 anon
> [   76.371073] 9299 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
> [   76.371165] requested [10030000, 10040000] mapped [10030000, 10040000] 100073 anon
> 
> 
> I have fixed/changed the debug patch a bit
> 
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index d8c5657..a43eccaa 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -372,11 +372,35 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
>         } else
>                 map_addr = vm_mmap(filep, addr, size, prot, type, off);
> 
> -       if ((type & MAP_FIXED_NOREPLACE) && BAD_ADDR(map_addr))
> +       if ((type & MAP_FIXED_NOREPLACE) && BAD_ADDR(map_addr)) {
> +               struct vm_area_struct *vma;
> +               unsigned long end;
> +
> +               if (total_size)
> +                       end = addr + total_size;
> +               else
> +                       end = addr + size;
> +
>                 pr_info("%d (%s): Uhuuh, elf segment at %p requested but the memory is mapped already\n",
>                                 task_pid_nr(current), current->comm,
>                                 (void *)addr);
> 
> +               vma = find_vma(current->mm, addr);
> +               if (vma && vma->vm_start <= addr) {
> +                       pr_info("requested [%lx, %lx] mapped [%lx, %lx] %lx ", addr, end,
> +                                       vma->vm_start, vma->vm_end, vma->vm_flags);
> +                       if (!vma->vm_file) {
> +                               pr_cont("anon\n");
> +                       } else {
> +                               char path[512];
> +                               char *p = file_path(vma->vm_file, path, sizeof(path));
> +                               if (IS_ERR(p))
> +                                       p = "?";
> +                               pr_cont("\"%s\"\n", kbasename(p));
> +                       }
> +                       dump_stack();
> +               }
> +       }
>         return(map_addr);
>  }
> 
> 
> 

-- 
Michal Hocko
SUSE Labs