linux-kernel - Re: ppc elf_map breakage with MAP_FIXED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Jan 2018 13:45:45 +0100
From:   Michal Hocko <mhocko@...nel.org>
To:     Anshuman Khandual <khandual@...ux.vnet.ibm.com>
Cc:     Michael Ellerman <mpe@...erman.id.au>, akpm@...ux-foundation.org,
        mm-commits@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, linux-fsdevel@...r.kernel.org,
        linux-next@...r.kernel.org, sfr@...b.auug.org.au,
        broonie@...nel.org
Subject: Re: ppc elf_map breakage with MAP_FIXED_NOREPLACE

On Tue 23-01-18 16:55:18, Anshuman Khandual wrote:
> On 01/17/2018 01:37 PM, Michal Hocko wrote:
> > On Thu 11-01-18 15:38:37, Anshuman Khandual wrote:
> >> On 01/09/2018 09:43 PM, Michal Hocko wrote:
> > [...]
> >>> Did you manage to catch _who_ is requesting that anonymous mapping? Do
> >>> you need a help with the debugging patch?
> >>
> >> Not yet, will get back on this.
> > 
> > ping?
> 
> Hey Michal,
> 
> Missed this thread, my apologies. This problem is happening only with
> certain binaries like 'sed', 'tmux', 'hostname', 'pkg-config' etc. As
> you had mentioned before the map request collision is happening on
> [10030000, 10040000] and [10030000, 10040000] ranges only which is
> just a single PAGE_SIZE. You asked previously that who might have
> requested the anon mapping which is already present in there ? Would
> not that be the same process itself ? I am bit confused.

We are early in the ELF loading. If we are mapping over an existing
mapping then we are effectivelly corrupting it. In other words exactly
what this patch tries to prevent. I fail to see what would be a relevant
anon mapping this early and why it would be colliding with elf
segements.

> Would it be
> helpful to trap all the mmap() requests from any of the binaries
> and see where we might have created that anon mapping ?

Yeah, that is exactly what I was suggesting. Sorry for not being clear
about that.

-- 
Michal Hocko
SUSE Labs