linux-kernel - Re: Wrong module .text address in 4.16.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 16 Apr 2018 13:41:02 +0200
From:   Thomas-Mich Richter <tmricht@...ux.ibm.com>
To:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     Martin Schwidefsky <schwidefsky@...ibm.com>,
        Hendrik Brueckner <brueckner@...ux.vnet.ibm.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jessica Yu <jeyu@...nel.org>
Subject: Re: Wrong module .text address in 4.16.0

On 04/16/2018 08:23 AM, Christian Borntraeger wrote:
> FWIW, this breaks at least perf capability to resolve module symbols.
> Adding some more CCs for perf and module.
> 
> 
> On 04/16/2018 07:51 AM, Thomas-Mich Richter wrote:
>> I just installed 4.16.0 and discovered the module .text address is
>> wrong. It happens on s390 and x86 platforms. I have not tested others.
>>
>> Here is the issue, I have used module qeth_l2 on s390 which is the
>> ethernet device driver:
>>
>> root@...lp76 ~]# lsmod
>> Module                  Size  Used by
>> qeth_l2                94208  1
>> ...
>>
>> [root@...lp76 ~]# cat /proc/modules | egrep '^qeth_l2'
>> qeth_l2 94208 1 - Live 0x000003ff80401000   <---- This is the correct address in memory
>> [root@...lp76 ~]# cat /sys/module/qeth_l2/sections/.text 
>> 0x0000000018ea8363      <---- This is the wrong address
>> [root@...lp76 ~]# 
>>
>> File /sys/module/qeth_l2/sections/.text displays a very strange
>> address which is definitely wrong. It should be something like
>> 0x000003ff80401xxx.
>>
>> Same on x86.
>>
>> I have checked file kernel/module.c function add_sect_attrs()
>> and it calls module_sect_show() when the sysfs file is read.
>> And module_sect_show() uses 
>>
>>   sprintf(buf, "0x%pK\n", (void *)sattr->address);
>>
>> and my sysctl setting should be correct:
>> [root@...lp76 linux]# sysctl -a | fgrep kernel.kptr_restrict
>> kernel.kptr_restrict = 0
>> [root@...lp76 linux]#
>>
>> I wonder if somebody else has seen this issue?
>> Ideas how to fix this?
>>
>> Thanks
>>

This new behavior actually break perf report/record/top on s390 for
module address resolution. On s390 each module .text segment actually
start at some offset after the module load addess shown with
/proc/modules. That is the reason why we need 
/sys/module/<module-name>/sections/.text to get the actual
.text segment start address.

-- 
Thomas Richter, Dept 3303, IBM LTC Boeblingen Germany
--
Vorsitzende des Aufsichtsrats: Martina Koederitz 
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294