linux-kernel - Re: WARNING in arch_install_hw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190327174841.GI32571@zn.tnic>
Date:   Wed, 27 Mar 2019 18:48:41 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Frederic Weisbecker <frederic@...nel.org>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+370a6b0f11867bf13515@...kaller.appspotmail.com>,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Ingo Molnar <mingo@...hat.com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        the arch/x86 maintainers <x86@...nel.org>
Subject: Re: WARNING in arch_install_hw_breakpoint

On Wed, Mar 27, 2019 at 04:17:25PM +0100, Borislav Petkov wrote:
> On Wed, Mar 27, 2019 at 02:45:24PM +0100, Dmitry Vyukov wrote:
> > And run this program:
> > https://syzkaller.appspot.com/text?tag=ReproC&x=15439f27200000
> 
> Yap, that worked in my guest, after segfaulting a lot first:
> 
> [  101.600512][ T7333] Code: Bad RIP value.
> [  101.606103][ T7337] repro[7337]: segfault at 155555585 ip 0000000155555585 sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [  101.606248][ T7338] repro[7338]: segfault at 25555554e ip 000000025555554e sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [  101.608498][ T7337] Code: Bad RIP value.
> [  101.610442][ T7338] Code: Bad RIP value.
> [  101.611417][ T7341] repro[7341]: segfault at 0 ip 0000000000000000 sp 00000000200002c8 error 14
> [  101.613342][ T7341] Code: Bad RIP value.
> [  101.613798][ T7345] repro[7345]: segfault at 0 ip 0000000000000000 sp 00000000200002c8 error 14
> [  101.614292][ T7342] repro[7342]: segfault at 45555554e ip 000000045555554e sp 00007ffff7f98f10 error 14 in repro[555555554000+1000]
> [  101.615809][ T7345] Code: Bad RIP value.
> [  101.616777][ T7348] repro[7348]: segfault at 155555585 ip 0000000155555585 sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [  101.616802][ T7348] Code: Bad RIP value.
> [  101.617733][ T7342] Code: Bad RIP value.
> [  105.321676][T11024] ------------[ cut here ]------------
> [  105.324183][T11024] Can't find any breakpoint slot
> [  105.324229][T11024] WARNING: CPU: 0 PID: 11024 at arch/x86/kernel/hw_breakpoint.c:121 arch_install_hw_breakpoint+0x2d1/0x3a0

Ok, after adding some debug output, it looks like this (newlines mine):

[  200.921625][ T8029]    repro-8029    0d..4 200923254us : arch_install_hw_breakpoint: i: 0, slot: ffff888069668080

[  200.922507][ T8029]    repro-8029    0d..4 200923257us : arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[  200.923397][ T8029]    repro-8029    0d..4 200923259us : arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40

[  200.924294][ T8029]    repro-8029    0d..4 200923262us : arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[  200.925175][ T8029]    repro-8029    0d..4 200923264us : arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40
[  200.926054][ T8029]    repro-8029    0d..4 200923266us : arch_install_hw_breakpoint: i: 2, slot: ffff8880602004c0

[  200.926933][ T8029]    repro-8029    0d..4 200923270us : arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[  200.927816][ T8029]    repro-8029    0d..4 200923271us : arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40
[  200.928695][ T8029]    repro-8029    0d..4 200923273us : arch_install_hw_breakpoint: i: 2, slot: ffff8880602004c0
[  200.929573][ T8029]    repro-8029    0d..4 200923275us : arch_install_hw_breakpoint: i: 3, slot: ffff88806991ed00

which basically shows how this thread adds 4 breakpoints and hits the
warn on on the 5th.

Now, that code I've seen only once or twice so I don't have a very smart
guess but it looks to me like arch_install_hw_breakpoint() or something
scheduling the events above that, should check HBP_NUM and not schedule
more than 4 hw breakpoints. Or..?

Frederic, I know you know this code... :-)

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.