linux-kernel - Re: bug disabling NX (noexec=off)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 14 Apr 2019 23:26:04 +0200
From:   Xose Vazquez Perez <xose.vazquez@...il.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>, x86 team <x86@...nel.org>
Subject: Re: bug disabling NX (noexec=off)

On 4/14/19 11:59 AM, Thomas Gleixner wrote:
> On Sat, 13 Apr 2019, Xose Vazquez Perez wrote:
>> [    0.000000] NX (Execute Disable) protection: disabled by kernel command line option
>> [    0.000000] ------------[ cut here ]------------
>> [    0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
> 
> Does the below patch fix it for you?
> 
> Thanks,
> 
> 	tglx
> 
> 8<----------------
> diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
> index 0029604af8a4..dd73d5d74393 100644
> --- a/arch/x86/mm/ioremap.c
> +++ b/arch/x86/mm/ioremap.c
> @@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
>  	pte = early_ioremap_pte(addr);
>  
>  	/* Sanitize 'prot' against any unsupported bits: */
> -	pgprot_val(flags) &= __default_kernel_pte_mask;
> +	pgprot_val(flags) &= __supported_pte_mask;
>  
>  	if (pgprot_val(flags))
>  		set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
> 

Yes, it fixed it.


But there is another bug that I did not see before, but it was there:

---cut dmesg---
Freeing unused kernel image memory: 76K
------------[ cut here ]------------
x86/mm: Found insecure W+X mapping at address 0xffff9df500000000
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.0.7-300.fc30.x86_64 #1
Hardware name: Hewlett-Packard p6-2004es/2ABF, BIOS 7.16 03/23/2012
RIP: 0010:note_page+0x2ae/0x650
Code: 29 f0 48 c1 e8 0c 48 01 43 40 80 3d 54 15 2c 01 00 0f 85 07 ff ff ff 48 c7 c7 a0 d9 0a b7 c6 05 40 15 2c 01 01 e8 41 2d 06 00 <0f> 0b 4c 8b 4b 20 e9 e9 fe ff ff 48 29 d6 84 c9 0f 85 71 09 00 00
RSP: 0018:ffffb35940c63e18 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffb35940c63ec8 RCX: 0000000000000050
RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000247
RBP: 0000000000000161 R08: 0000000000000001 R09: 00000000000002ca
R10: 000000000000e844 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff9df737280000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2e235a8a88 CR3: 000000012b20e002 CR4: 00000000000606e0
Call Trace:
 ? vprintk_emit+0x1ec/0x250
 ptdump_walk_pgd_level_core+0x46a/0x4c0
 ? rest_init+0xaa/0xaa
 kernel_init+0x2c/0x106
 ret_from_fork+0x1f/0x40
---[ end trace 3288a26b9a3da7ee ]---
x86/mm: Checked W+X mappings: FAILED, 2175454 W+X pages found.
rodata_test: all tests were successful
Run /init as init process
---cut dmesg---


Thank you.