linux-kernel - kprobe: kernel panic in 4.19.47

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 07 Jun 2019 16:54:37 -0700
From:   fruggeri@...sta.com (Francesco Ruggeri)
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        gregkh@...uxfoundation.org, fruggeri@...sta.com, namit@...are.com
Subject: kprobe: kernel panic in 4.19.47

I see the following kernel panic in 4.19.47 as soon as I hit a kprobe.
In this case it happened right after

# cd /sys/kernel/debug/tracing/
# echo >trace
# echo 'p rollback_registered_many' >kprobe_events 
# echo 1 >events/kprobes/enable 
# ip netns add dummy
# ip netns del dummy

but I have also seen it with other functions, or when I used kernel modules
to install kprobes.
I bisected to 

8715ce033e [ "x86/modules: Avoid breaking W^X while loading modules" ]

in 4.19.47 (upstream commit f2c65fb322 in v5.2-rc1).

Thanks,
Francesco

[  151.067082] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[  151.074631] BUG: unable to handle kernel paging request at ffffffffa000f000
[  151.081661] PGD 200a067 P4D 200a067 PUD 200b063 PMD 1038324067 PTE 800000101cb73161
[  151.089396] Oops: 0011 [#1] SMP
[  151.092603] CPU: 12 PID: 1831 Comm: kworker/u64:1 Kdump: loaded Not tainted 4.19.47-12345018.AroraKernel419.fc18.x86_64 #1
[  151.103696] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013
[  151.110298] Workqueue: netns cleanup_net
[  151.114297] RIP: 0010:0xffffffffa000f000
[  151.118286] Code: Bad RIP value.
[  151.121562] RSP: 0018:ffffc90007947d60 EFLAGS: 00010206
[  151.126835] RAX: ffff88901cbf8070 RBX: ffffc90007947d88 RCX: ffff88901cbf8070
[  151.134033] RDX: ffffc90007947d88 RSI: ffffc90007947d88 RDI: ffffc90007947d88
[  151.141226] RBP: ffffc90007947d78 R08: 0000000000000001 R09: 0000000000020cc0
[  151.148429] R10: ffffc900063ebe08 R11: 0000000000026cdc R12: ffffc90007947d88
[  151.155630] R13: ffffc90007947e38 R14: ffff88901cbc8110 R15: ffffc90007947e10
[  151.162817] FS:  0000000000000000(0000) GS:ffff88a03f900000(0000) knlGS:0000000000000000
[  151.170964] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  151.176986] CR2: ffffffffa000efd6 CR3: 0000000002009006 CR4: 00000000000606e0
[  151.184403] Call Trace:
[  151.187150]  ? rollback_registered_many+0x5/0x3bc
[  151.192123]  ? unregister_netdevice_many+0x1a/0x79
[  151.197177]  default_device_exit_batch+0x137/0x15f
[  151.202231]  ? __wake_up_sync+0x12/0x12
[  151.206345]  ops_exit_list+0x29/0x53
[  151.210181]  cleanup_net+0x189/0x240
[  151.214030]  process_one_work+0x174/0x280
[  151.218319]  ? rescuer_thread+0x277/0x277
[  151.222610]  worker_thread+0x1b5/0x264
[  151.226639]  ? rescuer_thread+0x277/0x277
[  151.230922]  kthread+0xf5/0xfa
[  151.234239]  ? kthread_cancel_delayed_work_sync+0x15/0x15
[  151.239906]  ret_from_fork+0x1f/0x30
[  151.243751] Modules linked in: ipt_MASQUERADE nf_conntrack_netlink iptable_filter xt_addrtype xt_conntrack br_netfilter bridge stp llc macvlan sg coretemp x86_pkg_temp_thermal ip6table_filter ip6_tables ghash_clmulni_intel pcbc bonding aesni_intel kvm_intel aes_x86_64 crypto_simd kvm igb cryptd irqbypass glue_helper iTCO_wdt ioatdma iTCO_vendor_support hwmon joydev i2c_i801 i2c_algo_bit ipmi_si i2c_core pcc_cpufreq lpc_ich mfd_core ipmi_msghandler fuse dca pcspkr xt_multiport iptable_nat nf_nat_ipv4 ip_tables nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 x_tables tun loop 8021q raid456 async_raid6_recov async_memcpy libcrc32c async_pq async_xor xor async_tx raid6_pq raid1 raid0 isci libsas ehci_pci crc32c_intel ehci_hcd scsi_transport_sas wmi autofs4
[  151.312827] CR2: ffffffffa000f000