| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190607235437.CFF3F95C0244@us180.sjc.aristanetworks.com>
Date: Fri, 07 Jun 2019 16:54:37 -0700
From: fruggeri@...sta.com (Francesco Ruggeri)
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
gregkh@...uxfoundation.org, fruggeri@...sta.com, namit@...are.com
Subject: kprobe: kernel panic in 4.19.47
I see the following kernel panic in 4.19.47 as soon as I hit a kprobe.
In this case it happened right after
# cd /sys/kernel/debug/tracing/
# echo >trace
# echo 'p rollback_registered_many' >kprobe_events
# echo 1 >events/kprobes/enable
# ip netns add dummy
# ip netns del dummy
but I have also seen it with other functions, or when I used kernel modules
to install kprobes.
I bisected to
8715ce033e [ "x86/modules: Avoid breaking W^X while loading modules" ]
in 4.19.47 (upstream commit f2c65fb322 in v5.2-rc1).
Thanks,
Francesco
[ 151.067082] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[ 151.074631] BUG: unable to handle kernel paging request at ffffffffa000f000
[ 151.081661] PGD 200a067 P4D 200a067 PUD 200b063 PMD 1038324067 PTE 800000101cb73161
[ 151.089396] Oops: 0011 [#1] SMP
[ 151.092603] CPU: 12 PID: 1831 Comm: kworker/u64:1 Kdump: loaded Not tainted 4.19.47-12345018.AroraKernel419.fc18.x86_64 #1
[ 151.103696] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013
[ 151.110298] Workqueue: netns cleanup_net
[ 151.114297] RIP: 0010:0xffffffffa000f000
[ 151.118286] Code: Bad RIP value.
[ 151.121562] RSP: 0018:ffffc90007947d60 EFLAGS: 00010206
[ 151.126835] RAX: ffff88901cbf8070 RBX: ffffc90007947d88 RCX: ffff88901cbf8070
[ 151.134033] RDX: ffffc90007947d88 RSI: ffffc90007947d88 RDI: ffffc90007947d88
[ 151.141226] RBP: ffffc90007947d78 R08: 0000000000000001 R09: 0000000000020cc0
[ 151.148429] R10: ffffc900063ebe08 R11: 0000000000026cdc R12: ffffc90007947d88
[ 151.155630] R13: ffffc90007947e38 R14: ffff88901cbc8110 R15: ffffc90007947e10
[ 151.162817] FS: 0000000000000000(0000) GS:ffff88a03f900000(0000) knlGS:0000000000000000
[ 151.170964] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 151.176986] CR2: ffffffffa000efd6 CR3: 0000000002009006 CR4: 00000000000606e0
[ 151.184403] Call Trace:
[ 151.187150] ? rollback_registered_many+0x5/0x3bc
[ 151.192123] ? unregister_netdevice_many+0x1a/0x79
[ 151.197177] default_device_exit_batch+0x137/0x15f
[ 151.202231] ? __wake_up_sync+0x12/0x12
[ 151.206345] ops_exit_list+0x29/0x53
[ 151.210181] cleanup_net+0x189/0x240
[ 151.214030] process_one_work+0x174/0x280
[ 151.218319] ? rescuer_thread+0x277/0x277
[ 151.222610] worker_thread+0x1b5/0x264
[ 151.226639] ? rescuer_thread+0x277/0x277
[ 151.230922] kthread+0xf5/0xfa
[ 151.234239] ? kthread_cancel_delayed_work_sync+0x15/0x15
[ 151.239906] ret_from_fork+0x1f/0x30
[ 151.243751] Modules linked in: ipt_MASQUERADE nf_conntrack_netlink iptable_filter xt_addrtype xt_conntrack br_netfilter bridge stp llc macvlan sg coretemp x86_pkg_temp_thermal ip6table_filter ip6_tables ghash_clmulni_intel pcbc bonding aesni_intel kvm_intel aes_x86_64 crypto_simd kvm igb cryptd irqbypass glue_helper iTCO_wdt ioatdma iTCO_vendor_support hwmon joydev i2c_i801 i2c_algo_bit ipmi_si i2c_core pcc_cpufreq lpc_ich mfd_core ipmi_msghandler fuse dca pcspkr xt_multiport iptable_nat nf_nat_ipv4 ip_tables nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 x_tables tun loop 8021q raid456 async_raid6_recov async_memcpy libcrc32c async_pq async_xor xor async_tx raid6_pq raid1 raid0 isci libsas ehci_pci crc32c_intel ehci_hcd scsi_transport_sas wmi autofs4
[ 151.312827] CR2: ffffffffa000f000
Powered by blists - more mailing lists