linux-kernel - Re: [PATCH] arm64: defconfig: update and enable CONFIG_RANDOMIZE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 25 Jun 2019 16:39:19 +0100
From:   Catalin Marinas <catalin.marinas@....com>
To:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc:     Will Deacon <will@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Kees Cook <keescook@...gle.com>,
        Sami Tolvanen <samitolvanen@...gle.com>,
        Jeffrey Vander Stoep <jeffv@...gle.com>,
        Mark Rutland <mark.rutland@....com>,
        Enric Balletbo i Serra <enric.balletbo@...labora.com>,
        Arnd Bergmann <arnd@...db.de>,
        Maxime Ripard <maxime.ripard@...tlin.com>,
        Will Deacon <will.deacon@....com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Dinh Nguyen <dinguyen@...nel.org>,
        Mark Brown <broonie@...nel.org>,
        Jagan Teki <jagan@...rulasolutions.com>,
        Olof Johansson <olof@...om.net>,
        Shawn Guo <shawnguo@...nel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH] arm64: defconfig: update and enable CONFIG_RANDOMIZE_BASE

On Mon, Jun 24, 2019 at 12:06:18PM +0200, Ard Biesheuvel wrote:
> On Mon, 24 Jun 2019 at 11:57, Will Deacon <will@...nel.org> wrote:
> > Thanks for having a look. It could be that we've fixed the issue Catalin was
> > running into in the past -- he was going to see if the problem persists with
> > mainline, since it was frequent enough that it was causing us to ignore the
> > results from our testing infrastructure when RANDOMIZE_BASE=y.
> 
> I had no idea this was the case. I can look into it if we are still
> seeing failures.

I've seen the panic below with 5.2-rc1, defconfig + RANDOMIZE_BASE=y in
a guest on TX2. It takes a few tries to trigger just with kaslr,
enabling lots of other DEBUG_* options makes the failures more
deterministic. I can't really say it's kaslr's fault here, only that I
used to consistently get it in this configuration. For some reason, I
can no longer reproduce it on arm64 for-next/core (or maybe it just
takes more tries and my script doesn't catch this).

The fault is in the ip_tables module, the __this_cpu_read in
xt_write_recseq_begin() inlined in ipt_do_table(). The disassembled
sequence in my build:

0000000000000188 <ipt_do_table>:
...
     258:       d538d080        mrs     x0, tpidr_el1
     25c:       aa1303f9        mov     x25, x19
     260:       b8606b34        ldr     w20, [x25, x0]

# modprobe iptable_filter
[   45.618896] Unable to handle kernel paging request at virtual address ffffeda0ffbe1388
[   45.620545] Mem abort info:
[   45.621035]   ESR = 0x96000005
[   45.621559]   Exception class = DABT (current EL), IL = 32 bits
[   45.622527]   SET = 0, FnV = 0
[   45.623032]   EA = 0, S1PTW = 0
[   45.623684] Data abort info:
[   45.624192]   ISV = 0, ISS = 0x00000005
[   45.624849]   CM = 0, WnR = 0
[   45.625361] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000026cb760e
[   45.626537] [ffffeda0ffbe1388] pgd=00000000bfffa003, pud=0000000000000000
[   45.627864] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[   45.628844] Modules linked in: iptable_filter cfg80211 rfkill 8021q garp crct10dif_ce stp mrp llc ip_tables x_tables ipv6
[   45.630700] Process kworker/u8:5 (pid: 173, stack limit = 0x0000000047fc7e17)
[   45.632056] CPU: 3 PID: 173 Comm: kworker/u8:5 Not tainted 5.2.0-rc1 #1
[   45.633377] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[   45.634752] Workqueue: rpciod rpc_async_schedule
[   45.635684] pstate: 80400005 (Nzcv daif +PAN -UAO)
[   45.636674] pc : ipt_do_table+0xd8/0x4b8 [ip_tables]
[   45.637686] lr : ipt_do_table+0xc4/0x4b8 [ip_tables]
[   45.638685] sp : ffff000010aa35a0
[   45.639358] x29: ffff000010aa35a0 x28: ffffeda1f7eb0ce8
[   45.640424] x27: ffffeda1e69f1380 x26: ffff5d2c2314a288
[   45.641493] x25: ffff5d2c0cfbf388 x24: ffffeda1fb5a9000
[   45.642556] x23: ffff5d2c2314a220 x22: 0000000000000003
[   45.643636] x21: ffffeda1f79c15d8 x20: ffffeda1e69f1780
[   45.644727] x19: ffff5d2c0cfbf388 x18: 0000000000000000
[   45.645814] x17: 0000000000000000 x16: ffff5d2d0bc16d78
[   45.646908] x15: 0000000000000000 x14: 0900000017ea6502
[   45.647994] x13: 014a023b4751727f x12: 0000000000002238
[   45.649060] x11: ffff5d2d0e0de000 x10: 0000000000004000
[   45.650117] x9 : 000000000000000e x8 : ffffeda1fb5a9000
[   45.651178] x7 : ffffeda1f7eb0c00 x6 : 00000000000000e8
[   45.652263] x5 : 0000000000000080 x4 : 00009074f2c22000
[   45.653286] x3 : 0000000000000200 x2 : ffffeda1fc41c440
[   45.654314] x1 : ffff5d2c2314a000 x0 : 00009074f2c22000
[   45.655382] Call trace:
[   45.655896]  ipt_do_table+0xd8/0x4b8 [ip_tables]
[   45.656825]  iptable_filter_hook+0x1c/0x28 [iptable_filter]
[   45.657938]  nf_hook_slow+0x44/0xe8
[   45.658647]  __ip_local_out+0x150/0x250
[   45.659421]  ip_local_out+0x20/0x80
[   45.660142]  __ip_queue_xmit+0x1b0/0x540
[   45.660937]  ip_queue_xmit+0x10/0x18
[   45.661661]  __tcp_transmit_skb+0x50c/0xad8
[   45.662494]  tcp_write_xmit+0x6cc/0x1010
[   45.663294]  __tcp_push_pending_frames+0x38/0xc0
[   45.664236]  tcp_push+0x150/0x170
[   45.664912]  tcp_sendmsg_locked+0xaa0/0xc40
[   45.665754]  tcp_sendmsg+0x34/0x58
[   45.666442]  inet_sendmsg+0x48/0x210
[   45.667175]  sock_sendmsg+0x18/0x30
[   45.667889]  xs_sendpages+0xfc/0x2d8
[   45.668610]  xs_tcp_send_request+0x9c/0x1b0
[   45.669454]  xprt_transmit+0x100/0x5b8
[   45.670210]  call_transmit+0x8c/0xa0
[   45.670938]  __rpc_execute+0xbc/0x580
[   45.671687]  rpc_async_schedule+0x28/0x48
[   45.672493]  process_one_work+0x244/0x680
[   45.673306]  worker_thread+0x40/0x3f0
[   45.674053]  kthread+0x128/0x130
[   45.674710]  ret_from_fork+0x10/0x18
[   45.675436] Code: b0f4f3d3 910e2273 d538d080 aa1303f9 (b8606b34)
[   45.676665] ---[ end trace 9d1f75fe6e41c0d7 ]---
[   45.677590] Kernel panic - not syncing: Fatal exception in interrupt
[   45.678851] SMP: stopping secondary CPUs
[   45.679670] Kernel Offset: 0x5d2cfb600000 from 0xffff000010000000
[   45.680882] PHYS_OFFSET: 0xffff925ec0000000
[   45.681727] CPU features: 0x002,23800438
[   45.682518] Memory Limit: none
[   45.683143] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

-- 
Catalin