linux-kernel - kernel oops loading i915 after "x86/asm: Pin sensitive CR4 bits" (873d50d58)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e5baec48e5c362256a631a2d55fbc30251ab5e83.camel@mengyan1223.wang>
Date:   Wed, 10 Jul 2019 13:44:17 +0800
From:   Xi Ruoyao <xry111@...gyan1223.wang>
To:     Kees Cook <keescook@...omium.org>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        David Airlie <airlied@...ux.ie>, Jessica Yu <jeyu@...nel.org>
Cc:     kernel-hardening@...ts.openwall.com,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-modules@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: kernel oops loading i915 after "x86/asm: Pin sensitive CR4 bits"
 (873d50d58)

Hello,

When I try to build and run the latest mainline kernel, it Oops loading i915
module:

BUG: unable to handle page fault for address: ffffffff9edc1598
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
PGD 1a20c067 P4D 1a20c067 PUD 1a20d063 PMD 8000000019e000e1 
Oops: 0003 [#1] SMP PTI

The complete log is attached.

Bisection tells "x86/asm: Pin sensitive CR4 bits" (873d50d58) is the first "bad"
commit.  I can revert it and also "x86/asm: Pin sensitive CR0 bits" (8dbec27a2)
to make the kernel "seems to" work.

I'm not a kernel expert so I can't tell if there is a bug in Kees' patch, or his
patch exploits a bug in i915 or module loader.

My CPU is an i3-3217u.  If a kdump is helpful I'll try to gather it.
-- 
Xi Ruoyao <xry111@...gyan1223.wang>
School of Aerospace Science and Technology, Xidian University

View attachment "log" of type "text/plain" (5196 bytes)