linux-kernel - Re: [PATCH] ARM: fix race in for_each

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191113032554.21034-1-mark-pk.tsai@mediatek.com>
Date:   Wed, 13 Nov 2019 11:25:54 +0800
From:   Mark-PK Tsai <mark-pk.tsai@...iatek.com>
To:     <lvqiang.huang@...soc.com>
CC:     <alix.wu@...iatek.com>, <allison@...utok.net>,
        <eddy.lin@...iatek.com>, <enlai.chu@...soc.com>,
        <gregkh@...uxfoundation.org>, <info@...ux.net>,
        <kstewart@...uxfoundation.org>,
        <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>, <linux@...linux.org.uk>,
        <mark-pk.tsai@...iatek.com>, <matthias.bgg@...il.com>,
        <mike-sl.lin@...iatek.com>, <phil.chang@...iatek.com>,
        <tglx@...utronix.de>, <yj.chiang@...iatek.com>
Subject: Re: [PATCH] ARM: fix race in for_each_frame

> Dear Mark,
> Thanks a lot for the reply. 
> 
> As said in last reply, sv_pc can be a module text, then more check needed.

If sv_pc is in module text area, kernel_text_address() returns true.

> 
> And beside crash at 1003, we may also get crash at 1001, the frame is invalid. (The last sv_pv is valid and sv_frame is invalid), then more check needed. 

There's a basic check for sv_fp at the end of 1004.
But I'm not sure is it enough to prevent the 1001 crash you mentioned.
Should we add a verify_stack for sv_fp?

> 
> And we often show_data around the general proposal registers when kernel crash. When they contain an address mapping for a hw register but cant access because clock gated, it will crash again because do_bad() is involved. (continuous crash in arm and hang at die_lock in arm64)
> 
> So, why not check the __ex_table in do_bad() ?
> 

On our arm platform, kernel just die becuase the Unhandled fault in for_each_frame.
So I'd rather to fix it before the continuous crash happen.