linux-kernel - Re: general protection fault in perf_misc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200930161711.GH6810@zn.tnic>
Date:   Wed, 30 Sep 2020 18:17:11 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>,
        syzbot <syzbot+ce179bc99e64377c24bc@...kaller.appspotmail.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>, Jiri Olsa <jolsa@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Ingo Molnar <mingo@...hat.com>,
        Namhyung Kim <namhyung@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        the arch/x86 maintainers <x86@...nel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: general protection fault in perf_misc_flags

Hi,

one more thing I just spotted. The default install of syzkaller here
runs the guest with this on the kernel command line:

2020/09/30 17:56:18 running command: qemu-system-x86_64 []string{"-m", "2048",
"-smp", "2", "-display", ... "-append", "earlyprintk=serial oops=panic ...
 nmi_watchdog=panic panic_on_warn=1 panic=1 ftrace_dump_on_oops=orig_cpu rodata=n
									^^^^^^^^^^

which basically leaves guest kernel's memory RW and it gets caught
immediately on vm boot by CONFIG_DEBUG_WX.

This pretty much explains why kernel text can get corrupted with a stray
pointer write or so. So what's the use case for rodata=n?

[    2.478136] Kernel memory protection disabled.
		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[    2.478689] x86/mm: Checking user space page tables
[    2.550163] ------------[ cut here ]------------
[    2.550736] x86/mm: Found insecure W+X mapping at address entry_SYSCALL_64+0x0/0x29
[    2.551612] WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:246 note_page+0x81f/0x13a0
[    2.552577] Kernel panic - not syncing: panic_on_warn set ...
[    2.553240] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.9.0-rc7+ #5
[    2.553953] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014
[    2.554922] Call Trace:
[    2.555233]  dump_stack+0x9c/0xcf
[    2.555633]  panic+0x250/0x5a0
[    2.556004]  ? __warn_printk+0xf8/0xf8
[    2.556450]  ? console_trylock+0xb0/0xb0
[    2.556914]  ? __warn.cold+0x5/0x44
[    2.557332]  ? note_page+0x81f/0x13a0
[    2.557768]  __warn.cold+0x20/0x44
[    2.558176]  ? note_page+0x81f/0x13a0
[    2.558641]  report_bug+0x168/0x1b0
[    2.559059]  handle_bug+0x3c/0x60
[    2.559458]  exc_invalid_op+0x14/0x40
[    2.559894]  asm_exc_invalid_op+0x12/0x20
[    2.560368] RIP: 0010:note_page+0x81f/0x13a0
[    2.560870] Code: 26 00 80 3d 9a d0 7f 02 00 0f 85 82 f9 ff ff e8 47 3c 26 00 4c 89 e6 48 c7 c7 40 aff
[    2.562951] RSP: 0000:ffff88800e9f7a90 EFLAGS: 00010282
[    2.563554] RAX: 0000000000000000 RBX: ffff88800e9f7e00 RCX: 0000000000000000
[    2.564361] RDX: ffff88800e9edb80 RSI: 0000000000000004 RDI: ffffed1001d3ef44
[    2.565167] RBP: 0000000000000200 R08: 0000000000000001 R09: 0000000000000003
[    2.565973] R10: ffffed1001d3eefd R11: 0000000000000001 R12: ffffffff96e00000
[    2.566780] R13: 00000000000001e3 R14: 0000000000000000 R15: ffff88800e9f7e58
[    2.567587]  ? __kprobes_text_end+0xb3598/0xb3598
[    2.568122]  ? __entry_text_end+0x1fea85/0x1fea85
[    2.568754]  ? __entry_text_end+0x1fea85/0x1fea85
[    2.569288]  ? __entry_text_end+0x1fea85/0x1fea85
[    2.569821]  ptdump_hole+0x61/0x90
[    2.570212]  ? ptdump_pte_entry+0x100/0x100
[    2.570712]  walk_pgd_range+0xdb8/0x15f0
[    2.571178]  walk_page_range_novma+0xd9/0x140
[    2.571689]  ? walk_page_range+0x2b0/0x2b0
[    2.572171]  ? console_unlock+0x58f/0xb10
[    2.572644]  ptdump_walk_pgd+0xcd/0x180
[    2.573099]  ptdump_walk_pgd_level_core+0x13c/0x1b0
[    2.573663]  ? effective_prot+0xb0/0xb0
[    2.574117]  ? vprintk_emit+0x214/0x380
[    2.574601]  ? ptdump_walk_pgd_level_core+0x1b0/0x1b0
[    2.575186]  ? memtype_copy_nth_element+0x1a0/0x1a0
[    2.575752]  ? __kprobes_text_end+0xb3598/0xb3598
[    2.576300]  ? pti_user_pagetable_walk_pmd+0x130/0x460
[    2.576894]  ? __kprobes_text_end+0xb3598/0xb3598
[    2.577441]  ? __kprobes_text_end+0xb3598/0xb3598
[    2.577988]  ? __kprobes_text_end+0xb3598/0xb3598
[    2.578564]  ? rest_init+0xdd/0xdd
[    2.578972]  ptdump_walk_user_pgd_level_checkwx.cold+0x31/0x36
[    2.579640]  pti_finalize+0x7b/0x170
[    2.580066]  kernel_init+0x5b/0x183
[    2.580484]  ret_from_fork+0x22/0x30
[    2.581010] Dumping ftrace buffer:
[    2.581456]    (ftrace buffer empty)
ffffffffbfffffff)
[    2.583137] Rebooting in 1 seconds..
2020/09/30 17:56:23 failed to create instance: failed to read from qemu: EOF

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette