linux-kernel - Re: general protection fault in perf_misc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 30 Sep 2020 18:23:44 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>,
        syzbot <syzbot+ce179bc99e64377c24bc@...kaller.appspotmail.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>, Jiri Olsa <jolsa@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Ingo Molnar <mingo@...hat.com>,
        Namhyung Kim <namhyung@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: general protection fault in perf_misc_flags

On Wed, Sep 30, 2020 at 6:17 PM Borislav Petkov <bp@...en8.de> wrote:
>
> Hi,
>
> one more thing I just spotted. The default install of syzkaller here
> runs the guest with this on the kernel command line:
>
> 2020/09/30 17:56:18 running command: qemu-system-x86_64 []string{"-m", "2048",
> "-smp", "2", "-display", ... "-append", "earlyprintk=serial oops=panic ...
>  nmi_watchdog=panic panic_on_warn=1 panic=1 ftrace_dump_on_oops=orig_cpu rodata=n
>                                                                         ^^^^^^^^^^
>
> which basically leaves guest kernel's memory RW and it gets caught
> immediately on vm boot by CONFIG_DEBUG_WX.
>
> This pretty much explains why kernel text can get corrupted with a stray
> pointer write or so. So what's the use case for rodata=n?
>
> [    2.478136] Kernel memory protection disabled.
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


Ha!

Here is the answer:
https://github.com/google/syzkaller/blob/master/tools/create-gce-image.sh#L189

# rodata=n: mark_rodata_ro becomes very slow with KASAN (lots of PGDs)

I have some vague memory that there was some debug double checking
that pages are indeed read-only and that debug check was slow, but it
was always executed without rodata=n.

> [    2.478689] x86/mm: Checking user space page tables
> [    2.550163] ------------[ cut here ]------------
> [    2.550736] x86/mm: Found insecure W+X mapping at address entry_SYSCALL_64+0x0/0x29
> [    2.551612] WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:246 note_page+0x81f/0x13a0
> [    2.552577] Kernel panic - not syncing: panic_on_warn set ...
> [    2.553240] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.9.0-rc7+ #5
> [    2.553953] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014
> [    2.554922] Call Trace:
> [    2.555233]  dump_stack+0x9c/0xcf
> [    2.555633]  panic+0x250/0x5a0
> [    2.556004]  ? __warn_printk+0xf8/0xf8
> [    2.556450]  ? console_trylock+0xb0/0xb0
> [    2.556914]  ? __warn.cold+0x5/0x44
> [    2.557332]  ? note_page+0x81f/0x13a0
> [    2.557768]  __warn.cold+0x20/0x44
> [    2.558176]  ? note_page+0x81f/0x13a0
> [    2.558641]  report_bug+0x168/0x1b0
> [    2.559059]  handle_bug+0x3c/0x60
> [    2.559458]  exc_invalid_op+0x14/0x40
> [    2.559894]  asm_exc_invalid_op+0x12/0x20
> [    2.560368] RIP: 0010:note_page+0x81f/0x13a0
> [    2.560870] Code: 26 00 80 3d 9a d0 7f 02 00 0f 85 82 f9 ff ff e8 47 3c 26 00 4c 89 e6 48 c7 c7 40 aff
> [    2.562951] RSP: 0000:ffff88800e9f7a90 EFLAGS: 00010282
> [    2.563554] RAX: 0000000000000000 RBX: ffff88800e9f7e00 RCX: 0000000000000000
> [    2.564361] RDX: ffff88800e9edb80 RSI: 0000000000000004 RDI: ffffed1001d3ef44
> [    2.565167] RBP: 0000000000000200 R08: 0000000000000001 R09: 0000000000000003
> [    2.565973] R10: ffffed1001d3eefd R11: 0000000000000001 R12: ffffffff96e00000
> [    2.566780] R13: 00000000000001e3 R14: 0000000000000000 R15: ffff88800e9f7e58
> [    2.567587]  ? __kprobes_text_end+0xb3598/0xb3598
> [    2.568122]  ? __entry_text_end+0x1fea85/0x1fea85
> [    2.568754]  ? __entry_text_end+0x1fea85/0x1fea85
> [    2.569288]  ? __entry_text_end+0x1fea85/0x1fea85
> [    2.569821]  ptdump_hole+0x61/0x90
> [    2.570212]  ? ptdump_pte_entry+0x100/0x100
> [    2.570712]  walk_pgd_range+0xdb8/0x15f0
> [    2.571178]  walk_page_range_novma+0xd9/0x140
> [    2.571689]  ? walk_page_range+0x2b0/0x2b0
> [    2.572171]  ? console_unlock+0x58f/0xb10
> [    2.572644]  ptdump_walk_pgd+0xcd/0x180
> [    2.573099]  ptdump_walk_pgd_level_core+0x13c/0x1b0
> [    2.573663]  ? effective_prot+0xb0/0xb0
> [    2.574117]  ? vprintk_emit+0x214/0x380
> [    2.574601]  ? ptdump_walk_pgd_level_core+0x1b0/0x1b0
> [    2.575186]  ? memtype_copy_nth_element+0x1a0/0x1a0
> [    2.575752]  ? __kprobes_text_end+0xb3598/0xb3598
> [    2.576300]  ? pti_user_pagetable_walk_pmd+0x130/0x460
> [    2.576894]  ? __kprobes_text_end+0xb3598/0xb3598
> [    2.577441]  ? __kprobes_text_end+0xb3598/0xb3598
> [    2.577988]  ? __kprobes_text_end+0xb3598/0xb3598
> [    2.578564]  ? rest_init+0xdd/0xdd
> [    2.578972]  ptdump_walk_user_pgd_level_checkwx.cold+0x31/0x36
> [    2.579640]  pti_finalize+0x7b/0x170
> [    2.580066]  kernel_init+0x5b/0x183
> [    2.580484]  ret_from_fork+0x22/0x30
> [    2.581010] Dumping ftrace buffer:
> [    2.581456]    (ftrace buffer empty)
> ffffffffbfffffff)
> [    2.583137] Rebooting in 1 seconds..
> 2020/09/30 17:56:23 failed to create instance: failed to read from qemu: EOF
>
> --
> Regards/Gruss,
>     Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette