linux-kernel - Re: [PATCH v2] x86/dumpstack: Fix misleading instruction pointer error message

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201103125034.GA30391@redhat.com>
Date:   Tue, 3 Nov 2020 13:50:34 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     Mark Mossberg <mark.mossberg@...il.com>
Cc:     tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, x86@...nel.org,
        linux-kernel@...r.kernel.org, hpa@...or.com, jannh@...gle.com,
        kyin@...hat.com
Subject: Re: [PATCH v2] x86/dumpstack: Fix misleading instruction pointer
 error message

On 10/02, Mark Mossberg wrote:
>
> Printing "Bad RIP value" if copy_code() fails can be misleading for
> userspace pointers, since copy_code() can fail if the instruction
> pointer is valid, but the code is paged out.

Another problem is that show_opcodes() makes no sense if user_mode(regs)
and tsk is not current. Try "echo t > /proc/sysrq-trigger".

In this case copy_from_user_nmi() will either fail, or (worse) it will
read the "random" memory from current->mm.

Perhaps we can add something like

	if (user_mode(regs) && regs != task_pt_regs(current))
		return;

at the start of show_opcodes() ?

> --- a/arch/x86/kernel/dumpstack.c
> +++ b/arch/x86/kernel/dumpstack.c
> @@ -115,7 +115,8 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl)
>  	unsigned long prologue = regs->ip - PROLOGUE_SIZE;
>  
>  	if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
> -		printk("%sCode: Bad RIP value.\n", loglvl);
> +		printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n",
> +		       loglvl, prologue);
>  	} else {
>  		printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
>  		       __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes,
> -- 
> 2.25.1
>