| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 5 Oct 2022 23:00:10 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Dave Hansen <dave.hansen@...el.com>
CC: <lkp@...ts.01.org>, <lkp@...el.com>,
Ingo Molnar <mingo@...nel.org>,
kernel test robot <yujie.liu@...el.com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Peter Zijlstra <peterz@...radead.org>,
<linux-kernel@...r.kernel.org>, <x86@...nel.org>
Subject: [x86/mm/32] a3d3163fbe:
WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr_set_clr
hi, Dave,
we noticed this commit is the fix for
"[x86/mm] 652c5bf380: WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr"
which is on
https://lore.kernel.org/all/fcf89147-440b-e478-40c9-228c9fe56691@intel.com/
however, in vm boot tests by kernel compiled with attached config, we noticed
the similar issue seem still exist.
c0d2e63d4c618185 a3d3163fbe690cfec354fc20808
---------------- ---------------------------
fail:runs %reproduction fail:runs
| | |
6:6 0% 6:6 dmesg.BUG:unable_to_handle_page_fault_for_address
6:6 -100% :6 dmesg.EIP:__change_page_attr
:6 100% 6:6 dmesg.EIP:__change_page_attr_set_clr
6:6 0% 6:6 dmesg.Kernel_panic-not_syncing:Fatal_exception
6:6 0% 6:6 dmesg.Oops:#[##]
6:6 -100% :6 dmesg.WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr
:6 100% 6:6 dmesg.WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr_set_clr
besides dmesg for this commit, also attached parent dmesg FYI.
Greeting,
FYI, we noticed the following commit (built with clang-14):
commit: a3d3163fbe690cfec354fc20808adf0629adf8da ("x86/mm/32: Fix W^X detection when page tables do not support NX")
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git x86/mm
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Link: https://lore.kernel.org/r/202210052224.2d53164-oliver.sang@intel.com
the Call Trace for a3d3163fbe:
[ 11.338257][ T1] calling pci_arch_init+0x0/0x64 @ 1
[ 11.339206][ T1] ------------[ cut here ]------------
[ 11.339884][ T1] CPA refuse W^X violation: 8000000000000163 -> 0000000000000163 range: 0x00000000800a0000 - 0x00000000800a0fff PFN a0
[ 11.340052][ T1] WARNING: CPU: 0 PID: 1 at arch/x86/mm/pat/set_memory.c:604 __change_page_attr_set_clr+0x992/0xa10
[ 11.341379][ T1] Modules linked in:
[ 11.341852][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3-00113-ga3d3163fbe69 #1
[ 11.342871][ T1] EIP: __change_page_attr_set_clr+0x992/0xa10
[ 11.343353][ T1] Code: 00 00 89 55 d8 c6 05 91 c9 73 82 01 ff 75 cc ff 75 d8 ff 75 f0 50 51 ff 75 bc ff 75 e4 68 03 72 26 82 e8 21 cd 00 00 83 c4 20 <0
f> 0b a1 e4 48 74 82 89 45 e4 a1 e0 48 74 82 89 45 d8 e9 4f fc ff
[ 11.345706][ T1] EAX: 00000074 EBX: 000a0163 ECX: 00000000 EDX: 834c7be8
[ 11.346551][ T1] ESI: 80000000 EDI: 830a9500 EBP: 834c7d28 ESP: 834c7ca0
[ 11.346685][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010286
[ 11.347593][ T1] CR0: 80050033 CR2: ffbff000 CR3: 02952000 CR4: 000406f0
[ 11.348444][ T1] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 11.349275][ T1] DR6: fffe0ff0 DR7: 00000400
[ 11.349831][ T1] Call Trace:
[ 11.350042][ T1] ? __mutex_unlock_slowpath+0x20/0x1e0
[ 11.350750][ T1] ? _vm_unmap_aliases+0x202/0x210
[ 11.351383][ T1] change_page_attr_set_clr+0x15b/0x1d0
[ 11.352062][ T1] set_memory_x+0x2b/0x40
[ 11.352592][ T1] set_bios_x+0x1c/0x40
[ 11.353115][ T1] pci_find_bios+0xbc/0xd6
[ 11.353352][ T1] ? acpi_table_parse+0x5e/0x7e
[ 11.353945][ T1] pci_pcbios_init+0x13/0x25
[ 11.354495][ T1] pci_arch_init+0x30/0x64
[ 11.355016][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 11.355663][ T1] do_one_initcall+0x113/0x1f0
[ 11.356310][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 11.356695][ T1] do_initcall_level+0x7b/0x8d
[ 11.357249][ T1] do_initcalls+0x3c/0x6a
[ 11.357719][ T1] do_basic_setup+0x31/0x34
[ 11.358218][ T1] kernel_init_freeable+0x131/0x17d
[ 11.358811][ T1] ? kernel_init+0x12/0x180
[ 11.359321][ T1] ? rest_init+0x180/0x180
[ 11.359802][ T1] kernel_init+0x12/0x180
[ 11.360021][ T1] ret_from_fork+0x1c/0x28
[ 11.360536][ T1] irq event stamp: 13727
[ 11.360990][ T1] hardirqs last enabled at (13735): [<810e63ba>] __up_console_sem+0x5a/0x60
[ 11.362049][ T1] hardirqs last disabled at (13742): [<810e63a1>] __up_console_sem+0x41/0x60
[ 11.363046][ T1] softirqs last enabled at (13450): [<81025800>] do_softirq_own_stack+0x50/0x60
[ 11.363360][ T1] softirqs last disabled at (13445): [<81025800>] do_softirq_own_stack+0x50/0x60
[ 11.364380][ T1] ---[ end trace 0000000000000000 ]---
[ 11.365091][ T1] PCI: PCI BIOS area is rw and x. Use pci=nobios if you want it NX.
[ 11.365992][ T1] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[ 11.366673][ T1] BUG: unable to handle page fault for address: 800fd2bf
[ 11.366673][ T1] #PF: supervisor instruction fetch in kernel mode
[ 11.366673][ T1] #PF: error_code(0x0011) - permissions violation
[ 11.366673][ T1] *pdpt = 000000000294f001 *pde = 00000000030a9063 *pte = 80000000000fd163
[ 11.366673][ T1] Oops: 0011 [#1] SMP
[ 11.366673][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.0.0-rc3-00113-ga3d3163fbe69 #1
[ 11.366673][ T1] EIP: 0x800fd2bf
[ 11.366673][ T1] Code: 06 1e 8c d0 8e d8 66 89 e3 66 0f b7 e4 66 89 e0 66 e8 43 e8 ff ff 66 89 dc 1f 07 66 5f 66 5e 66 5d 66 5b 66 5a 66 59 66 58 cf <9c> 3d 24 50 43 49 75 13 bb 00 00 0f 00 b9 00 00 01 00 ba 1d d2 00
[ 11.366673][ T1] EAX: 49435024 EBX: 00000000 ECX: 827bc0a4 EDX: 827bbf78
[ 11.366673][ T1] ESI: 800f6040 EDI: 827d59b0 EBP: 834c7d88 ESP: 834c7d70
[ 11.366673][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010046
[ 11.366673][ T1] CR0: 80050033 CR2: 800fd2bf CR3: 02952000 CR4: 000406f0
[ 11.366673][ T1] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 11.366673][ T1] DR6: fffe0ff0 DR7: 00000400
[ 11.366673][ T1] Call Trace:
[ 11.366673][ T1] ? bios32_service+0x42/0x91
[ 11.366673][ T1] check_pcibios+0xe/0x106
[ 11.366673][ T1] pci_find_bios+0xc1/0xd6
[ 11.366673][ T1] ? acpi_table_parse+0x5e/0x7e
[ 11.366673][ T1] pci_pcbios_init+0x13/0x25
[ 11.366673][ T1] pci_arch_init+0x30/0x64
[ 11.366673][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 11.366673][ T1] do_one_initcall+0x113/0x1f0
[ 11.366673][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 11.366673][ T1] do_initcall_level+0x7b/0x8d
[ 11.366673][ T1] do_initcalls+0x3c/0x6a
[ 11.366673][ T1] do_basic_setup+0x31/0x34
[ 11.366673][ T1] kernel_init_freeable+0x131/0x17d
[ 11.366673][ T1] ? kernel_init+0x12/0x180
[ 11.366673][ T1] ? rest_init+0x180/0x180
[ 11.366673][ T1] kernel_init+0x12/0x180
[ 11.366673][ T1] ret_from_fork+0x1c/0x28
[ 11.366673][ T1] Modules linked in:
[ 11.366673][ T1] CR2: 00000000800fd2bf
[ 11.366673][ T1] ---[ end trace 0000000000000000 ]---
[ 11.366673][ T1] EIP: 0x800fd2bf
[ 11.366673][ T1] Code: 06 1e 8c d0 8e d8 66 89 e3 66 0f b7 e4 66 89 e0 66 e8 43 e8 ff ff 66 89 dc 1f 07 66 5f 66 5e 66 5d 66 5b 66 5a 66 59 66 58 cf <9c> 3d 24 50 43 49 75 13 bb 00 00 0f 00 b9 00 00 01 00 ba 1d d2 00
[ 11.366673][ T1] EAX: 49435024 EBX: 00000000 ECX: 827bc0a4 EDX: 827bbf78
[ 11.366673][ T1] ESI: 800f6040 EDI: 827d59b0 EBP: 834c7d88 ESP: 834c7d70
[ 11.366673][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010046
[ 11.366673][ T1] CR0: 80050033 CR2: 800fd2bf CR3: 02952000 CR4: 000406f0
[ 11.366673][ T1] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 11.366673][ T1] DR6: fffe0ff0 DR7: 00000400
[ 11.366673][ T1] Kernel panic - not syncing: Fatal exception
the Call Trace for parent commit:
[ 9.760899][ T1] calling pci_arch_init+0x0/0x64 @ 1
[ 9.762665][ T9] Callback from call_rcu_tasks() invoked.
[ 9.762085][ T1] ------------[ cut here ]------------
[ 9.762331][ T1] CPA refuse W^X violation: 8000000000000163 -> 0000000000000163 range: 0x00000000800a0000 - 0x00000000800a0fff PFN a0
[ 9.763251][ T1] WARNING: CPU: 1 PID: 1 at arch/x86/mm/pat/set_memory.c:603 __change_page_attr+0x35e/0x370
[ 9.764044][ T1] Modules linked in:
[ 9.764335][ T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3-00112-gc0d2e63d4c61 #1
[ 9.764981][ T1] EIP: __change_page_attr+0x35e/0x370
[ 9.765241][ T1] Code: ff 0f 00 00 89 55 dc c6 05 91 c9 73 82 01 ff 75 d0 ff 75 dc ff 75 f0 51 56 ff 75 d8 50 68 e5 71 26 82 e8 05 cf 00 00 83 c4 20 <0f> 0b e9 b1 fe ff ff 89 c1 89 55 ec e9 c5 fe ff ff 90 55 89 e5 53
[ 9.766695][ T1] EAX: 00000074 EBX: 000a0163 ECX: 00000000 EDX: 834c7be0
[ 9.767204][ T1] ESI: 00000163 EDI: 830a9500 EBP: 834c7cd4 ESP: 834c7c98
[ 9.767732][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010282
[ 9.768295][ T1] CR0: 80050033 CR2: 00000000 CR3: 02952000 CR4: 000406f0
[ 9.768577][ T1] Call Trace:
[ 9.768827][ T1] __change_page_attr_set_clr+0x45/0x170
[ 9.769243][ T1] ? mutex_unlock+0xd/0x10
[ 9.769562][ T1] ? _vm_unmap_aliases+0x202/0x210
[ 9.769944][ T1] change_page_attr_set_clr+0x15b/0x1d0
[ 9.770358][ T1] set_memory_x+0x2b/0x40
[ 9.770676][ T1] set_bios_x+0x1c/0x40
[ 9.770977][ T1] pci_find_bios+0xbc/0xd6
[ 9.771302][ T1] ? acpi_table_parse+0x5e/0x7e
[ 9.771741][ T1] pci_pcbios_init+0x13/0x25
[ 9.771913][ T1] pci_arch_init+0x30/0x64
[ 9.772445][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 9.773116][ T1] do_one_initcall+0x113/0x1f0
[ 9.773775][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 9.774178][ T1] do_initcall_level+0x7b/0x8d
[ 9.774523][ T1] do_initcalls+0x3c/0x6a
[ 9.774835][ T1] do_basic_setup+0x31/0x34
[ 9.775157][ T1] kernel_init_freeable+0x131/0x17d
[ 9.775244][ T1] ? kernel_init+0x12/0x180
[ 9.775583][ T1] ? rest_init+0x180/0x180
[ 9.775905][ T1] kernel_init+0x12/0x180
[ 9.776230][ T1] ret_from_fork+0x1c/0x28
[ 9.776583][ T1] irq event stamp: 6239
[ 9.776883][ T1] hardirqs last enabled at (6247): [<810e63aa>] __up_console_sem+0x5a/0x60
[ 9.777512][ T1] hardirqs last disabled at (6254): [<810e6391>] __up_console_sem+0x41/0x60
[ 9.778127][ T1] softirqs last enabled at (5630): [<81025800>] do_softirq_own_stack+0x50/0x60
[ 9.778574][ T1] softirqs last disabled at (5625): [<81025800>] do_softirq_own_stack+0x50/0x60
[ 9.779199][ T1] ---[ end trace 0000000000000000 ]---
[ 9.779613][ T1] PCI: PCI BIOS area is rw and x. Use pci=nobios if you want it NX.
[ 9.780167][ T1] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[ 9.780759][ T1] BUG: unable to handle page fault for address: 800fd2bf
[ 9.781308][ T1] #PF: supervisor instruction fetch in kernel mode
[ 9.781752][ T1] #PF: error_code(0x0011) - permissions violation
[ 9.781902][ T1] *pdpt = 000000000294f001 *pde = 00000000030a9063 *pte = 80000000000fd163
[ 9.781902][ T1] Oops: 0011 [#1] SMP
[ 9.781902][ T1] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 6.0.0-rc3-00112-gc0d2e63d4c61 #1
[ 9.781902][ T1] EIP: 0x800fd2bf
[ 9.781902][ T1] Code: 06 1e 8c d0 8e d8 66 89 e3 66 0f b7 e4 66 89 e0 66 e8 43 e8 ff ff 66 89 dc 1f 07 66 5f 66 5e 66 5d 66 5b 66 5a 66 59 66 58 cf <9c> 3d 24 50 43 49 75 13 bb 00 00 0f 00 b9 00 00 01 00 ba 1d d2 00
[ 9.781902][ T1] EAX: 49435024 EBX: 00000000 ECX: 827bc0a4 EDX: 827bbf78
[ 9.781902][ T1] ESI: 800f6040 EDI: 827d59b0 EBP: 834c7d88 ESP: 834c7d70
[ 9.781902][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010046
[ 9.781902][ T1] CR0: 80050033 CR2: 800fd2bf CR3: 02952000 CR4: 000406f0
[ 9.781902][ T1] Call Trace:
[ 9.781902][ T1] ? bios32_service+0x42/0x91
[ 9.781902][ T1] check_pcibios+0xe/0x106
[ 9.781902][ T1] pci_find_bios+0xc1/0xd6
[ 9.781902][ T1] ? acpi_table_parse+0x5e/0x7e
[ 9.781902][ T1] pci_pcbios_init+0x13/0x25
[ 9.781902][ T1] pci_arch_init+0x30/0x64
[ 9.781902][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 9.781902][ T1] do_one_initcall+0x113/0x1f0
[ 9.781902][ T1] ? pcibios_fw_addr_list_del+0x68/0x68
[ 9.781902][ T1] do_initcall_level+0x7b/0x8d
[ 9.781902][ T1] do_initcalls+0x3c/0x6a
[ 9.781902][ T1] do_basic_setup+0x31/0x34
[ 9.781902][ T1] kernel_init_freeable+0x131/0x17d
[ 9.781902][ T1] ? kernel_init+0x12/0x180
[ 9.781902][ T1] ? rest_init+0x180/0x180
[ 9.781902][ T1] kernel_init+0x12/0x180
[ 9.781902][ T1] ret_from_fork+0x1c/0x28
[ 9.781902][ T1] Modules linked in:
[ 9.781902][ T1] CR2: 00000000800fd2bf
[ 9.781902][ T1] ---[ end trace 0000000000000000 ]---
[ 9.781902][ T1] EIP: 0x800fd2bf
[ 9.781902][ T1] Code: 06 1e 8c d0 8e d8 66 89 e3 66 0f b7 e4 66 89 e0 66 e8 43 e8 ff ff 66 89 dc 1f 07 66 5f 66 5e 66 5d 66 5b 66 5a 66 59 66 58 cf <9c> 3d 24 50 43 49 75 13 bb 00 00 0f 00 b9 00 00 01 00 ba 1d d2 00
[ 9.781902][ T1] EAX: 49435024 EBX: 00000000 ECX: 827bc0a4 EDX: 827bbf78
[ 9.781902][ T1] ESI: 800f6040 EDI: 827d59b0 EBP: 834c7d88 ESP: 834c7d70
[ 9.781902][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010046
[ 9.781902][ T1] CR0: 80050033 CR2: 800fd2bf CR3: 02952000 CR4: 000406f0
[ 9.781902][ T1] Kernel panic - not syncing: Fatal exception
To reproduce:
# build kernel
cd linux
cp config-6.0.0-rc3-00113-ga3d3163fbe69 .config
make HOSTCC=clang-14 CC=clang-14 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=clang-14 CC=clang-14 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-6.0.0-rc3-00113-ga3d3163fbe69" of type "text/plain" (146123 bytes)
View attachment "job-script" of type "text/plain" (5092 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (10280 bytes)
Download attachment "dmesg-parent.xz" of type "application/x-xz" (10204 bytes)
Powered by blists - more mailing lists