linux-kernel - Re: [PATCH v3] kexec: Support purgatories with .text.hot sections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230403163540.4f597d50@rotkaeppchen>
Date:   Mon, 3 Apr 2023 16:35:40 +0200
From:   Philipp Rudo <prudo@...hat.com>
To:     Ricardo Ribalda <ribalda@...omium.org>
Cc:     Eric Biederman <ebiederm@...ssion.com>,
        linux-kernel@...r.kernel.org, kexec@...ts.infradead.org,
        Baoquan He <bhe@...hat.com>
Subject: Re: [PATCH v3] kexec: Support purgatories with .text.hot sections

Hi Ricardo,

sorry for the late reply...

On Mon, 27 Mar 2023 13:52:08 +0200
Ricardo Ribalda <ribalda@...omium.org> wrote:

[...]

> 
> I tried removing the -r from arch/x86/purgatory/Makefile and that resulted into:
> 
> [  115.631578] BUG: unable to handle page fault for address: ffff93224d5c8e20
> [  115.631583] #PF: supervisor write access in kernel mode
> [  115.631585] #PF: error_code(0x0002) - not-present page
> [  115.631586] PGD 100000067 P4D 100000067 PUD 1001ed067 PMD 132b58067 PTE 0
> [  115.631589] Oops: 0002 [#1] PREEMPT SMP NOPTI
> [  115.631592] CPU: 0 PID: 5291 Comm: kexec-lite Tainted: G     U
>       5.15.103-17399-g852a928df601-dirty #19
> cd159e0d6a91f03e06035a0a8eb7fc984a8f3e82
> [  115.631594] Hardware name: Google Crota/Crota, BIOS
> Google_Crota.14505.288.0 11/08/2022
> [  115.631595] RIP: 0010:memcpy_erms+0x6/0x10
> [  115.631599] Code: 5d 00 eb bd eb 1e 0f 1f 00 48 89 f8 48 89 d1 48
> c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 cc cc cc cc 66 90 48 89 f8
> 48 89 d1 <f3> a4 c3 cc cc cc cc 0f 1f 00 48 89 f8 48 83 fa 20 72 7e 40
> 38 fe
> [  115.631601] RSP: 0018:ffff93224f65fe50 EFLAGS: 00010246
> [  115.631602] RAX: ffff93224d5c8e20 RBX: 00000000ffffffea RCX: 0000000000000100
> [  115.631603] RDX: 0000000000000100 RSI: ffff9322407bd000 RDI: ffff93224d5c8e20
> [  115.631604] RBP: ffff93224f65fe88 R08: 0000000000000000 R09: ffff92133cd3ef08
> [  115.631605] R10: ffff9322407be000 R11: ffffffffa1b4f2e0 R12: 0000000000000000
> [  115.631606] R13: ffff92133cee4c00 R14: 0000000000000100 R15: ffffffffa2b6f14f
> [  115.631607] FS:  000078e8b9dbf7c0(0000) GS:ffff921437800000(0000)
> knlGS:0000000000000000
> [  115.631609] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  115.631610] CR2: ffff93224d5c8e20 CR3: 000000015be26001 CR4: 0000000000770ef0
> [  115.631611] PKRU: 55555554
> [  115.631612] Call Trace:
> [  115.631614]  <TASK>
> [  115.631615]  kexec_purgatory_get_set_symbol+0x82/0xd3
> [  115.631619]  __se_sys_kexec_file_load+0x523/0x644
> [  115.631621]  do_syscall_64+0x58/0xa5
> [  115.631623]  entry_SYSCALL_64_after_hwframe+0x61/0xcb

Yeah, simply dropping -r doesn't work. You at least need to add -fPIE
to the CFLAGS. But probably you need more. When you go down this route
you really need to pay attention to some nasty details...

> And I did not continue in that direction.

That's totally fine.

Thanks
Philipp

> I also tried finding a flag for llvm that would avoid splitting .text,
> but was not lucky either.
> 
> I will look into making a linker script for x86, we could combine it
> with something like:
> 
>                 if (sechdrs[i].sh_flags & SHF_EXECINSTR &&
>                     pi->ehdr->e_entry >= sechdrs[i].sh_addr &&
>                     pi->ehdr->e_entry < (sechdrs[i].sh_addr
> -                                        + sechdrs[i].sh_size) &&
> -                   kbuf->image->start == pi->ehdr->e_entry) {
> -                       kbuf->image->start -= sechdrs[i].sh_addr;
> -                       kbuf->image->start += kbuf->mem + offset;
> +                                        + sechdrs[i].sh_size)) {
> +                       if (!WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) {
> +                               kbuf->image->start -= sechdrs[i].sh_addr;
> +                               kbuf->image->start += kbuf->mem + offset;
> +                       }
>                 }
> 
> So developers have some hints of what to look at.
> 
> Thanks!
> 
> 
> >
> > Thanks
> > Philipp
> >  
> > >                       kbuf->image->start -= sechdrs[i].sh_addr;
> > >                       kbuf->image->start += kbuf->mem + offset;
> > >               }
> > >
> > > ---
> > > base-commit: 17214b70a159c6547df9ae204a6275d983146f6b
> > > change-id: 20230321-kexec_clang16-4510c23d129c
> > >
> > > Best regards,  
> >  
> 
>