Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1643553

Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0

From Kees Cook <keescook@chromium.org>
Newsgroups linux.kernel
Subject Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0
Date 2017-05-17 20:00 +0200
Message-ID <tIboS-69O-7@gated-at.bofh.it> (permalink)
References (1 earlier) <tHwvn-5tj-5@gated-at.bofh.it> <tHx86-5MH-3@gated-at.bofh.it> <tHxUt-6kj-1@gated-at.bofh.it> <tHynv-6J0-15@gated-at.bofh.it> <tIaj7-5vV-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Wed, May 17, 2017 at 9:40 AM, Luis R. Rodriguez <mcgrof@kernel.org> wrote:
> Yes, but I had killed that boot session again, so upon my next boot
> I had a different layout, the ASLR gap was much larger:
>
> ---[ Modules ]---
> 0xffffffffc0000000-0xffffffffc01b0000        1728K                               pte
> 0xffffffffc01b0000-0xffffffffc01b1000           4K     RW                 GLB x  pte
> 0xffffffffc01b1000-0xffffffffc01b2000           4K                               pte
> 0xffffffffc01b2000-0xffffffffc01c6000          80K     ro                 GLB x  pte
> 0xffffffffc01c6000-0xffffffffc01cc000          24K     ro                 GLB NX pte
> 0xffffffffc01cc000-0xffffffffc01d5000          36K     RW                 GLB NX pte
>
> As you can guess if we follow similar pattern the RW hole is the one this boot
> warned about:
>
> [    1.450483] x86/mm: Found insecure W+X mapping at address ffffffffc01b0000/0xffffffffc01b0000
> [    1.451280] ------------[ cut here ]------------
> [    1.451721] WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0
> [    1.452499] Modules linked in:
> [    1.452791] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc1-next-20170515+ #145
>
> I checked and indeed 0xffffffffc01b2000 is part of a module, it was not the first one
> on the /proc/modules list but then again /proc/modules does not seem to have a specific
> order other than perhaps being pegged into a linked list of modules once they go live,
> and it seems its typically output backwards from when that happened, sorting that
> by address we get:

Right, sorry, I'd expect it at the bottom of the list in
/proc/modules, but that's fine, it's there.

>
> root@piggy:~# cat /proc/modules | sort -k 6 | head -3
> e1000 143360 0 - Live 0xffffffffc01b2000 (E)
> mbcache 16384 1 ext4, Live 0xffffffffc01d6000 (E)
> scsi_mod 217088 4 sg,sr_mod,sd_mod,libata, Live 0xffffffffc01df000 (E)
>
> And this then seems to be the first module loaded:
>
> e1000 143360 0 - Live 0xffffffffc01b2000 (E)
>
> The output of dmesg seems to confirm this as per the list of modules sorted
> as per above.
>
>> Something touched the module gap and left is RW+x...
>
> Lemme try booting with e1000 renamed to e1000.ko.ignore and see how that goes.

Is it possible a module got loaded before e1000 and then unloaded?
That seems odd, but maybe unload isn't cleaning up?

>> Are you able to bisect this?
>
> This issue has been present for a while so since I recall this I might be
> able to reduce the number of needed target kernels to bisect. Lemme tinker
> a bit and if no clear culprit comes up then will try bisect.

Okay, thanks!

-Kees


-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-16 00:10 +0200
  Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-16 00:20 +0200
    Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Kees Cook <keescook@chromium.org> - 2017-05-16 01:00 +0200
      Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-16 01:50 +0200
        Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Kees Cook <keescook@chromium.org> - 2017-05-16 02:20 +0200
          Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-17 18:50 +0200
            Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Kees Cook <keescook@chromium.org> - 2017-05-17 20:00 +0200
              Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-19 02:50 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kenrel.org> - 2017-05-19 05:10 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-19 17:50 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-19 19:30 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 Masami Hiramatsu <mhiramat@kernel.org> - 2017-05-20 04:40 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-23 16:50 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-24 20:00 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at  arch/x86/mm/dump_pagetables.c:236 note_page+0x630/0x7e0 Catalin Marinas <catalin.marinas@arm.com> - 2017-05-19 19:40 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Andy Lutomirski <luto@kernel.org> - 2017-05-19 20:30 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Kees Cook <keescook@chromium.org> - 2017-05-19 21:20 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Andy Lutomirski <luto@kernel.org> - 2017-05-19 21:20 +0200
                Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 Kees Cook <keescook@chromium.org> - 2017-05-19 21:30 +0200
    Re: next-20170515: WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:236  note_page+0x630/0x7e0 "Luis R. Rodriguez" <mcgrof@kernel.org> - 2017-05-16 01:40 +0200

csiph-web