Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1724491
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection |
| Date | 2017-08-31 20:50 +0200 |
| Message-ID | <ukCHp-Qu-29@gated-at.bofh.it> (permalink) |
| References | (15 earlier) <ukoXL-Lg-9@gated-at.bofh.it> <ukp7r-Oj-1@gated-at.bofh.it> <ukyaL-6kL-55@gated-at.bofh.it> <ukB8C-8op-19@gated-at.bofh.it> <ukBrZ-4T-31@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, Aug 31, 2017 at 10:19 AM, Mike Galbraith <efault@gmx.de> wrote:
> On Thu, 2017-08-31 at 10:00 -0700, Kees Cook wrote:
>>
>> Oh! So it's gcc-version sensitive? That's alarming. Is this mapping correct:
>>
>> 4.8.5: WARN, eventual kernel hang
>> 6.3.1, 7.0.1: WARN, but continues working
>
> Yeah, that's correct. I find that troubling, simply because this gcc
> version has been through one hell of a lot of kernels with me. Yeah, I
> know, that doesn't exempt it from having bugs, but color me suspicious.
I still can't hit this with a 4.8.5 build. :(
With _RATELIMIT removed, this should, in theory, report whatever goes
negative first...
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index c076f710de4c..d4fc6b91c0e6 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -72,6 +72,10 @@ bool ex_handler_refcount(const struct
exception_table_entry *fixup,
bool zero = regs->flags & X86_EFLAGS_ZF;
refcount_error_report(regs, zero ? "hit zero" : "overflow");
+ } else if (regs->flags & X86_EFLAGS_SF) {
+ refcount_error_report(regs, "result was negative");
+ } else {
+ refcount_error_report(regs, "unknown state");
}
return true;
diff --git a/kernel/panic.c b/kernel/panic.c
index bdd18afa19a4..966ade491543 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -605,7 +605,7 @@ EXPORT_SYMBOL(__stack_chk_fail);
#ifdef CONFIG_ARCH_HAS_REFCOUNT
void refcount_error_report(struct pt_regs *regs, const char *err)
{
- WARN_RATELIMIT(1, "refcount_t %s at %pB in %s[%d], uid/euid: %u/%u\n",
+ WARN(1, "refcount_t %s at %pB in %s[%d], uid/euid: %u/%u\n",
err, (void *)instruction_pointer(regs),
current->comm, task_pid_nr(current),
from_kuid_munged(&init_user_ns, current_uid()),
And if it is still a refcount_inc(), and only on gcc 4.8.5, then I
think we need to study the resulting assembly...
-Kees
--
Kees Cook
Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-29 11:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-29 18:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-29 20:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-29 20:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 07:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 18:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 19:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 19:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-30 20:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 21:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-30 21:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 04:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 04:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 05:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 06:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 06:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 06:40 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 16:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 19:10 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-08-31 19:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 20:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 09:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 15:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 19:20 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 20:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 21:00 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Mike Galbraith <efault@gmx.de> - 2017-09-01 21:30 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-09-01 21:50 +0200
Re: tip -ENOBOOT - bisected to locking/refcounts, x86/asm: Implement fast refcount overflow protection Kees Cook <keescook@chromium.org> - 2017-08-31 21:30 +0200
csiph-web