From: Seunghun Han <kkamagui@gmail.com> To: Tony Luck <tony.luck@intel.com>, Borislav Petkov <bp@alien8.de> Cc: linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Seunghun Han <kkamagui@gmail.com> Subject: [PATCH] x86: mce: fix kernel panic when check_interval is changed Date: Fri, 23 Feb 2018 19:13:50 +0900 [thread overview] Message-ID: <20180223101350.8344-1-kkamagui@gmail.com> (raw) I am Seunghun Han and a senior security researcher at National Security Research Institute of South Korea. I found a critical security issue which can make kernel panic in userspace. After analyzing the issue carefully, I found that MCE driver in the kernel has a problem which can be occurred in SMP environment. The check_interval file in /sys/devices/system/machinecheck/machinecheck<cpu number> directory is a global timer value for MCE polling. If it is changed by one CPU, MCE driver in kernel calls mce_restart() function and broadcasts the event to other CPUs to delete and restart MCE polling timer. The __mcheck_cpu_init_timer() function which is called by mce_restart() function initializes the mce_timer variable, and the "lock" in mce_timer is also reinitialized. If more than one CPU write a specific value to check_interval file concurrently, one can initialize the "lock" in mce_timer while the others are handling "lock" in mce_timer. This problem causes some synchronization errors such as kernel panic and kernel hang. It is a critical security problem because the attacker can make kernel panic by writing a value to the check_interval file in userspace, and it can be used for Denial-of-Service (DoS) attack. To fix this problem, I changed the __mcheck_cpu_init_timer() function to reuse mce_timer instead of initializing it. The purpose of the function is to restart the timer and it can be archived by calling Signed-off-by: Seunghun Han <kkamagui@gmail.com> --- arch/x86/kernel/cpu/mcheck/mce.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c index 3d8c573a9a27..d72f2f74f4d7 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -1771,7 +1771,6 @@ static void __mcheck_cpu_init_timer(void) { struct timer_list *t = this_cpu_ptr(&mce_timer); - timer_setup(t, mce_timer_fn, TIMER_PINNED); mce_start_timer(t); } @@ -2029,8 +2028,10 @@ static void mce_enable_ce(void *all) return; cmci_reenable(); cmci_recheck(); - if (all) + if (all) { + del_timer_sync(this_cpu_ptr(&mce_timer)); __mcheck_cpu_init_timer(); + } } static struct bus_type mce_subsys = { -- 2.11.0
WARNING: multiple messages have this Message-ID (diff)
From: Seunghun Han <kkamagui@gmail.com> To: Tony Luck <tony.luck@intel.com>, Borislav Petkov <bp@alien8.de> Cc: linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Seunghun Han <kkamagui@gmail.com> Subject: x86: mce: fix kernel panic when check_interval is changed Date: Fri, 23 Feb 2018 19:13:50 +0900 [thread overview] Message-ID: <20180223101350.8344-1-kkamagui@gmail.com> (raw) I am Seunghun Han and a senior security researcher at National Security Research Institute of South Korea. I found a critical security issue which can make kernel panic in userspace. After analyzing the issue carefully, I found that MCE driver in the kernel has a problem which can be occurred in SMP environment. The check_interval file in /sys/devices/system/machinecheck/machinecheck<cpu number> directory is a global timer value for MCE polling. If it is changed by one CPU, MCE driver in kernel calls mce_restart() function and broadcasts the event to other CPUs to delete and restart MCE polling timer. The __mcheck_cpu_init_timer() function which is called by mce_restart() function initializes the mce_timer variable, and the "lock" in mce_timer is also reinitialized. If more than one CPU write a specific value to check_interval file concurrently, one can initialize the "lock" in mce_timer while the others are handling "lock" in mce_timer. This problem causes some synchronization errors such as kernel panic and kernel hang. It is a critical security problem because the attacker can make kernel panic by writing a value to the check_interval file in userspace, and it can be used for Denial-of-Service (DoS) attack. To fix this problem, I changed the __mcheck_cpu_init_timer() function to reuse mce_timer instead of initializing it. The purpose of the function is to restart the timer and it can be archived by calling Signed-off-by: Seunghun Han <kkamagui@gmail.com> --- arch/x86/kernel/cpu/mcheck/mce.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c index 3d8c573a9a27..d72f2f74f4d7 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -1771,7 +1771,6 @@ static void __mcheck_cpu_init_timer(void) { struct timer_list *t = this_cpu_ptr(&mce_timer); - timer_setup(t, mce_timer_fn, TIMER_PINNED); mce_start_timer(t); } @@ -2029,8 +2028,10 @@ static void mce_enable_ce(void *all) return; cmci_reenable(); cmci_recheck(); - if (all) + if (all) { + del_timer_sync(this_cpu_ptr(&mce_timer)); __mcheck_cpu_init_timer(); + } } static struct bus_type mce_subsys = {
next reply other threads:[~2018-02-23 10:13 UTC|newest] Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-02-23 10:13 Seunghun Han [this message] 2018-02-23 10:13 ` x86: mce: fix kernel panic when check_interval is changed Seunghun Han 2018-02-23 10:42 ` [PATCH] " Borislav Petkov 2018-02-23 10:42 ` Borislav Petkov 2018-02-23 10:52 ` [PATCH] " Greg Kroah-Hartman 2018-02-23 10:52 ` Greg Kroah-Hartman 2018-02-25 20:05 ` [PATCH] " Seunghun Han 2018-02-25 20:05 ` Seunghun Han 2018-02-28 9:32 ` [PATCH] " Borislav Petkov 2018-02-28 9:32 ` Borislav Petkov 2018-02-28 9:48 ` [PATCH] " Seunghun Han 2018-02-28 9:48 ` Seunghun Han
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180223101350.8344-1-kkamagui@gmail.com \ --to=kkamagui@gmail.com \ --cc=bp@alien8.de \ --cc=gregkh@linuxfoundation.org \ --cc=linux-edac@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=tony.luck@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.