From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751566AbcFXVGr (ORCPT ); Fri, 24 Jun 2016 17:06:47 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35906 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751141AbcFXVGq (ORCPT ); Fri, 24 Jun 2016 17:06:46 -0400 Date: Fri, 24 Jun 2016 15:25:30 -0500 From: Josh Poimboeuf To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Jann Horn , Heiko Carstens Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Message-ID: <20160624202530.unmidps4kpebo2na@treble> References: <20160623185340.GO30154@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Fri, 24 Jun 2016 21:06:45 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jun 24, 2016 at 11:11:47AM -0700, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:51 AM, Linus Torvalds > wrote: > > > > And in particular, the init_task stack initialization initialized it > > to the init_thread pointer. Which was definitely deadly. > > > > Let's see if that was it.. > > No, it's still broken. But it's *less* broken, so here's a new version > of the patch that at least gets some of the stack setup right, in my > hope that somebody will bother to look at this, and being less broken > might mean that somebody sees what else I missed.. I found at least one bug. The changing of task->stack from a "void *" to an "unsigned long *": > - void *stack; > + unsigned long *stack; That subtly changes the pointer arithmetic in do_boot_cpu(): idle->thread.sp = (unsigned long) (((struct pt_regs *) (THREAD_SIZE + task_stack_page(idle))) - 1); That ends up adding 128k to the stack page bottom instead of 16k. But fixing that doesn't seem to fix this: [18446743832.576241] ------------[ cut here ]------------ [18446743832.576241] WARNING: CPU: 1 PID: 0 at /home/jpoimboe/git/linux/arch/x86/kernel/cpu/common.c:1434 cpu_init+0x34b/0x440 [18446743832.576241] Modules linked in: [18446743832.576241] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.7.0-rc4+ #47 [18446743832.576241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [18446743832.576241] 0000000000000086 574e5e6c6855ace9 ffff88007c553e88 ffffffff8143cb83 [18446743832.576241] 0000000000000000 0000000000000000 ffff88007c553ec8 ffffffff810b0e7b [18446743832.576241] 0000059a00000000 0000000000000000 0000000000000000 0000000000000000 [18446743832.576241] Call Trace: [18446743832.576241] [] dump_stack+0x85/0xc2 [18446743832.576241] [] __warn+0xcb/0xf0 [18446743832.576241] [] warn_slowpath_null+0x1d/0x20 [18446743832.576241] [] cpu_init+0x34b/0x440 [18446743832.576241] [] start_secondary+0x1c/0x1a0 [18446743832.576241] ---[ end trace 924d57afbaca0720 ]--- So there's at least another bug lurking.. -- Josh From mboxrd@z Thu Jan 1 00:00:00 1970 From: Josh Poimboeuf Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Fri, 24 Jun 2016 15:25:30 -0500 Message-ID: <20160624202530.unmidps4kpebo2na@treble> References: <20160623185340.GO30154@twins.programming.kicks-ass.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from mx1.redhat.com ([209.132.183.28]:35906 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751141AbcFXVGq (ORCPT ); Fri, 24 Jun 2016 17:06:46 -0400 Content-Disposition: inline In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Jann Horn , Heiko Carstens On Fri, Jun 24, 2016 at 11:11:47AM -0700, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:51 AM, Linus Torvalds > wrote: > > > > And in particular, the init_task stack initialization initialized it > > to the init_thread pointer. Which was definitely deadly. > > > > Let's see if that was it.. > > No, it's still broken. But it's *less* broken, so here's a new version > of the patch that at least gets some of the stack setup right, in my > hope that somebody will bother to look at this, and being less broken > might mean that somebody sees what else I missed.. I found at least one bug. The changing of task->stack from a "void *" to an "unsigned long *": > - void *stack; > + unsigned long *stack; That subtly changes the pointer arithmetic in do_boot_cpu(): idle->thread.sp = (unsigned long) (((struct pt_regs *) (THREAD_SIZE + task_stack_page(idle))) - 1); That ends up adding 128k to the stack page bottom instead of 16k. But fixing that doesn't seem to fix this: [18446743832.576241] ------------[ cut here ]------------ [18446743832.576241] WARNING: CPU: 1 PID: 0 at /home/jpoimboe/git/linux/arch/x86/kernel/cpu/common.c:1434 cpu_init+0x34b/0x440 [18446743832.576241] Modules linked in: [18446743832.576241] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.7.0-rc4+ #47 [18446743832.576241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [18446743832.576241] 0000000000000086 574e5e6c6855ace9 ffff88007c553e88 ffffffff8143cb83 [18446743832.576241] 0000000000000000 0000000000000000 ffff88007c553ec8 ffffffff810b0e7b [18446743832.576241] 0000059a00000000 0000000000000000 0000000000000000 0000000000000000 [18446743832.576241] Call Trace: [18446743832.576241] [] dump_stack+0x85/0xc2 [18446743832.576241] [] __warn+0xcb/0xf0 [18446743832.576241] [] warn_slowpath_null+0x1d/0x20 [18446743832.576241] [] cpu_init+0x34b/0x440 [18446743832.576241] [] start_secondary+0x1c/0x1a0 [18446743832.576241] ---[ end trace 924d57afbaca0720 ]--- So there's at least another bug lurking.. -- Josh From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Fri, 24 Jun 2016 15:25:30 -0500 From: Josh Poimboeuf Message-ID: <20160624202530.unmidps4kpebo2na@treble> References: <20160623185340.GO30154@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Linus Torvalds Cc: Brian Gerst , Peter Zijlstra , Oleg Nesterov , Andy Lutomirski , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Kees Cook , "kernel-hardening@lists.openwall.com" , Jann Horn , Heiko Carstens List-ID: On Fri, Jun 24, 2016 at 11:11:47AM -0700, Linus Torvalds wrote: > On Fri, Jun 24, 2016 at 10:51 AM, Linus Torvalds > wrote: > > > > And in particular, the init_task stack initialization initialized it > > to the init_thread pointer. Which was definitely deadly. > > > > Let's see if that was it.. > > No, it's still broken. But it's *less* broken, so here's a new version > of the patch that at least gets some of the stack setup right, in my > hope that somebody will bother to look at this, and being less broken > might mean that somebody sees what else I missed.. I found at least one bug. The changing of task->stack from a "void *" to an "unsigned long *": > - void *stack; > + unsigned long *stack; That subtly changes the pointer arithmetic in do_boot_cpu(): idle->thread.sp = (unsigned long) (((struct pt_regs *) (THREAD_SIZE + task_stack_page(idle))) - 1); That ends up adding 128k to the stack page bottom instead of 16k. But fixing that doesn't seem to fix this: [18446743832.576241] ------------[ cut here ]------------ [18446743832.576241] WARNING: CPU: 1 PID: 0 at /home/jpoimboe/git/linux/arch/x86/kernel/cpu/common.c:1434 cpu_init+0x34b/0x440 [18446743832.576241] Modules linked in: [18446743832.576241] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.7.0-rc4+ #47 [18446743832.576241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 [18446743832.576241] 0000000000000086 574e5e6c6855ace9 ffff88007c553e88 ffffffff8143cb83 [18446743832.576241] 0000000000000000 0000000000000000 ffff88007c553ec8 ffffffff810b0e7b [18446743832.576241] 0000059a00000000 0000000000000000 0000000000000000 0000000000000000 [18446743832.576241] Call Trace: [18446743832.576241] [] dump_stack+0x85/0xc2 [18446743832.576241] [] __warn+0xcb/0xf0 [18446743832.576241] [] warn_slowpath_null+0x1d/0x20 [18446743832.576241] [] cpu_init+0x34b/0x440 [18446743832.576241] [] start_secondary+0x1c/0x1a0 [18446743832.576241] ---[ end trace 924d57afbaca0720 ]--- So there's at least another bug lurking.. -- Josh