* bug disabling NX (noexec=off)
@ 2019-04-13 20:53 Xose Vazquez Perez
2019-04-14 9:59 ` Thomas Gleixner
0 siblings, 1 reply; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-13 20:53 UTC (permalink / raw)
To: LKML, x86 team
Hi,
Intel Core i3-2120 + kernel-5.0.7 x86_64 from Fedora:
[ 0.000000] microcode: microcode updated early to revision 0x2e, date = 2018-04-10
[ 0.000000] Linux version 5.0.7-300.fc30.x86_64 (mockbuild@bkernel04.phx2.fedoraproject.org) (gcc version 9.0.1 20190312 (Red Hat 9.0.1-0.10) (GCC)) #1 SMP Mon Apr 8 18:28:09 UTC 2019
[ 0.000000] Command line: BOOT_IMAGE=(hd0,msdos1)/boot/vmlinuz-5.0.7-300.fc30.x86_64 root=UUID=ea93877a-9487-4416-9f32-9d1fba2a639a ro quiet audit=0 usb-storage.delay_use=0 net.ifnames=0
plymouth.enable=0 pti=off spectre_v2=off spectre_v2_user=off spec_store_bypass_disable=off l1tf=off noexec=off
[...]
[ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
[ 0.000000] ------------[ cut here ]------------
[ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
[ 0.000000] WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537 __early_set_fixmap+0xa2/0xff
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.7-300.fc30.x86_64 #1
[ 0.000000] RIP: 0010:__early_set_fixmap+0xa2/0xff
[ 0.000000] Code: ed be ff 49 21 cc 4c 39 e2 74 21 80 3d b8 a2 bb ff 00 75 18 4c 31 e2 48 c7 c7 68 b6 09 ac c6 05 a5 a2 bb ff 01 e8 ae ba 95 fe <0f> 0b 4c 89 e7 4c 09 ef ff 14 25 98 e2 22 ac 48 89
c6 48 89 df ff
[ 0.000000] RSP: 0000:ffffffffac203de8 EFLAGS: 00010082 ORIG_RAX: 0000000000000000
[ 0.000000] RAX: 0000000000000000 RBX: ffffffffac972000 RCX: 0000000000000078
[ 0.000000] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000047
[ 0.000000] RBP: ffffffffff200000 R08: 0000000000000001 R09: 0000000000000024
[ 0.000000] R10: 0000000000000c1c R11: 0000000000000003 R12: 0000000000000163
[ 0.000000] R13: 00000000000f0000 R14: 0000000000010000 R15: 0000000000000000
[ 0.000000] FS: 0000000000000000(0000) GS:ffffffffac73a000(0000) knlGS:0000000000000000
[ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.000000] CR2: ffff888046212ff8 CR3: 00000000467de000 CR4: 00000000000406a0
[ 0.000000] Call Trace:
[ 0.000000] ? __early_ioremap+0x10b/0x189
[ 0.000000] ? dmi_scan_machine+0xfe/0x209
[ 0.000000] ? setup_arch+0x436/0xc9f
[ 0.000000] ? start_kernel+0x65/0x519
[ 0.000000] ? secondary_startup_64+0xa4/0xb0
[ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x26/0x40 with crng_init=0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] SMBIOS 2.6 present.
[...]
The same happens in a T61 with an Intel Core 2 Duo T7300.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: bug disabling NX (noexec=off)
2019-04-13 20:53 bug disabling NX (noexec=off) Xose Vazquez Perez
@ 2019-04-14 9:59 ` Thomas Gleixner
2019-04-14 21:26 ` Xose Vazquez Perez
0 siblings, 1 reply; 6+ messages in thread
From: Thomas Gleixner @ 2019-04-14 9:59 UTC (permalink / raw)
To: Xose Vazquez Perez; +Cc: LKML, x86 team
On Sat, 13 Apr 2019, Xose Vazquez Perez wrote:
> [ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
> [ 0.000000] ------------[ cut here ]------------
> [ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
Does the below patch fix it for you?
Thanks,
tglx
8<----------------
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0029604af8a4..dd73d5d74393 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: bug disabling NX (noexec=off)
2019-04-14 9:59 ` Thomas Gleixner
@ 2019-04-14 21:26 ` Xose Vazquez Perez
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
0 siblings, 1 reply; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-14 21:26 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: LKML, x86 team
On 4/14/19 11:59 AM, Thomas Gleixner wrote:
> On Sat, 13 Apr 2019, Xose Vazquez Perez wrote:
>> [ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
>> [ 0.000000] ------------[ cut here ]------------
>> [ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
>
> Does the below patch fix it for you?
>
> Thanks,
>
> tglx
>
> 8<----------------
> diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
> index 0029604af8a4..dd73d5d74393 100644
> --- a/arch/x86/mm/ioremap.c
> +++ b/arch/x86/mm/ioremap.c
> @@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
> pte = early_ioremap_pte(addr);
>
> /* Sanitize 'prot' against any unsupported bits: */
> - pgprot_val(flags) &= __default_kernel_pte_mask;
> + pgprot_val(flags) &= __supported_pte_mask;
>
> if (pgprot_val(flags))
> set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
>
Yes, it fixed it.
But there is another bug that I did not see before, but it was there:
---cut dmesg---
Freeing unused kernel image memory: 76K
------------[ cut here ]------------
x86/mm: Found insecure W+X mapping at address 0xffff9df500000000
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.0.7-300.fc30.x86_64 #1
Hardware name: Hewlett-Packard p6-2004es/2ABF, BIOS 7.16 03/23/2012
RIP: 0010:note_page+0x2ae/0x650
Code: 29 f0 48 c1 e8 0c 48 01 43 40 80 3d 54 15 2c 01 00 0f 85 07 ff ff ff 48 c7 c7 a0 d9 0a b7 c6 05 40 15 2c 01 01 e8 41 2d 06 00 <0f> 0b 4c 8b 4b 20 e9 e9 fe ff ff 48 29 d6 84 c9 0f 85 71 09 00 00
RSP: 0018:ffffb35940c63e18 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffb35940c63ec8 RCX: 0000000000000050
RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000247
RBP: 0000000000000161 R08: 0000000000000001 R09: 00000000000002ca
R10: 000000000000e844 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff9df737280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2e235a8a88 CR3: 000000012b20e002 CR4: 00000000000606e0
Call Trace:
? vprintk_emit+0x1ec/0x250
ptdump_walk_pgd_level_core+0x46a/0x4c0
? rest_init+0xaa/0xaa
kernel_init+0x2c/0x106
ret_from_fork+0x1f/0x40
---[ end trace 3288a26b9a3da7ee ]---
x86/mm: Checked W+X mappings: FAILED, 2175454 W+X pages found.
rodata_test: all tests were successful
Run /init as init process
---cut dmesg---
Thank you.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-14 21:26 ` Xose Vazquez Perez
@ 2019-04-15 8:46 ` Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
0 siblings, 2 replies; 6+ messages in thread
From: Thomas Gleixner @ 2019-04-15 8:46 UTC (permalink / raw)
To: Xose Vazquez Perez; +Cc: LKML, x86 team
Xose reported warnings when NX is disabled on the kernel command line.
__early_set_fixmap() triggers:
attempted to set unsupported pgprot: 8000000000000163
bits: 8000000000000000
supported: 7fffffffffffffff
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
__early_set_fixmap+0xa2/0xff
because it uses __default_kernel_pte_mask to mask out unsupported bits.
Use __supported_pte_mask instead.
Disabling NX on the command line also triggers the NX warning in the page
table mapping check:
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
....
Make the warning depend on NX set in __supported_pte_mask.
Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
arch/x86/mm/dump_pagetables.c | 3 ++-
arch/x86/mm/ioremap.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
#endif
/* Account the WX pages */
st->wx_pages += npages;
- WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+ WARN_ONCE(__supported_pte_mask & _PAGE_NX,
+ "x86/mm: Found insecure W+X mapping at address %pS\n",
(void *)st->start_address);
}
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixe
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
@ 2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
1 sibling, 0 replies; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-15 22:57 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: LKML, x86 team
On 4/15/19 10:46 AM, Thomas Gleixner wrote:
> Xose reported warnings when NX is disabled on the kernel command line.
Thank you for doing the dirty work.
>
> __early_set_fixmap() triggers:
>
> attempted to set unsupported pgprot: 8000000000000163
> bits: 8000000000000000
> supported: 7fffffffffffffff
>
> WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
> __early_set_fixmap+0xa2/0xff
>
> because it uses __default_kernel_pte_mask to mask out unsupported bits.
>
> Use __supported_pte_mask instead.
>
> Disabling NX on the command line also triggers the NX warning in the page
> table mapping check:
>
> WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
> ....
>
> Make the warning depend on NX set in __supported_pte_mask.
>
> Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
And
Tested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> ---
> arch/x86/mm/dump_pagetables.c | 3 ++-
> arch/x86/mm/ioremap.c | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> --- a/arch/x86/mm/dump_pagetables.c
> +++ b/arch/x86/mm/dump_pagetables.c
> @@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
> #endif
> /* Account the WX pages */
> st->wx_pages += npages;
> - WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
> + WARN_ONCE(__supported_pte_mask & _PAGE_NX,
> + "x86/mm: Found insecure W+X mapping at address %pS\n",
> (void *)st->start_address);
> }
>
> --- a/arch/x86/mm/ioremap.c
> +++ b/arch/x86/mm/ioremap.c
> @@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixe
> pte = early_ioremap_pte(addr);
>
> /* Sanitize 'prot' against any unsupported bits: */
> - pgprot_val(flags) &= __default_kernel_pte_mask;
> + pgprot_val(flags) &= __supported_pte_mask;
>
> if (pgprot_val(flags))
> set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip:x86/urgent] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
@ 2019-04-16 7:46 ` tip-bot for Thomas Gleixner
1 sibling, 0 replies; 6+ messages in thread
From: tip-bot for Thomas Gleixner @ 2019-04-16 7:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: xose.vazquez, riel, tglx, hpa, mingo, luto, bp, dave.hansen,
peterz, linux-kernel, torvalds
Commit-ID: 510bb96fe5b3480b4b22d815786377e54cb701e7
Gitweb: https://git.kernel.org/tip/510bb96fe5b3480b4b22d815786377e54cb701e7
Author: Thomas Gleixner <tglx@linutronix.de>
AuthorDate: Mon, 15 Apr 2019 10:46:07 +0200
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 16 Apr 2019 09:42:10 +0200
x86/mm: Prevent bogus warnings with "noexec=off"
Xose Vazquez Perez reported boot warnings when NX is disabled on the kernel command line.
__early_set_fixmap() triggers this warning:
attempted to set unsupported pgprot: 8000000000000163
bits: 8000000000000000
supported: 7fffffffffffffff
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
__early_set_fixmap+0xa2/0xff
because it uses __default_kernel_pte_mask to mask out unsupported bits.
Use __supported_pte_mask instead.
Disabling NX on the command line also triggers the NX warning in the page
table mapping check:
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
....
Make the warning depend on NX set in __supported_pte_mask.
Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Tested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1904151037530.1729@nanos.tec.linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/mm/dump_pagetables.c | 3 ++-
arch/x86/mm/ioremap.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index ee8f8ab46941..c0309ea9abee 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
#endif
/* Account the WX pages */
st->wx_pages += npages;
- WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+ WARN_ONCE(__supported_pte_mask & _PAGE_NX,
+ "x86/mm: Found insecure W+X mapping at address %pS\n",
(void *)st->start_address);
}
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0029604af8a4..dd73d5d74393 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-04-16 7:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-13 20:53 bug disabling NX (noexec=off) Xose Vazquez Perez
2019-04-14 9:59 ` Thomas Gleixner
2019-04-14 21:26 ` Xose Vazquez Perez
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.