* bug disabling NX (noexec=off)
@ 2019-04-13 20:53 Xose Vazquez Perez
2019-04-14 9:59 ` Thomas Gleixner
0 siblings, 1 reply; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-13 20:53 UTC (permalink / raw)
To: LKML, x86 team
Hi,
Intel Core i3-2120 + kernel-5.0.7 x86_64 from Fedora:
[ 0.000000] microcode: microcode updated early to revision 0x2e, date = 2018-04-10
[ 0.000000] Linux version 5.0.7-300.fc30.x86_64 (mockbuild@bkernel04.phx2.fedoraproject.org) (gcc version 9.0.1 20190312 (Red Hat 9.0.1-0.10) (GCC)) #1 SMP Mon Apr 8 18:28:09 UTC 2019
[ 0.000000] Command line: BOOT_IMAGE=(hd0,msdos1)/boot/vmlinuz-5.0.7-300.fc30.x86_64 root=UUID=ea93877a-9487-4416-9f32-9d1fba2a639a ro quiet audit=0 usb-storage.delay_use=0 net.ifnames=0
plymouth.enable=0 pti=off spectre_v2=off spectre_v2_user=off spec_store_bypass_disable=off l1tf=off noexec=off
[...]
[ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
[ 0.000000] ------------[ cut here ]------------
[ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
[ 0.000000] WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537 __early_set_fixmap+0xa2/0xff
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.7-300.fc30.x86_64 #1
[ 0.000000] RIP: 0010:__early_set_fixmap+0xa2/0xff
[ 0.000000] Code: ed be ff 49 21 cc 4c 39 e2 74 21 80 3d b8 a2 bb ff 00 75 18 4c 31 e2 48 c7 c7 68 b6 09 ac c6 05 a5 a2 bb ff 01 e8 ae ba 95 fe <0f> 0b 4c 89 e7 4c 09 ef ff 14 25 98 e2 22 ac 48 89
c6 48 89 df ff
[ 0.000000] RSP: 0000:ffffffffac203de8 EFLAGS: 00010082 ORIG_RAX: 0000000000000000
[ 0.000000] RAX: 0000000000000000 RBX: ffffffffac972000 RCX: 0000000000000078
[ 0.000000] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000047
[ 0.000000] RBP: ffffffffff200000 R08: 0000000000000001 R09: 0000000000000024
[ 0.000000] R10: 0000000000000c1c R11: 0000000000000003 R12: 0000000000000163
[ 0.000000] R13: 00000000000f0000 R14: 0000000000010000 R15: 0000000000000000
[ 0.000000] FS: 0000000000000000(0000) GS:ffffffffac73a000(0000) knlGS:0000000000000000
[ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.000000] CR2: ffff888046212ff8 CR3: 00000000467de000 CR4: 00000000000406a0
[ 0.000000] Call Trace:
[ 0.000000] ? __early_ioremap+0x10b/0x189
[ 0.000000] ? dmi_scan_machine+0xfe/0x209
[ 0.000000] ? setup_arch+0x436/0xc9f
[ 0.000000] ? start_kernel+0x65/0x519
[ 0.000000] ? secondary_startup_64+0xa4/0xb0
[ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x26/0x40 with crng_init=0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] SMBIOS 2.6 present.
[...]
The same happens in a T61 with an Intel Core 2 Duo T7300.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: bug disabling NX (noexec=off)
2019-04-13 20:53 bug disabling NX (noexec=off) Xose Vazquez Perez
@ 2019-04-14 9:59 ` Thomas Gleixner
2019-04-14 21:26 ` Xose Vazquez Perez
0 siblings, 1 reply; 6+ messages in thread
From: Thomas Gleixner @ 2019-04-14 9:59 UTC (permalink / raw)
To: Xose Vazquez Perez; +Cc: LKML, x86 team
On Sat, 13 Apr 2019, Xose Vazquez Perez wrote:
> [ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
> [ 0.000000] ------------[ cut here ]------------
> [ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
Does the below patch fix it for you?
Thanks,
tglx
8<----------------
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0029604af8a4..dd73d5d74393 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: bug disabling NX (noexec=off)
2019-04-14 9:59 ` Thomas Gleixner
@ 2019-04-14 21:26 ` Xose Vazquez Perez
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
0 siblings, 1 reply; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-14 21:26 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: LKML, x86 team
On 4/14/19 11:59 AM, Thomas Gleixner wrote:
> On Sat, 13 Apr 2019, Xose Vazquez Perez wrote:
>> [ 0.000000] NX (Execute Disable) protection: disabled by kernel command line option
>> [ 0.000000] ------------[ cut here ]------------
>> [ 0.000000] attempted to set unsupported pgprot: 8000000000000163 bits: 8000000000000000 supported: 7fffffffffffffff
>
> Does the below patch fix it for you?
>
> Thanks,
>
> tglx
>
> 8<----------------
> diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
> index 0029604af8a4..dd73d5d74393 100644
> --- a/arch/x86/mm/ioremap.c
> +++ b/arch/x86/mm/ioremap.c
> @@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
> pte = early_ioremap_pte(addr);
>
> /* Sanitize 'prot' against any unsupported bits: */
> - pgprot_val(flags) &= __default_kernel_pte_mask;
> + pgprot_val(flags) &= __supported_pte_mask;
>
> if (pgprot_val(flags))
> set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
>
Yes, it fixed it.
But there is another bug that I did not see before, but it was there:
---cut dmesg---
Freeing unused kernel image memory: 76K
------------[ cut here ]------------
x86/mm: Found insecure W+X mapping at address 0xffff9df500000000
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
Modules linked in:
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.0.7-300.fc30.x86_64 #1
Hardware name: Hewlett-Packard p6-2004es/2ABF, BIOS 7.16 03/23/2012
RIP: 0010:note_page+0x2ae/0x650
Code: 29 f0 48 c1 e8 0c 48 01 43 40 80 3d 54 15 2c 01 00 0f 85 07 ff ff ff 48 c7 c7 a0 d9 0a b7 c6 05 40 15 2c 01 01 e8 41 2d 06 00 <0f> 0b 4c 8b 4b 20 e9 e9 fe ff ff 48 29 d6 84 c9 0f 85 71 09 00 00
RSP: 0018:ffffb35940c63e18 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffb35940c63ec8 RCX: 0000000000000050
RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000247
RBP: 0000000000000161 R08: 0000000000000001 R09: 00000000000002ca
R10: 000000000000e844 R11: 0000000000000003 R12: 0000000000000000
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff9df737280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2e235a8a88 CR3: 000000012b20e002 CR4: 00000000000606e0
Call Trace:
? vprintk_emit+0x1ec/0x250
ptdump_walk_pgd_level_core+0x46a/0x4c0
? rest_init+0xaa/0xaa
kernel_init+0x2c/0x106
ret_from_fork+0x1f/0x40
---[ end trace 3288a26b9a3da7ee ]---
x86/mm: Checked W+X mappings: FAILED, 2175454 W+X pages found.
rodata_test: all tests were successful
Run /init as init process
---cut dmesg---
Thank you.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-14 21:26 ` Xose Vazquez Perez
@ 2019-04-15 8:46 ` Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
0 siblings, 2 replies; 6+ messages in thread
From: Thomas Gleixner @ 2019-04-15 8:46 UTC (permalink / raw)
To: Xose Vazquez Perez; +Cc: LKML, x86 team
Xose reported warnings when NX is disabled on the kernel command line.
__early_set_fixmap() triggers:
attempted to set unsupported pgprot: 8000000000000163
bits: 8000000000000000
supported: 7fffffffffffffff
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
__early_set_fixmap+0xa2/0xff
because it uses __default_kernel_pte_mask to mask out unsupported bits.
Use __supported_pte_mask instead.
Disabling NX on the command line also triggers the NX warning in the page
table mapping check:
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
....
Make the warning depend on NX set in __supported_pte_mask.
Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
arch/x86/mm/dump_pagetables.c | 3 ++-
arch/x86/mm/ioremap.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
#endif
/* Account the WX pages */
st->wx_pages += npages;
- WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+ WARN_ONCE(__supported_pte_mask & _PAGE_NX,
+ "x86/mm: Found insecure W+X mapping at address %pS\n",
(void *)st->start_address);
}
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixe
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
@ 2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
1 sibling, 0 replies; 6+ messages in thread
From: Xose Vazquez Perez @ 2019-04-15 22:57 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: LKML, x86 team
On 4/15/19 10:46 AM, Thomas Gleixner wrote:
> Xose reported warnings when NX is disabled on the kernel command line.
Thank you for doing the dirty work.
>
> __early_set_fixmap() triggers:
>
> attempted to set unsupported pgprot: 8000000000000163
> bits: 8000000000000000
> supported: 7fffffffffffffff
>
> WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
> __early_set_fixmap+0xa2/0xff
>
> because it uses __default_kernel_pte_mask to mask out unsupported bits.
>
> Use __supported_pte_mask instead.
>
> Disabling NX on the command line also triggers the NX warning in the page
> table mapping check:
>
> WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
> ....
>
> Make the warning depend on NX set in __supported_pte_mask.
>
> Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
And
Tested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> ---
> arch/x86/mm/dump_pagetables.c | 3 ++-
> arch/x86/mm/ioremap.c | 2 +-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> --- a/arch/x86/mm/dump_pagetables.c
> +++ b/arch/x86/mm/dump_pagetables.c
> @@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
> #endif
> /* Account the WX pages */
> st->wx_pages += npages;
> - WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
> + WARN_ONCE(__supported_pte_mask & _PAGE_NX,
> + "x86/mm: Found insecure W+X mapping at address %pS\n",
> (void *)st->start_address);
> }
>
> --- a/arch/x86/mm/ioremap.c
> +++ b/arch/x86/mm/ioremap.c
> @@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixe
> pte = early_ioremap_pte(addr);
>
> /* Sanitize 'prot' against any unsupported bits: */
> - pgprot_val(flags) &= __default_kernel_pte_mask;
> + pgprot_val(flags) &= __supported_pte_mask;
>
> if (pgprot_val(flags))
> set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip:x86/urgent] x86/mm: Prevent bogus warnings with "noexec=off"
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
@ 2019-04-16 7:46 ` tip-bot for Thomas Gleixner
1 sibling, 0 replies; 6+ messages in thread
From: tip-bot for Thomas Gleixner @ 2019-04-16 7:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: xose.vazquez, riel, tglx, hpa, mingo, luto, bp, dave.hansen,
peterz, linux-kernel, torvalds
Commit-ID: 510bb96fe5b3480b4b22d815786377e54cb701e7
Gitweb: https://git.kernel.org/tip/510bb96fe5b3480b4b22d815786377e54cb701e7
Author: Thomas Gleixner <tglx@linutronix.de>
AuthorDate: Mon, 15 Apr 2019 10:46:07 +0200
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 16 Apr 2019 09:42:10 +0200
x86/mm: Prevent bogus warnings with "noexec=off"
Xose Vazquez Perez reported boot warnings when NX is disabled on the kernel command line.
__early_set_fixmap() triggers this warning:
attempted to set unsupported pgprot: 8000000000000163
bits: 8000000000000000
supported: 7fffffffffffffff
WARNING: CPU: 0 PID: 0 at arch/x86/include/asm/pgtable.h:537
__early_set_fixmap+0xa2/0xff
because it uses __default_kernel_pte_mask to mask out unsupported bits.
Use __supported_pte_mask instead.
Disabling NX on the command line also triggers the NX warning in the page
table mapping check:
WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:262 note_page+0x2ae/0x650
....
Make the warning depend on NX set in __supported_pte_mask.
Reported-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Tested-by: Xose Vazquez Perez <xose.vazquez@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1904151037530.1729@nanos.tec.linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/mm/dump_pagetables.c | 3 ++-
arch/x86/mm/ioremap.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index ee8f8ab46941..c0309ea9abee 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -259,7 +259,8 @@ static void note_wx(struct pg_state *st)
#endif
/* Account the WX pages */
st->wx_pages += npages;
- WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+ WARN_ONCE(__supported_pte_mask & _PAGE_NX,
+ "x86/mm: Found insecure W+X mapping at address %pS\n",
(void *)st->start_address);
}
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 0029604af8a4..dd73d5d74393 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -825,7 +825,7 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
pte = early_ioremap_pte(addr);
/* Sanitize 'prot' against any unsupported bits: */
- pgprot_val(flags) &= __default_kernel_pte_mask;
+ pgprot_val(flags) &= __supported_pte_mask;
if (pgprot_val(flags))
set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-04-16 7:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-13 20:53 bug disabling NX (noexec=off) Xose Vazquez Perez
2019-04-14 9:59 ` Thomas Gleixner
2019-04-14 21:26 ` Xose Vazquez Perez
2019-04-15 8:46 ` [PATCH] x86/mm: Prevent bogus warnings with "noexec=off" Thomas Gleixner
2019-04-15 22:57 ` Xose Vazquez Perez
2019-04-16 7:46 ` [tip:x86/urgent] " tip-bot for Thomas Gleixner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).