2004-10-06 22:24:25

by Pavel Machek

[permalink] [raw]
Subject: __init poisoning for i386, too

Hi!

Overwrite __init section so calls to __init functions from normal code
are catched, reliably. I wonder if this should be configurable... but
it is configurable on x86-64 so I copied it. Please apply,

Pavel

--- tmp/linux/arch/i386/Kconfig.debug 2004-10-01 00:29:59.000000000 +0200
+++ linux/arch/i386/Kconfig.debug 2004-10-07 00:11:09.000000000 +0200
@@ -15,6 +15,13 @@
with klogd/syslogd or the X server. You should normally N here,
unless you want to debug such a crash.

+config INIT_DEBUG
+ bool "Debug __init statements"
+ depends on DEBUG_KERNEL
+ help
+ Fill __init and __initdata at the end of boot. This helps debugging
+ illegal uses of __init and __initdata after initialization.
+
config DEBUG_STACKOVERFLOW
bool "Check for stack overflows"
depends on DEBUG_KERNEL
--- tmp/linux/arch/i386/mm/init.c 2004-10-01 00:29:59.000000000 +0200
+++ linux/arch/i386/mm/init.c 2004-10-07 00:09:04.000000000 +0200
@@ -705,6 +705,9 @@
ClearPageReserved(virt_to_page(addr));
set_page_count(virt_to_page(addr), 1);
free_page(addr);
+#ifdef CONFIG_INIT_DEBUG
+ memset((void *)(addr & ~(PAGE_SIZE-1)), 0xcc, PAGE_SIZE);
+#endif
totalram_pages++;
}
printk (KERN_INFO "Freeing unused kernel memory: %dk freed\n", (__init_end - __init_begin) >> 10);

--
People were complaining that M$ turns users into beta-testers...
...jr ghea gurz vagb qrirybcref, naq gurl frrz gb yvxr vg gung jnl!


2004-10-06 22:32:18

by Andrew Morton

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

Pavel Machek <[email protected]> wrote:
>
> Overwrite __init section so calls to __init functions from normal code
> are catched, reliably. I wonder if this should be configurable... but
> it is configurable on x86-64 so I copied it. Please apply,

No, I'll change it to just enable the thing unconditionally.

2004-10-07 00:04:54

by Nigel Cunningham

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

Hi.

On Thu, 2004-10-07 at 08:18, Pavel Machek wrote:
> free_page(addr);
> +#ifdef CONFIG_INIT_DEBUG
> + memset((void *)(addr & ~(PAGE_SIZE-1)), 0xcc, PAGE_SIZE);
> +#endif

Shouldn't the memset be before the free_page? (Changing freed pages?)

Regards,

Nigel
--
Nigel Cunningham
Pastoral Worker
Christian Reformed Church of Tuggeranong
PO Box 1004, Tuggeranong, ACT 2901

Many today claim to be tolerant. True tolerance, however, can cope with others
being intolerant.

2004-10-07 06:16:27

by William Lee Irwin III

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

On Thu, Oct 07, 2004 at 12:18:55AM +0200, Pavel Machek wrote:
> Overwrite __init section so calls to __init functions from normal code
> are catched, reliably. I wonder if this should be configurable... but
> it is configurable on x86-64 so I copied it. Please apply,

Any chance we could:
(a) set the stuff to 0x0f0b so illegal instructions come of it; jumps are
most often aligned to something > 16 bits anyway
(b) poison __initdata, memsetting to some bit pattern oopsable to dereference


-- wli

2004-10-07 08:02:54

by Pavel Machek

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

Hi!

> On Thu, 2004-10-07 at 08:18, Pavel Machek wrote:
> > free_page(addr);
> > +#ifdef CONFIG_INIT_DEBUG
> > + memset((void *)(addr & ~(PAGE_SIZE-1)), 0xcc, PAGE_SIZE);
> > +#endif
>
> Shouldn't the memset be before the free_page? (Changing freed pages?)

Ouch, you are right. Interrupt could come and grab them. Yes, we need
first memset, then free_page().
Pavel
--
People were complaining that M$ turns users into beta-testers...
...jr ghea gurz vagb qrirybcref, naq gurl frrz gb yvxr vg gung jnl!

2004-10-07 08:22:29

by Geert Uytterhoeven

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

On Wed, 6 Oct 2004, Andrew Morton wrote:
> Pavel Machek <[email protected]> wrote:
> > Overwrite __init section so calls to __init functions from normal code
> > are catched, reliably. I wonder if this should be configurable... but
> > it is configurable on x86-64 so I copied it. Please apply,
>
> No, I'll change it to just enable the thing unconditionally.

And can't such things be done in architecture-neutral code, to avoid code
duplication and out-of-sync code among different architectures?

The magic value that corresponds to an illegal instruction (as suggested by
wli) is arch-dependent, of course.

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

2004-10-07 11:28:12

by Andi Kleen

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

William Lee Irwin III <[email protected]> writes:

> On Thu, Oct 07, 2004 at 12:18:55AM +0200, Pavel Machek wrote:
> > Overwrite __init section so calls to __init functions from normal code
> > are catched, reliably. I wonder if this should be configurable... but
> > it is configurable on x86-64 so I copied it. Please apply,
>
> Any chance we could:
> (a) set the stuff to 0x0f0b so illegal instructions come of it; jumps are
> most often aligned to something > 16 bits anyway

0xcc is an int3, that already causes an oops.

> (b) poison __initdata, memsetting to some bit pattern oopsable to dereference

Would be a good idea yes. I will add it to x86-64.

-Andi

2004-10-07 21:21:21

by H. Peter Anvin

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

Followup to: <[email protected]>
By author: William Lee Irwin III <[email protected]>
In newsgroup: linux.dev.kernel
>
> On Thu, Oct 07, 2004 at 12:18:55AM +0200, Pavel Machek wrote:
> > Overwrite __init section so calls to __init functions from normal code
> > are catched, reliably. I wonder if this should be configurable... but
> > it is configurable on x86-64 so I copied it. Please apply,
>
> Any chance we could:
> (a) set the stuff to 0x0f0b so illegal instructions come of it; jumps are
> most often aligned to something > 16 bits anyway
> (b) poison __initdata, memsetting to some bit pattern oopsable to dereference
>

What's wrong with using 0xCC (breakpoint instruction)?

If you want an illegal instruction, 0xFF 0xFF is an illegal
instruction, so filling memory with 0xFF will do what you want.

-hpa

2004-10-08 11:09:05

by William Lee Irwin III

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

At some point in the past, I wrote:
>> Any chance we could:
>> (a) set the stuff to 0x0f0b so illegal instructions come of it; jumps are
>> most often aligned to something > 16 bits anyway
>> (b) poison __initdata, memsetting to some bit pattern oopsable to dereference

On Thu, Oct 07, 2004 at 09:05:45PM +0000, H. Peter Anvin wrote:
> What's wrong with using 0xCC (breakpoint instruction)?
> If you want an illegal instruction, 0xFF 0xFF is an illegal
> instruction, so filling memory with 0xFF will do what you want.

That sounds better than what I suggested.


-- wli

2004-10-08 11:28:41

by Ryan Cumming

[permalink] [raw]
Subject: Re: __init poisoning for i386, too

On Friday 08 October 2004 04:08, you wrote:
> On Thu, Oct 07, 2004 at 09:05:45PM +0000, H. Peter Anvin wrote:
> > What's wrong with using 0xCC (breakpoint instruction)?
> > If you want an illegal instruction, 0xFF 0xFF is an illegal
> > instruction, so filling memory with 0xFF will do what you want.
>
> That sounds better than what I suggested.
>

Here's the trivial patch against 2.4.9-rc3-mm3

-Ryan


Attachments:
(No filename) (0.00 B)
(No filename) (189.00 B)
Download all attachments