Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751272AbeAEKMj (ORCPT + 1 other); Fri, 5 Jan 2018 05:12:39 -0500 Received: from mail-vk0-f68.google.com ([209.85.213.68]:38908 "EHLO mail-vk0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751012AbeAEKMf (ORCPT ); Fri, 5 Jan 2018 05:12:35 -0500 X-Google-Smtp-Source: ACJfBou5zZ4Eaikr1kJ1FtzlsNoC8qMVmr8jBKn8Sh4h7sSOgsNZQRPoSPXeWQJk+YykaqvWhUdQuC9TpozLuZVxNuM= MIME-Version: 1.0 In-Reply-To: References: <20180103195056.837404126@linuxfoundation.org> <20180104195055.GA29809@kroah.com> From: Kees Cook Date: Fri, 5 Jan 2018 02:12:33 -0800 X-Google-Sender-Auth: JAegMLWhifW20Jz9zFHw-fqyzQw Message-ID: Subject: Re: [PATCH 4.4 00/37] 4.4.110-stable review To: Andy Lutomirski Cc: Linus Torvalds , Pavel Tatashin , Thomas Voegtle , Greg Kroah-Hartman , Linux Kernel Mailing List , Andrew Morton , Guenter Roeck , Shuah Khan , patches@kernelci.org, Ben Hutchings , lkft-triage@lists.linaro.org, stable Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Thu, Jan 4, 2018 at 9:33 PM, Andy Lutomirski wrote: > On Thu, Jan 4, 2018 at 12:43 PM, Andy Lutomirski wrote: >> >>> On Jan 4, 2018, at 12:29 PM, Linus Torvalds wrote: >>> >>>> On Thu, Jan 4, 2018 at 12:16 PM, Thomas Voegtle wrote: >>>> >>>> Attached a screenshot. >>>> Is that useful? Are there some debug options I can add? >>> >>> Not much of an oops, because the SIGSEGV happens in user space. The >>> only reason you get any kernel stack printout at all is because 'init' >>> dying will make the kernel print that out. >>> >>> The segfault address for init looks like the fixmap area to me (first >>> byte in the last page of the fixmap?). "Error 5" means that it's a >>> user-space read that got a protection fault. So it's not a LDT of GDT >>> update or anything like that, it's a normal access from user space (or >>> a qemu emulation bug, but that sounds unlikely). >>> >>> Is that the vsyscall page? >>> >>> Adding Luto to the participants. I think he noticed one of the >>> vsyscall patches missing earlier in the 4.9 series. Maybe the 4.4 >>> series had something similar.. >>> >> >> That's almost certainly it. >> >> I'll try to find some time today or tomorrow to add a proper selftest. >> > > Give this a shot: > > https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git/commit/?h=x86/pti&id=17c5ebeb2e00879b0af1a9c32bf37ecdd9b9b31b > > Boot with each of vsyscall=none, vsyscall=native, and vsyscall=emulate > and run both the 32-bit and 64-bit variants of that test. All six > combinations should pass. But I bet they don't on 4.4. With my 4.4.110-rc1 under QEMU -cpu=host (Xeon E5-2690 v3) vsyscall=emulate: # ./test_vsyscall_64 ... [RUN] Checking read access to the vsyscall page [FAIL] We don't have read access, but we should vsyscall=native: # ./test_vsyscall_64 ... [RUN] Checking read access to the vsyscall page [FAIL] We don't have read access, but we should Everything else passes. Note that test_vsyscall_32 warns: # ./test_vsyscall_32 Warning: failed to find getcpu in vDSO ... -Kees -- Kees Cook Pixel Security