From: "PaX Team" <pageexec@freemail.hu>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: spender@grsecurity.net,
WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: Kernel Panic
Date: Wed, 07 Dec 2016 01:44:44 +0100 [thread overview]
Message-ID: <58475B7C.14182.19D586@pageexec.freemail.hu> (raw)
In-Reply-To: <CAHmME9q+oEAo+HuSRf8WJoGv+jbsA46c3GHXCUT4QvX8a+k23w@mail.gmail.com>
On 6 Dec 2016 at 23:39, Jason A. Donenfeld wrote:
[added spender to CC as it's his feature in grsec]
> Hey PaXTeam,
>
> I tracked down Samuel's bug to this line in crypto/scatterwalk.c:
> if (sg_page(sg) == virt_to_page(realbuf) &&
>
> virt_to_page is redefined for CONFIG_GRKERNSEC_KSTACKOVERFLOW:
>
> #define virt_to_page(kaddr) \
> ({ \
> const void *__kaddr = (const void *)(kaddr); \
> BUG_ON(!virt_addr_valid(__kaddr)); \
> pfn_to_page(__pa(__kaddr) >> PAGE_SHIFT); \
> })
>
> So that's where the bug is hit. Now why is this happening?
>
> I call scatterwalk_map_and_copy to read or write from or to a stack
> buffer
that's is your problem, DMA is forbidden to/from the stack in linux,
Documentation/DMA-API-HOWTO.txt says this:
This rule also means that you may use neither kernel image addresses
(items in data/text/bss segments), nor module image addresses, nor
stack addresses for DMA.
> from a scattergather list, inside some crypto code that does
> MAC checking. When virt_addr_valid(__kaddr) returns false, it is only
> after PaX has additionally messed with its value. A few lines above
> the call to virt_to_page is:
>
> #ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
> if (object_starts_on_stack(buf))
> realbuf = buf - current->stack + current->lowmem_stack;
> #endif
>
> Presumably this condition winds up being true, and then that
> arithmetic is wrong somehow. Alternatively, that condition isn't true
> due to a bug in object_starts_on_stack, and that arithmetic doesn't
> run when it needs to run.
>
> Samuel reported that the problem did not exist on 4.7 but does exist
> on 4.8. If my memory serves me correctly, 4.8 introduced virtually
> mapped stacks. Could it be that this virtual mapping now eliminates
> the need for that arithmetic?
upstream will have 'virtually mapped stacks' (stupid name btw, stack is
always virtually mapped on MMU-capable systems :) as of 4.9 only, what
you're seeing above is grsec's KSTACKOVERFLOW feature which had a little
bonus added in 4.8 to handle (and detect the abuse of) IRQ stacks as well.
> Regards,
> Jason
next prev parent reply other threads:[~2016-12-07 0:39 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-06 6:23 Samuel Holland
2016-12-06 18:19 ` Jason A. Donenfeld
2016-12-06 18:26 ` Samuel Holland
2016-12-06 18:31 ` Jason A. Donenfeld
2016-12-06 22:39 ` Jason A. Donenfeld
2016-12-07 0:44 ` PaX Team [this message]
2016-12-07 10:38 ` Jason A. Donenfeld
[not found] ` <CAHmME9pVCDu88c6n+LV9Mtd5Ohu8o-7RSQB4kRjsHGRQ3jF8zw@mail.gmail.com>
[not found] ` <20161208231626.GA5230@grsecurity.net>
2016-12-09 11:17 ` Jason A. Donenfeld
[not found] ` <20161209121144.GA31448@grsecurity.net>
2016-12-09 12:56 ` Jason A. Donenfeld
2016-12-09 13:27 ` Jason A. Donenfeld
2016-12-09 15:54 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58475B7C.14182.19D586@pageexec.freemail.hu \
--to=pageexec@freemail.hu \
--cc=Jason@zx2c4.com \
--cc=spender@grsecurity.net \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).