Hi,
Le 23/08/2020 à 19:26, Giuseppe Sacco a écrit :
Hello,
I am not a kernel developer and I need much help in order to understand
a kernel Oops (the first of a series of three Oops). It is:
This is a bug in the kernel. It is fixed in 5.9-rc2.
See the following commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/powerpc/mm/book3s32/mmu.c?h=v5.9-rc2&id=541cebb51f3422d4f2c6cb95c1e5cc3dcc9e5021
Christophe
kernel tried to execute exec-protected page (f1020000) - exploit attempt? (uid:
0)
BUG: Unable to handle kernel instruction fetch
Faulting instruction address: 0xf1020000
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K MMU=Hash PowerMac
Modules linked in: crct10dif_generic (+) crct10dif_common
drm_panel_orientation_quirks
CPU: 0 PID: 71 Comm: systemd-udevd Not tainted 5.9.0-rc1+ #298
NIP: f1020000 LR: c00053a4 CTR: f1020000
REGS: c1c6dd50 TRAP: 0400 Not tainted (5.9.0-rc1+)
MSR: 10009032 <EE,ME,IR,DR,RI> CR: 22222284 XER: 00000000
GPR00: c0005390 c1c6de08 c1c6b400 00000000 00000cc0 00000008 ef6db038 00000001
GPR08: 0000002e 00000000 00000000 00000000 22222284 00b6fb58 00000000 00000005
GPR16: bff0d768 bff0d770 00000000 00000000 01032cc0 00000000 00b0b31f 01020960
GPR24: 00000000 00b70954 010206c0 ef39f4a0 00000000 00a28380 f1020000 f10193a0
NIP [f1020000] crct10dif_mod_init+0x0/0x60 [crct10dif_generic]
LR [c00053a4] do_one_initcall+0x50/0x1f4
Call Trace:
[c1c6de08] [c0005390] do_one_initcall+0x3c/0x1f4 (unreliable)
[c1c6de78] [c0102068] do_init_module+0x6c/0x27c
[c1c6dea8] [c01053cc] sys_finit_module+0xc0/0x12c
[c1c6df38] [c001c11c] ret_from_syscall+0x0/0x34
--- interrupt: c01 at 0x7a7780
LR = 0xa1bf64
Instruction dump:
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX <7c0802a6> 90010004 60000000 9421fff0
---[ end trace 257a4bbda691894e ]---
From what I understand, this is a problem in the init function of
module crct10dif_generic jumping at address f1020000.
I think I understand that f1020000 is an address for data and not for
code. In fact it belongs to "vmalloc & ioremap" area of the virtual
memory layout:
* 0xffbee000..0xfffff000 : fixmap
* 0xff400000..0xff800000 : highmem PTEs
* 0xfda27000..0xff400000 : early ioremap
* 0xf1000000..0xfda27000 : vmalloc & ioremap
The init function is:
00000000 <init_module>:
0: 7c 08 02 a6 mflr r0
4: 90 01 00 04 stw r0,4(r1)
8: 48 00 00 01 bl 8 <init_module+0x8>
c: 94 21 ff f0 stwu r1,-16(r1)
10: 7c 08 02 a6 mflr r0
14: 3c 60 00 00 lis r3,0
18: 90 01 00 14 stw r0,20(r1)
1c: 38 63 00 00 addi r3,r3,0
20: 80 01 00 14 lwz r0,20(r1)
24: 38 21 00 10 addi r1,r1,16
28: 7c 08 03 a6 mtlr r0
2c: 48 00 00 00 b 2c <init_module+0x2c>
and its source code is:
static int __init crct10dif_mod_init(void)
{
return crypto_register_shash(&alg);
}
This is what I am not understanding. The error message seems to imply
that code jumps to an invalid address, so the problem would be that
address of function crypto_register_shash is calculated wrongly.
About stack addresses, please note that CONFIG_VMAP_STACK is not set.
Is this a correct reasoning?
Thank you very much,
Giuseppe
