Date: Wed, 9 Jan 2019 10:38:35 +0800 From: Jason Yan <yanaijie@...wei.com> To: Kees Cook <keescook@...omium.org>, Jann Horn <jannh@...gle.com> CC: Kernel Hardening <kernel-hardening@...ts.openwall.com>, <zhaohongjiang@...wei.com>, <miaoxie@...wei.com>, Li Bin <huawei.libin@...wei.com>, Wei Yongjun <weiyongjun1@...wei.com> Subject: Re: [PATCH] usercopy: skip the check if not a real usercopy On 2019/1/9 10:26, Jason Yan wrote: > Hi all, > > On 2019/1/9 7:54, Kees Cook wrote: >> I would think we'd still want to be performing bounds-checking even in >> the kernel-to-kernel case. It seems like there is some other issue >> here? Why would the check stall? >> >> Can you find out from your build what your top-of-dump line this >> resolves to? (My various kernel version builds don't share the same >> function size, so this doesn't resolve for me...) >> >> $ ./scripts/faddr2line vmlinux __check_object_size+0x1f1/0x460 >> >> Maybe it's getting stuck in loop doing stack frame walking? I'd expect >> that to show up in the backtrace though (since it's noinline). > > > It's very easy to reproduce in qemu using my config with v4.20. Please > refer to the attachment. > > I did some debug and found that check_object_size() did not stuck but > check_object_size() sometimes takes more than 30 milliseconds, and > ftrace will call __probe_kernel_write() thousands of times, which makes > the whole process stuck for more than 20 seconds. And I tried kernel v5.0-rc1，the system directly reboot and didn't print any thing. [root@...alhost ~]# [root@...alhost ~]# cat functiontracer.sh ping 127.0.0.1 -i 0.01 > /dev/null & sleep 1 echo function > /sys/kernel/debug/tracing/current_tracer [root@...alhost ~]# [root@...alhost ~]# [root@...alhost ~]# sh functiontracer.sh [ 43.972860] hrtimer: interrupt took 3515386 ns [ 0.000000] Linux version 5.0.0-rc1-522.214.171.124.x86_64 (yanaijie@138) (gcc version 7.3.1 20180712 (Red Hat 7.3.1-6) (GCC)) #72 SMP Wed Jan 9 09:25:31 CST 2019 [ 0.000000] Command line: console=ttyS0 IP=192.168.25.187 root=/dev/vda rw [ 0.000000] x86/fpu: x87 FPU will use FXSAVE [ 0.000000] BIOS-provided physical RAM map: [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffddfff] usable [ 0.000000] BIOS-e820: [mem 0x00000000bffde000-0x00000000bfffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.