Re: [gentoo-hardened] kernel upgrade problems: bad page state

[Brian Kroth]

pageexec@××××××××.hu wrote:
> On 3 Nov 2007 at 19:02, Brian Kroth wrote:
>
>>> i'm almost sure it's a bug somewhere in vma mirroring as that's the
>>> only thing i changed in .22 and on and it does play with page locking
>>> (the bad page state is triggered because a to-be-freed page is still
>>> locked, that's means there's a missing unlock somewhere in the code,
>>> but i couldn't figure it out from the code yet).
>> Where's the code for this?  I'm no kernel guru by any means, but I'd
>> still be interested to look at it and learn.
>
> it's all of mm/memory.c:pax*mirror*pte() .
>
>> So far this is only on that single machine, and only for nagios and
>> cacti.
>
> based on the maps files, both cactid and nagios are PIEs. two questions:
> are they the only PIEs on this system (that regularly run, that is) and
> do you have PIEs on the other systems that don't show the symptomps?

I'm using the hardened/x86/2.6 profile which enables the pic use flag. 
Here's where my understanding gets hazy.  PIC != PIE, but the two are 
related in that PIC creates position independent code, but not for 
executables?  Anyways, how would I check?

>
>> I rebuilt the kernel with the config that's attached.  I've
>> basically turned on a few more debug settings in the kernel and turned
>> off the randomization features of pax (CONFIG_PAX_ASLR) and the "remove
>> addresses" feature of grsec (CONFIG_GRKERNSEC_PROC_MEMMAP) like you
>> asked.  Tweaked my sec script to copy the maps files before killing the
>> offending processes.  Everything should be in the tar.  Let me know if
>> you need anything else.
>
> ok, three more things please. first, 'echo 0 >|
> /proc/sys/kernel/randomize_va_space'
> as well (in fact, you can re-enable ASLR in PaX, the sysctl controls it as
> well), second, enable CONFIG_FRAME_POINTER (this will change memory.o so
> i'll need it again), third, add the following patch on top of PaX (i think
> it'll patch over grsec as well, maybe with offsets). note that it's most
> likely whitespace damaged, but should be easy to copy/paste by hand:
>
> --- linux-2.6.23-pax/mm/memory.c        2007-10-23 00:27:08.000000000 +0200
> +++ linux-2.6.23-pax-debug/mm/memory.c  2007-11-04 01:33:04.000000000 +0100
> @@ -1960,6 +1960,8 @@ gotten:
>         }
>         if (new_page)
>                 page_cache_release(new_page);
> +       if (old_page && (old_page->flags & PG_locked))
> +               printk("PAX: %u %08lx %08lx-%08lx %08lx\n", current->pid,
> address, vma->vm_start, vma->vm_end, vma->vm_pgoff);
>         if (old_page)
>                 page_cache_release(old_page);
>  unlock:

I added this to the 2.6.22-hardened-r8 kernel, it's building now - do 
you want me to be testing this with 2.6.23?

>
> i'll again need the logs (there will be more info in it because of the above)
> and the maps file of the failing process.
>
>> PS - would you like me to take this off list?
>
> no need unless you don't want to leak any more of your host names
> in kernel logs ;-). actually, attachments this big you can send me
> directly and don't bother the list with it, but the discussion may
> be interesting for others as well.
>