Re: [gentoo-hardened] stack fault in kernel mode with i686 with 2.6.26-r9 and 2.6.27-r8

[basile]

pageexec@××××××××.hu wrote:
> On 7 Mar 2009 at 18:39, basile wrote:
>
>
>> Hi guys,
>>
>> I'm encountering a reproduceable problem with hardened 2.6.26-r9 and
>> 2.6.27-r8 that wasn't there with 2.6.25-r13 on i686, and isn't there
>> with amd64 using approximately the same kernel configuration in every
>> case.  I've been able to reproduce it in vmware, qemu and on physical
>> boxes, one with a Intel(R) Core(TM)2 Quad CPU Q6700, the other AMD
>> Athlon(tm) 64 FX-62 Dual Core.  It a stack fault in kernel mode, but I
>> can't pin it down further.  It happens almost immediately after the
>> bootloader passes control to the kernel.  The best error message comes
>> from qemu which gives the states of the registers.  Here's the error
>> message from a bootable ISO I made suing 2.6.26-r9.  Any idea where I
>> can start tackling this one?
>>
>
> you'll have to check what code was executed just before the triple fault,
> start at around EIP. also passing -d in_asm,int,exec,cpu,pcall will pro
> a nice log file that will make it even easier.
>
>
>> # qemu -cdrom th-i686-20090307-RC3.iso
>> qemu: fatal: triple fault
>> EAX=000000ff EBX=0153cac0 ECX=0013a2d1 EDX=0013a2d1
>> ESI=0024c000 EDI=01400000 EBP=01541a20 ESP=01541a10
>> EIP=0153a2d0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
>>
>   ^^^^^^^^^^^^
>
>
1) Thanks for the suggestion with  -d in_asm,int,exec,cpu,pcall  Very
useful.

2) I've localized the problem, but I can't figure out what's changed
from 2.6.25 to 2.6.26/2.6.27.  The triple fault occurs when activating
CONFIG_PAX_KERNEXEC in the later two, but poses no problem in 2.6.25. 
Comparing the source trees for 2.6.25-hardened-r13 and
2.6.26-hardened-r9, I found no clues tracing back from places where
#ifdef CONFIG_PAX_KERNEXEC includes code.  I compared the patches
(4420_grsec) and the only "suspicious" changes I saw were 1) in
arch/x86/kernel/module_32.c where invoking vmalloc changed and 2) in
arch/x86/kernel/head64.c (2.6.25) -> arch/x86/kernel/head_32.S (2.6.26)
there is some inline assembly which changed.  I don't really understand
these two changes yet.

Any more suggestions?  I can always disable the option, but I like the
feature.

-- 

Anthony G. Basile, Ph.D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
USA

[phone]