From: Kees Cook <kees@outflux.net>
To: "H. Peter Anvin" <hpa@zytor.com>
Cc: "Yan, Zheng" <zheng.z.yan@intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
linux-kernel@vger.kernel.org
Subject: Re: RW and executable hole in page tables on x86_64
Date: Fri, 14 Nov 2014 11:02:51 -0800 [thread overview]
Message-ID: <20141114190251.GT5451@outflux.net> (raw)
In-Reply-To: <526A874B.2040108@zytor.com>
Continuing a thread from a year ago...
On Fri, Oct 25, 2013 at 03:59:23PM +0100, H. Peter Anvin wrote:
> On 10/25/2013 02:34 PM, Kees Cook wrote:
> > Hi,
> >
> > I've noticed there's a chunk of kernel memory still marked RW and x. See
> > 0xffffffff82956000 below...
> >
> > ---[ High Kernel Mapping ]---
> > 0xffffffff80000000-0xffffffff81000000 16M pmd
> > 0xffffffff81000000-0xffffffff81a00000 10M ro PSE GLB x pmd
> > 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd
> > 0xffffffff81e00000-0xffffffff82200000 4M RW GLB NX pte
> > 0xffffffff82200000-0xffffffff82800000 6M RW PSE GLB NX pmd
> > 0xffffffff82800000-0xffffffff82956000 1368K RW GLB NX pte
> > 0xffffffff82956000-0xffffffff82a00000 680K RW GLB x pte
> > 0xffffffff82a00000-0xffffffffa0000000 470M pmd
> >
> > HPA looked at it for a bit, but it wasn't obvious what was going on. It's
> > after the end of bss. I do note that the two adjacent regions add up to
> > 2MiB. Is this some kind of leftover mapping? What is this region? Is there
> > a sensible place to clean it up?
> >
>
> It looks to be what is left after the 2 MB page for bss is broken up.
> It doesn't mean it isn't broken, though.
It looks like the problem still exists:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff9ca00000 458M pmd
0xffffffff9ca00000-0xffffffff9d200000 8M ro PSE GLB x pmd
0xffffffff9d200000-0xffffffff9d3f3000 1996K ro GLB x pte
0xffffffff9d3f3000-0xffffffff9d400000 52K ro x pte
0xffffffff9d400000-0xffffffff9d600000 2M ro PSE GLB NX pmd
0xffffffff9d600000-0xffffffff9d7e8000 1952K ro GLB NX pte
0xffffffff9d7e8000-0xffffffff9d800000 96K ro NX pte
0xffffffff9d800000-0xffffffff9d8ff000 1020K RW GLB NX pte
0xffffffff9d8ff000-0xffffffff9da2d000 1208K RW NX pte
0xffffffff9da2d000-0xffffffff9dc00000 1868K RW GLB NX pte
0xffffffff9dc00000-0xffffffff9e600000 10M RW PSE GLB NX pmd
0xffffffff9e600000-0xffffffff9e7f5000 2004K RW GLB NX pte
0xffffffff9e7f5000-0xffffffff9e800000 44K RW GLB x pte
0xffffffff9e800000-0xffffffffc0000000 536M pmd
Still seems to be the bss getting broken up. What is this left-over
memory used for? Any pointers to where it happens? I'd really like to
kill this area.
-Kees
--
Kees Cook @outflux.net
next prev parent reply other threads:[~2014-11-14 19:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-25 13:34 RW and executable hole in page tables on x86_64 Kees Cook
2013-10-25 14:59 ` H. Peter Anvin
2014-11-14 19:02 ` Kees Cook [this message]
2014-11-14 20:04 ` Thomas Gleixner
2014-11-14 20:15 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141114190251.GT5451@outflux.net \
--to=kees@outflux.net \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=zheng.z.yan@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.