Re: problem starting /sbin/init (32-bit 5.3-rc8)

[Kees Cook <keescook@chromium.org>]

On Thu, Sep 12, 2019 at 02:40:19PM -0700, Randy Dunlap wrote:
> This is 32-bit kernel, just happens to be running on a 64-bit laptop.
> I added the debug printk in __phys_addr() just before "[cut here]".
> 
> CONFIG_HARDENED_USERCOPY=y

I can reproduce this under CONFIG_DEBUG_VIRTUAL=y, and it goes back
to at least to v5.2. Booting with "hardened_usercopy=off" or without
CONFIG_DEBUG_VIRTUAL makes this go away (since __phys_addr() doesn't
get called):

__check_object_size+0xff/0x1b0:
pfn_to_section_nr at include/linux/mmzone.h:1153
(inlined by) __pfn_to_section at include/linux/mmzone.h:1291
(inlined by) virt_to_head_page at include/linux/mm.h:729
(inlined by) check_heap_object at mm/usercopy.c:230
(inlined by) __check_object_size at mm/usercopy.c:280

Is virt_to_head_page() illegal to use under some recently new conditions?

> The BUG is this line in arch/x86/mm/physaddr.c:
> 		VIRTUAL_BUG_ON((phys_addr >> PAGE_SHIFT) > max_low_pfn);
> It's line 83 in my source file only due to adding <linux/printk.h> and
> a conditional pr_crit() call.
> 
> 
> [   19.730409][    T1] debug: unmapping init [mem 0xdc7bc000-0xdca30fff]
> [   19.734289][    T1] Write protecting kernel text and read-only data: 13888k
> [   19.737675][    T1] rodata_test: all tests were successful
> [   19.740757][    T1] Run /sbin/init as init process
> [   19.792877][    T1] __phys_addr: max_low_pfn=0x36ffe, x=0xff001ff1, phys_addr=0x3f001ff1
> [   19.796561][    T1] ------------[ cut here ]------------
> [   19.797501][    T1] kernel BUG at ../arch/x86/mm/physaddr.c:83!
> [   19.802799][    T1] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> [   19.803782][    T1] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.3.0-rc8 #6
> [   19.803782][    T1] Hardware name: Dell Inc. Inspiron 1318                   /0C236D, BIOS A04 01/15/2009
> [   19.803782][    T1] EIP: __phys_addr+0xaf/0x100
> [   19.803782][    T1] Code: 85 c0 74 67 89 f7 c1 ef 0c 39 f8 73 2e 56 53 50 68 90 9f 1f dc 68 00 eb 45 dc e8 ec b3 09 00 83 c4 14 3b 3d 30 55 cf dc 76 11 <0f> 0b b8 7c 3b 5c dc e8 45 53 4c 00 90 8d 74 26 00 89 d8 e8 39 cd
> [   19.803782][    T1] EAX: 00000044 EBX: ff001ff1 ECX: 00000000 EDX: db90a471
> [   19.803782][    T1] ESI: 3f001ff1 EDI: 0003f001 EBP: f41ddea0 ESP: f41dde90
> [   19.803782][    T1] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010216
> [   19.803782][    T1] CR0: 80050033 CR2: dc218544 CR3: 1ca39000 CR4: 000406d0
> [   19.803782][    T1] Call Trace:
> [   19.803782][    T1]  __check_object_size+0xaf/0x3c0
> [   19.803782][    T1]  ? __might_sleep+0x80/0xa0
> [   19.803782][    T1]  copy_strings+0x1c2/0x370
> [   19.803782][    T1]  copy_strings_kernel+0x2b/0x40
> 
> Full boot log or kernel .config file are available if wanted.

I'll see if I can bisect, but I'm getting on a plane soon...

-- 
Kees Cook