Re: kvm ptrace 32bit DoS bug - bisected

[Antoine Martin <antoine@nagafix.co.uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Marcelo,

Marcelo Tosatti wrote:
> On Sat, Sep 05, 2009 at 08:41:26PM +0700, Antoine Martin wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> Hi,
>>
>> I reported this bug a while ago but no-one picked up on it.
>> Just launch any UML 32-bit kernel on a 64-bit KVM guest:
>>
>> test $ ./kernel32-2.6.16.62
>> Checking that ptrace can change system call numbers...OK
>> Checking syscall emulation patch for ptrace...OK
>> Trace/breakpoint trap
>> test@localhost ~ $ Kernel panic - not syncing: Attempted to kill init!
>> Kernel panic - not syncing: Attempted to kill init!
>>
>>
>> You can find some pre-built binaries here:
>> http://uml.devloop.org.uk/kernels.html
>>
>> Since then, I've bisected it down to:
>> d4d67150165df8bf1cc05e532f6efca96f907cab is first bad commit
>> Author: Roland McGrath <roland@redhat.com>
>> Date:   Wed Jul 9 02:38:07 2008 -0700
>> Subject: x86 ptrace: unify syscall tracing
>>
>> It looks exploitable at first sight (ptrace generally is), but this is
>> beyond me (I am not a kernel hacker)
>>
>> QEMU without KVM is not affected.
>>
>> I've added some printf in a test UML kernel to see more precisely where
>> it dies in arch/um/os-Linux/startup.c: in check_sysemu():
>> 		non_fatal("Before singlestep\n");
>>                 if (ptrace(PTRACE_SYSEMU_SINGLESTEP, pid, 0, 0) < 0)
>>                         goto fail;
>>                 non_fatal("Before waitpid\n");
>> (also added a non_fatal() in fail)
>>
>> It prints these two statements 30 times from the while(1) loop and stops on:
>> Before singlestep
>>
>> Whatever the fix is, this should be queued for stable too.
> 
> Is this an AMD host? 
Nope, Intel Core2, more host info :

# cat /proc/cpuinfo
processor	: 0
vendor_id	: GenuineIntel
cpu family	: 6
model		: 15
model name	: Intel(R) Core(TM)2 CPU          6600  @ 2.40GHz
stepping	: 6
cpu MHz		: 900.000
cache size	: 4096 KB
physical id	: 0
siblings	: 2
core id		: 0
cpu cores	: 2
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm
constant_tsc arch_perfmon pebs bts rep_good pni dtes64 monitor ds_cpl
vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm tpr_shadow
bogomips	: 4787.60
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 6
model		: 15
model name	: Intel(R) Core(TM)2 CPU          6600  @ 2.40GHz
stepping	: 6
cpu MHz		: 900.000
cache size	: 4096 KB
physical id	: 0
siblings	: 2
core id		: 1
cpu cores	: 2
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 10
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm
constant_tsc arch_perfmon pebs bts rep_good pni dtes64 monitor ds_cpl
vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm tpr_shadow
bogomips	: 4788.10
clflush size	: 64
cache_alignment	: 64
address sizes	: 36 bits physical, 48 bits virtual
power management:

# uname -r
2.6.29.4

# qemu-system-x86_64 --version
QEMU PC emulator version 0.10.50 (qemu-kvm-devel-88), Copyright (c)
2003-2008 Fabrice Bellard


Antoine

> 
> Works for me on Intel:
> 
> [root@guest ~]# ./kernel32-2.6.29.6 
> Locating the bottom of the address space ... 0x0
> Locating the top of the address space ... 0xffffd000
> Core dump limits :
> 	soft - 0
> 	hard - NONE
> Checking that ptrace can change system call numbers...OK
> Checking syscall emulation patch for ptrace...OK
> Checking advanced syscall emulation patch for ptrace...OK
> Checking for tmpfs mount on /dev/shm...OK
> Checking PROT_EXEC mmap in /dev/shm/...OK
> Checking for the skas3 patch in the host:
>   - /proc/mm...not found: No such file or directory
>   - PTRACE_FAULTINFO...not found
>   - PTRACE_LDT...not found
> UML running in SKAS0 mode
> [    0.000000] Linux version 2.6.29.6 (root@virtual.nagafix.co.uk) (gcc
> version 4.3.2 (Gentoo 4.3.2-r3 p1.6, pie-10.1.5) ) #1 Wed Jul 29
> 08:29:46 BST 2009
> [    0.000000] Built 1 zonelists in Zone order, mobility grouping on.
> Total pages: 8128
> [    0.000000] Kernel command line: root=98:0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEAREKAAYFAkqjZqkACgkQGK2zHPGK1ruR+QCfTHPHM63cukJlX2PW7q6r0gFR
V4gAn1Al+9hhxTkH5e7PVJcN5gRvRdaJ
=AqI6
-----END PGP SIGNATURE-----