From: Kees Cook <kees@outflux.net>
To: "H. Peter Anvin" <hpa@zytor.com>
Cc: "Yan, Zheng" <zheng.z.yan@intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
linux-kernel@vger.kernel.org
Subject: Re: RW and executable hole in page tables on x86_64
Date: Fri, 14 Nov 2014 11:02:51 -0800 [thread overview]
Message-ID: <20141114190251.GT5451@outflux.net> (raw)
In-Reply-To: <526A874B.2040108@zytor.com>
Continuing a thread from a year ago...
On Fri, Oct 25, 2013 at 03:59:23PM +0100, H. Peter Anvin wrote:
> On 10/25/2013 02:34 PM, Kees Cook wrote:
> > Hi,
> >
> > I've noticed there's a chunk of kernel memory still marked RW and x. See
> > 0xffffffff82956000 below...
> >
> > ---[ High Kernel Mapping ]---
> > 0xffffffff80000000-0xffffffff81000000 16M pmd
> > 0xffffffff81000000-0xffffffff81a00000 10M ro PSE GLB x pmd
> > 0xffffffff81a00000-0xffffffff81e00000 4M ro PSE GLB NX pmd
> > 0xffffffff81e00000-0xffffffff82200000 4M RW GLB NX pte
> > 0xffffffff82200000-0xffffffff82800000 6M RW PSE GLB NX pmd
> > 0xffffffff82800000-0xffffffff82956000 1368K RW GLB NX pte
> > 0xffffffff82956000-0xffffffff82a00000 680K RW GLB x pte
> > 0xffffffff82a00000-0xffffffffa0000000 470M pmd
> >
> > HPA looked at it for a bit, but it wasn't obvious what was going on. It's
> > after the end of bss. I do note that the two adjacent regions add up to
> > 2MiB. Is this some kind of leftover mapping? What is this region? Is there
> > a sensible place to clean it up?
> >
>
> It looks to be what is left after the 2 MB page for bss is broken up.
> It doesn't mean it isn't broken, though.
It looks like the problem still exists:
---[ High Kernel Mapping ]---
0xffffffff80000000-0xffffffff9ca00000 458M pmd
0xffffffff9ca00000-0xffffffff9d200000 8M ro PSE GLB x pmd
0xffffffff9d200000-0xffffffff9d3f3000 1996K ro GLB x pte
0xffffffff9d3f3000-0xffffffff9d400000 52K ro x pte
0xffffffff9d400000-0xffffffff9d600000 2M ro PSE GLB NX pmd
0xffffffff9d600000-0xffffffff9d7e8000 1952K ro GLB NX pte
0xffffffff9d7e8000-0xffffffff9d800000 96K ro NX pte
0xffffffff9d800000-0xffffffff9d8ff000 1020K RW GLB NX pte
0xffffffff9d8ff000-0xffffffff9da2d000 1208K RW NX pte
0xffffffff9da2d000-0xffffffff9dc00000 1868K RW GLB NX pte
0xffffffff9dc00000-0xffffffff9e600000 10M RW PSE GLB NX pmd
0xffffffff9e600000-0xffffffff9e7f5000 2004K RW GLB NX pte
0xffffffff9e7f5000-0xffffffff9e800000 44K RW GLB x pte
0xffffffff9e800000-0xffffffffc0000000 536M pmd
Still seems to be the bss getting broken up. What is this left-over
memory used for? Any pointers to where it happens? I'd really like to
kill this area.
-Kees
--
Kees Cook @outflux.net
next prev parent reply other threads:[~2014-11-14 19:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-25 13:34 RW and executable hole in page tables on x86_64 Kees Cook
2013-10-25 14:59 ` H. Peter Anvin
2014-11-14 19:02 ` Kees Cook [this message]
2014-11-14 20:04 ` Thomas Gleixner
2014-11-14 20:15 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141114190251.GT5451@outflux.net \
--to=kees@outflux.net \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=zheng.z.yan@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox