[email protected] wrote: > On 7 Mar 2009 at 18:39, basile wrote: > > >> Hi guys, >> >> I'm encountering a reproduceable problem with hardened 2.6.26-r9 and >> 2.6.27-r8 that wasn't there with 2.6.25-r13 on i686, and isn't there >> with amd64 using approximately the same kernel configuration in every >> case. I've been able to reproduce it in vmware, qemu and on physical >> boxes, one with a Intel(R) Core(TM)2 Quad CPU Q6700, the other AMD >> Athlon(tm) 64 FX-62 Dual Core. It a stack fault in kernel mode, but I >> can't pin it down further. It happens almost immediately after the >> bootloader passes control to the kernel. The best error message comes >> from qemu which gives the states of the registers. Here's the error >> message from a bootable ISO I made suing 2.6.26-r9. Any idea where I >> can start tackling this one? >> > > you'll have to check what code was executed just before the triple fault, > start at around EIP. also passing -d in_asm,int,exec,cpu,pcall will pro > a nice log file that will make it even easier. > > >> # qemu -cdrom th-i686-20090307-RC3.iso >> qemu: fatal: triple fault >> EAX=000000ff EBX=0153cac0 ECX=0013a2d1 EDX=0013a2d1 >> ESI=0024c000 EDI=01400000 EBP=01541a20 ESP=01541a10 >> EIP=0153a2d0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 >> > ^^^^^^^^^^^^ > > 1) Thanks for the suggestion with -d in_asm,int,exec,cpu,pcall Very useful.
2) I've localized the problem, but I can't figure out what's changed from 2.6.25 to 2.6.26/2.6.27. The triple fault occurs when activating CONFIG_PAX_KERNEXEC in the later two, but poses no problem in 2.6.25. Comparing the source trees for 2.6.25-hardened-r13 and 2.6.26-hardened-r9, I found no clues tracing back from places where #ifdef CONFIG_PAX_KERNEXEC includes code. I compared the patches (4420_grsec) and the only "suspicious" changes I saw were 1) in arch/x86/kernel/module_32.c where invoking vmalloc changed and 2) in arch/x86/kernel/head64.c (2.6.25) -> arch/x86/kernel/head_32.S (2.6.26) there is some inline assembly which changed. I don't really understand these two changes yet. Any more suggestions? I can always disable the option, but I like the feature. -- Anthony G. Basile, Ph.D. Chair of Information Technology D'Youville College Buffalo, NY 14201 USA (716) 829-8197
signature.asc
Description: OpenPGP digital signature
