On Wed, Mar 27, 2019 at 04:17:25PM +0100, Borislav Petkov wrote:
> On Wed, Mar 27, 2019 at 02:45:24PM +0100, Dmitry Vyukov wrote:
> > And run this program:
> > https://syzkaller.appspot.com/text?tag=ReproC&x=15439f27200000
>
> Yap, that worked in my guest, after segfaulting a lot first:
>
> [ 101.600512][ T7333] Code: Bad RIP value.
> [ 101.606103][ T7337] repro[7337]: segfault at 155555585 ip 0000000155555585
> sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [ 101.606248][ T7338] repro[7338]: segfault at 25555554e ip 000000025555554e
> sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [ 101.608498][ T7337] Code: Bad RIP value.
> [ 101.610442][ T7338] Code: Bad RIP value.
> [ 101.611417][ T7341] repro[7341]: segfault at 0 ip 0000000000000000 sp
> 00000000200002c8 error 14
> [ 101.613342][ T7341] Code: Bad RIP value.
> [ 101.613798][ T7345] repro[7345]: segfault at 0 ip 0000000000000000 sp
> 00000000200002c8 error 14
> [ 101.614292][ T7342] repro[7342]: segfault at 45555554e ip 000000045555554e
> sp 00007ffff7f98f10 error 14 in repro[555555554000+1000]
> [ 101.615809][ T7345] Code: Bad RIP value.
> [ 101.616777][ T7348] repro[7348]: segfault at 155555585 ip 0000000155555585
> sp 00007ffff7fdaf10 error 14 in repro[555555554000+1000]
> [ 101.616802][ T7348] Code: Bad RIP value.
> [ 101.617733][ T7342] Code: Bad RIP value.
> [ 105.321676][T11024] ------------[ cut here ]------------
> [ 105.324183][T11024] Can't find any breakpoint slot
> [ 105.324229][T11024] WARNING: CPU: 0 PID: 11024 at
> arch/x86/kernel/hw_breakpoint.c:121 arch_install_hw_breakpoint+0x2d1/0x3a0
Ok, after adding some debug output, it looks like this (newlines mine):
[ 200.921625][ T8029] repro-8029 0d..4 200923254us :
arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[ 200.922507][ T8029] repro-8029 0d..4 200923257us :
arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[ 200.923397][ T8029] repro-8029 0d..4 200923259us :
arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40
[ 200.924294][ T8029] repro-8029 0d..4 200923262us :
arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[ 200.925175][ T8029] repro-8029 0d..4 200923264us :
arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40
[ 200.926054][ T8029] repro-8029 0d..4 200923266us :
arch_install_hw_breakpoint: i: 2, slot: ffff8880602004c0
[ 200.926933][ T8029] repro-8029 0d..4 200923270us :
arch_install_hw_breakpoint: i: 0, slot: ffff888069668080
[ 200.927816][ T8029] repro-8029 0d..4 200923271us :
arch_install_hw_breakpoint: i: 1, slot: ffff888060200d40
[ 200.928695][ T8029] repro-8029 0d..4 200923273us :
arch_install_hw_breakpoint: i: 2, slot: ffff8880602004c0
[ 200.929573][ T8029] repro-8029 0d..4 200923275us :
arch_install_hw_breakpoint: i: 3, slot: ffff88806991ed00
which basically shows how this thread adds 4 breakpoints and hits the
warn on on the 5th.
Now, that code I've seen only once or twice so I don't have a very smart
guess but it looks to me like arch_install_hw_breakpoint() or something
scheduling the events above that, should check HBP_NUM and not schedule
more than 4 hw breakpoints. Or..?
Frederic, I know you know this code... :-)
--
Regards/Gruss,
Boris.
Good mailing practices for 400: avoid top-posting and trim the reply.
