arm32 insecure W+X mapping

Tim Harvey tharvey at gateworks.com
Thu Aug 19 16:59:15 PDT 2021 

On Thu, Aug 19, 2021 at 2:28 PM Russell King (Oracle)
<linux at armlinux.org.uk> wrote:
>
> On Thu, Aug 19, 2021 at 10:19:46AM -0700, Tim Harvey wrote:
> > Greetings,
> >
> > Since commit a8e53c151fe7 "(ARM: 8737/1: mm: dump: add checking for
> > writable and executable)" I've been seeing the following appear on my
> > arm32 kernel:
> >
> > arm/mm: Found insecure W+X mapping at address 0xf087d000
> > ...
> > Checked W+X mappings: FAILED, 1 W+X pages found
> >
> > As I haven't seen others report this I assume it's something unique to
> > my kernel configuration. How do I debug what is causing the insecure
> > page?
>
> If you check /proc/vmallocinfo, it should tell you the physical
> address that was mapped there, and the function that created the
> mapping. That should give enough clues to track it down.
>

Russell,

Thanks for the tip!

# dmesg | grep insecure
[   13.219582] arm/mm: Found insecure W+X mapping at address 0xf087d000
# cat /proc/vmallocinfo | grep 0xf0
0x5f3045dd-0xf0020e05   20480 imx6_pm_get_base+0x64/0x98 phys=0x020e0000 ioremap
0xf0020e05-0x6e748217    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x127639d7-0x334ee291    4096 iotable_init+0x0/0xf0 phys=0x00a00000 ioremap

So this is saying its dma-coherent mapped from dma_common_continguous_remap?

# cat /proc/vmallocinfo
0x572091e4-0x27690de5   20480 of_iomap+0x44/0x68 phys=0x020d8000 ioremap
0x27690de5-0x35897f01    8192 of_iomap+0x44/0x68 phys=0x00a01000 ioremap
0xe3186ca4-0x0f1ef5e3   20480 of_iomap+0x44/0x68 phys=0x020dc000 ioremap
0x0f1ef5e3-0x5ece7ccc    8192 l2x0_of_init+0x78/0x26c phys=0x00a02000 ioremap
0xb5c85079-0xc2ca2734   20480 of_iomap+0x44/0x68 phys=0x020c4000 ioremap
0xc2ca2734-0xaf3c42de    8192 of_iomap+0x44/0x68 phys=0x020c8000 ioremap
0x28e036be-0xd5974946   20480 of_iomap+0x44/0x68 phys=0x020c4000 ioremap
0xeae42964-0xc4e615a6   20480 of_iomap+0x44/0x68 phys=0x02098000 ioremap
0x6a6bab5f-0x3ecf3e8c    8192 bpf_prog_alloc_no_stats+0x2c/0x118 pages=1 vmalloc
0x3ecf3e8c-0xbb5cf07d  266240 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xbb5cf07d-0x1a6cd05a    8192 gen_pool_add_owner+0x34/0x94 pages=1 vmalloc
0x1a6cd05a-0xcafd679a    8192 of_syscon_register+0xb8/0x2a0
phys=0x020c8000 ioremap
0xcafd679a-0xab606572    8192 __devm_ioremap+0x94/0xa4 phys=0x020c9000 ioremap
0xab606572-0xd42260ec    8192 __devm_ioremap+0x94/0xa4 phys=0x020ca000 ioremap
0xd42260ec-0xcbe84677    8192 gen_pool_add_owner+0x34/0x94 pages=1 vmalloc
0xcbe84677-0x235c7c16   20480 of_iomap+0x44/0x68 phys=0x021b0000 ioremap
0x235c7c16-0xb235d3f3    8192 imx6_pm_common_init+0x118/0x36c
phys=0x00900000 ioremap
0x47e7e130-0x808ca2d4  266240 __devm_ioremap+0x50/0xa4 phys=0x00900000 ioremap
0x808ca2d4-0xfccba85b    8192 imx6_pm_get_base+0x64/0x98 phys=0x00a02000 ioremap
0x800f4671-0xc7775acd   20480 imx6_pm_get_base+0x64/0x98 phys=0x021b0000 ioremap
0xc7775acd-0xa724d9e0    8192 of_syscon_register+0xb8/0x2a0
phys=0x020e0000 ioremap
0xb762f02e-0xed6991ca   20480 imx6_pm_get_base+0x64/0x98 phys=0x020d8000 ioremap
0xed6991ca-0xdbb588fa    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x5f3045dd-0xf0020e05   20480 imx6_pm_get_base+0x64/0x98 phys=0x020e0000 ioremap
0xf0020e05-0x6e748217    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x0b51e410-0x3d898417   20480 imx6_pm_get_base+0x64/0x98 phys=0x020dc000 ioremap
0x3d898417-0x86992438    8192 __devm_ioremap+0x94/0xa4 phys=0x02600000 ioremap
0x6464407c-0x60718db5   20480 __devm_ioremap+0x94/0xa4 phys=0x020e0000 ioremap
0x4c7be824-0xfe1fc1f2   20480 __devm_ioremap+0x94/0xa4 phys=0x0209c000 ioremap
0xfe1fc1f2-0x46954edf    8192 __devm_ioremap+0x94/0xa4 phys=0x02608000 ioremap
0x53446305-0x435a58b4   20480 __devm_ioremap+0x94/0xa4 phys=0x020a0000 ioremap
0x435a58b4-0x2e1fc59d    8192 __devm_ioremap+0x94/0xa4 phys=0x02630000 ioremap
0x3f2c2f34-0x01a2f43c   20480 __devm_ioremap+0x94/0xa4 phys=0x020a4000 ioremap
0x01a2f43c-0x6b20a97a    8192 __devm_ioremap+0x94/0xa4 phys=0x02638000 ioremap
0x6fd6457c-0xe0eb3463   20480 __devm_ioremap+0x94/0xa4 phys=0x020a8000 ioremap
0xe0eb3463-0xec4965e5    8192 __devm_ioremap+0x94/0xa4 phys=0x02620000 ioremap
0x5c03cdf7-0x3b1b3493   20480 __devm_ioremap+0x94/0xa4 phys=0x020ac000 ioremap
0x3b1b3493-0xad9aee67    8192 __devm_ioremap+0x94/0xa4 phys=0x02668000 ioremap
0x92feb1f5-0x7414f542   20480 __devm_ioremap+0x94/0xa4 phys=0x020b0000 ioremap
0x7414f542-0x7a40d77f    8192 __devm_ioremap+0x94/0xa4 phys=0x02640000 ioremap
0x8ee37216-0xbe006eb2   20480 __devm_ioremap+0x94/0xa4 phys=0x020b4000 ioremap
0x29a6ecde-0x80a7a60b   12288 __devm_ioremap+0x94/0xa4 phys=0x00110000 ioremap
0x80a7a60b-0x3db02e14    8192 __devm_ioremap+0x94/0xa4 phys=0x02648000 ioremap
0x60036855-0x1e6802e0   20480 __devm_ioremap+0x94/0xa4 phys=0x021a0000 ioremap
0x1e6802e0-0x62fd3e57    8192 __devm_ioremap+0x94/0xa4 phys=0x02658000 ioremap
0xabcb6908-0xa070b2ec   20480 __devm_ioremap+0x94/0xa4 phys=0x021a4000 ioremap
0xa070b2ec-0xe713ec73    8192 __devm_ioremap+0x94/0xa4 phys=0x02780000 ioremap
0x1d8444e1-0xcac4726c   20480 __devm_ioremap+0x94/0xa4 phys=0x021a8000 ioremap
0xcac4726c-0x8025cc0f    8192 __devm_ioremap+0x94/0xa4 phys=0x02660000 ioremap
0x1ae47ba3-0xf8c7f1ca   20480 __devm_ioremap+0x94/0xa4 phys=0x021d8000 ioremap
0xf8c7f1ca-0x32e09fa4    8192 __devm_ioremap+0x94/0xa4 phys=0x02740000 ioremap
0x4d10befe-0x60b4c1e9   20480 __devm_ioremap+0x94/0xa4 phys=0x01ffc000 ioremap
0x60b4c1e9-0xb3a54244    8192 __devm_ioremap+0x94/0xa4 phys=0x02650000 ioremap
0xe04d1c20-0x97be33d0   20480 __devm_ioremap+0x94/0xa4 phys=0x020ec000 ioremap
0x97be33d0-0xc1afe24c    8192 __devm_ioremap+0x94/0xa4 phys=0x02a00000 ioremap
0xac1caf35-0x7ceb30f1   20480 of_syscon_register+0xb8/0x2a0
phys=0x021bc000 ioremap
0x7ceb30f1-0x245e06af    8192 __devm_ioremap+0x94/0xa4 phys=0x02a08000 ioremap
0x6c5425e7-0x84bc25cc   20480 __devm_ioremap+0x94/0xa4 phys=0x020dc000 ioremap
0x84bc25cc-0x595056c5    8192 __devm_ioremap+0x94/0xa4 phys=0x02a30000 ioremap
0x074d8ed7-0x2e4d1a53   20480 __devm_ioremap+0x94/0xa4 phys=0x02020000 ioremap
0x2e4d1a53-0x95ed192f    8192 __devm_ioremap+0x94/0xa4 phys=0x02a38000 ioremap
0x19e0356d-0x45e14fed   20480 __devm_ioremap+0x94/0xa4 phys=0x021e8000 ioremap
0x45e14fed-0xe690f152    8192 __devm_ioremap+0x94/0xa4 phys=0x02a20000 ioremap
0x991fa501-0x9fdabf5a   20480 __devm_ioremap+0x94/0xa4 phys=0x021f4000 ioremap
0x9fdabf5a-0x3e67dae9    8192 __devm_ioremap+0x94/0xa4 phys=0x02a68000 ioremap
0x82e937d0-0x0811797e   40960 __devm_ioremap+0x94/0xa4 phys=0x00120000 ioremap
0x0811797e-0x923f8a88    8192 __devm_ioremap+0x94/0xa4 phys=0x02a40000 ioremap
0x923f8a88-0x206017e5   20480 __devm_ioremap+0x94/0xa4 phys=0x00130000 ioremap
0x206017e5-0x6c990a7b    8192 __devm_ioremap+0x94/0xa4 phys=0x02a48000 ioremap
0x99673e2c-0x2cac9053   20480 __devm_ioremap+0x94/0xa4 phys=0x00134000 ioremap
0x2cac9053-0x85ae7df8    8192 __devm_ioremap+0x94/0xa4 phys=0x02a58000 ioremap
0x85ae7df8-0x4405ccb4    8192 __devm_ioremap+0x94/0xa4 phys=0x02b80000 ioremap
0x4405ccb4-0xae8efb1a    8192 __devm_ioremap+0x94/0xa4 phys=0x02a60000 ioremap
0x126bbd24-0x2249ff6f  528384 devm_pci_remap_cfgspace+0x3c/0x74
phys=0x01f00000 ioremap
0x2249ff6f-0x8c2e304c  135168 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x8c2e304c-0x0bf3a28c    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x0bf3a28c-0x96e17d3f   20480 __devm_ioremap+0x94/0xa4 phys=0x02204000 ioremap
0x96e17d3f-0xa4daba8c  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xa4daba8c-0xe6185530    8192 __devm_ioremap+0x94/0xa4 phys=0x02b40000 ioremap
0xe6185530-0x821c3b4a    8192 __devm_ioremap+0x94/0xa4 phys=0x02a50000 ioremap
0xbd3e3c5d-0x597081d3  135168 __devm_ioremap+0x94/0xa4 phys=0x02700000 ioremap
0x0f8ddd13-0x32e4fd76   12288 __devm_ioremap+0x94/0xa4 phys=0x00112000 ioremap
0x32e4fd76-0x811b112c    8192 __pci_enable_msix_range+0x1b4/0x50c
phys=0x01420000 ioremap
0xce8aec4a-0xb2dd309c   69632 __devm_ioremap+0x94/0xa4 phys=0x02760000 ioremap
0xb2dd309c-0x5ff80254   81920 pcpu_create_chunk+0x14c/0x290 pages=19 vmalloc
0x6325b825-0xd6880a57    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0xd6880a57-0x01fdf853  135168 __devm_ioremap+0x94/0xa4 phys=0x02b00000 ioremap
0xfbfae5e4-0x34f66182   12288 __devm_ioremap+0x94/0xa4 phys=0x00114000 ioremap
0x34f66182-0x9759721e    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0xff9a433f-0x6ffcb3fc   69632 __devm_ioremap+0x94/0xa4 phys=0x02b60000 ioremap
0x6ffcb3fc-0x925370c6 4153344 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x89e10860-0x935fedfd   20480 __devm_ioremap+0x94/0xa4 phys=0x02200000 ioremap
0x935fedfd-0xb3e1eed1   98304 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xb3e1eed1-0xd19ae2f1   36864 iscsi_target_init_module+0xb4/0x234
pages=8 vmalloc
0xd19ae2f1-0x4ef92f29   20480 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x0e67a0eb-0x32add077   20480 __devm_ioremap+0x94/0xa4 phys=0x0200c000 ioremap
0x32add077-0xf2ae7966    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x24b26351-0x10c489ec   20480 __devm_ioremap+0x94/0xa4 phys=0x02188000 ioremap
0x10c489ec-0x99550a81  135168 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x99550a81-0xb8546101   36864 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xb757667d-0x00d14870   20480 __devm_ioremap+0x94/0xa4 phys=0x021e4000 ioremap
0x00d14870-0x4997051a    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xcd1bbc96-0x5470c56e   20480 __devm_ioremap+0x94/0xa4 phys=0x020c0000 ioremap
0x5470c56e-0x5041fe43    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x27c17eec-0x5f300c54   20480 __devm_ioremap+0x94/0xa4 phys=0x02198000 ioremap
0x5f300c54-0x779e324f    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0x71eda903-0x08c271b0  135168 igb_probe+0x150/0x10a4 phys=0x01400000 ioremap
0x08c271b0-0xaad09678    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x20320ae4-0x995de6c0   20480 __devm_ioremap+0x94/0xa4 phys=0x02034000 ioremap
0x995de6c0-0x53fe07bc    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x66a2a7f0-0x144dcde1   20480 __devm_ioremap+0x94/0xa4 phys=0x02028000 ioremap
0x144dcde1-0x28fcbfb5    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xd4d631e6-0x89b9dbd5   20480 __devm_ioremap+0x94/0xa4 phys=0x0202c000 ioremap
0x89b9dbd5-0xba573900   16384 n_tty_open+0x10/0x9c pages=3 vmalloc
0xf1af7427-0x2dd3f3b0  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x7ea79487-0xb5aa9a4a  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xb5aa9a4a-0x38706b86 1294336 zstd_comp_init+0x58/0xb0 pages=315 vmalloc
0x38706b86-0x2073eebb  163840 zstd_decomp_init+0x14/0x54 pages=39 vmalloc
0x2073eebb-0x0e3cf5f0  274432 deflate_comp_init+0x20/0x90 pages=66 vmalloc
0x0e3cf5f0-0x03c153c7   49152 deflate_decomp_init+0x14/0x58 pages=11 vmalloc
0x32a3b715-0x45627fc0  249856 __devm_ioremap+0x94/0xa4 phys=0x02040000 ioremap
0x45627fc0-0x8420dc4c  212992 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x8420dc4c-0x0268f3a7  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x127639d7-0x334ee291    4096 iotable_init+0x0/0xf0 phys=0x00a00000 ioremap
0x9569c0e1-0x413f89f0 2097152 pci_reserve_io+0x0/0x30 ioremap
0x1fa52fb4-0xe4568750  311296 pcpu_get_vm_areas+0x0/0x10c0 vmalloc
0xe4568750-0x2633c5e5  311296 pcpu_get_vm_areas+0x0/0x10c0 vmalloc
0x8276ef58-0x572091e4   16384 unpurged vm_area
0xd5974946-0xe417a989    8192 unpurged vm_area
0xc4e615a6-0x6a6bab5f    8192 unpurged vm_area
0x60718db5-0x4c7be824 15609856 unpurged vm_area
0x821c3b4a-0xbd3e3c5d   73728 unpurged vm_area
0x597081d3-0x0f8ddd13   36864 unpurged vm_area
0x5ff80254-0x6325b825   36864 unpurged vm_area
0x01fdf853-0xfbfae5e4   36864 unpurged vm_area
0x925370c6-0x208e0e7e  442368 unpurged vm_area
0xe1ca9db2-0xf1af7427  249856 unpurged vm_area
0x2dd3f3b0-0x7ea79487   36864 unpurged vm_area

Thanks,

Tim

More information about the linux-arm-kernel mailing list