arm32 insecure W+X mapping

Tim Harvey tharvey at gateworks.com
Fri Aug 20 09:06:42 PDT 2021 

On Thu, Aug 19, 2021 at 5:16 PM Russell King (Oracle)
<linux at armlinux.org.uk> wrote:
>
> On Thu, Aug 19, 2021 at 04:59:15PM -0700, Tim Harvey wrote:
> > On Thu, Aug 19, 2021 at 2:28 PM Russell King (Oracle)
> > <linux at armlinux.org.uk> wrote:
> > >
> > > On Thu, Aug 19, 2021 at 10:19:46AM -0700, Tim Harvey wrote:
> > > > Greetings,
> > > >
> > > > Since commit a8e53c151fe7 "(ARM: 8737/1: mm: dump: add checking for
> > > > writable and executable)" I've been seeing the following appear on my
> > > > arm32 kernel:
> > > >
> > > > arm/mm: Found insecure W+X mapping at address 0xf087d000
> > > > ...
> > > > Checked W+X mappings: FAILED, 1 W+X pages found
> > > >
> > > > As I haven't seen others report this I assume it's something unique to
> > > > my kernel configuration. How do I debug what is causing the insecure
> > > > page?
> > >
> > > If you check /proc/vmallocinfo, it should tell you the physical
> > > address that was mapped there, and the function that created the
> > > mapping. That should give enough clues to track it down.
> > >
> >
> > Russell,
> >
> > Thanks for the tip!
> >
> > # dmesg | grep insecure
> > [   13.219582] arm/mm: Found insecure W+X mapping at address 0xf087d000
> > # cat /proc/vmallocinfo | grep 0xf0
> > 0x5f3045dd-0xf0020e05   20480 imx6_pm_get_base+0x64/0x98 phys=0x020e0000 ioremap
> > 0xf0020e05-0x6e748217    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
> > 0x127639d7-0x334ee291    4096 iotable_init+0x0/0xf0 phys=0x00a00000 ioremap
>
> Oh... the kernel's %p pointer munging (for security reasons) is
> affecting your ability to debug your problem. Assuming this is a
> recent kernel, you can disable this by passing "no_hash_pointers"
> on the kernel command line. You should then see real addresses (and
> a big fat message at boot time about it.
>

I'm using 5.13 and when I pass in 'no_hash_pointers' I do indeed see
the huge warning but I get similar results that I can't make sense of:
# uname -r
5.13.0-00009-g8beacec9a060
# cat /proc/cmdline
console=ttymxc1,115200 no_hash_pointers
# dmesg | grep insecure
[   13.309537] arm/mm: Found insecure W+X mapping at address 0xf087d000
# cat /proc/vmallocinfo | grep 0xf0
0xf02c73a9-0xfa933595   20480 __devm_ioremap+0x94/0xa4 phys=0x0202c000 ioremap
0xc02cb795-0x054951d9    4096 iotable_init+0x0/0xf0 phys=0x00a00000 ioremap
# cat /proc/vmallocinfo
0xbe008562-0x5576ab44   20480 of_iomap+0x44/0x68 phys=0x020d8000 ioremap
0x5576ab44-0xb255df29    8192 of_iomap+0x44/0x68 phys=0x00a01000 ioremap
0x46b8335b-0x447c6b02   20480 of_iomap+0x44/0x68 phys=0x020dc000 ioremap
0x447c6b02-0x7527802c    8192 l2x0_of_init+0x78/0x26c phys=0x00a02000 ioremap
0xee30b5de-0x9e0d6dbd   20480 of_iomap+0x44/0x68 phys=0x020c4000 ioremap
0x9e0d6dbd-0xf62147bb    8192 of_iomap+0x44/0x68 phys=0x020c8000 ioremap
0xfe3688a4-0xecfce701   20480 of_iomap+0x44/0x68 phys=0x020c4000 ioremap
0x0d7d7401-0xce35bdb8   20480 of_iomap+0x44/0x68 phys=0x02098000 ioremap
0xd0da9915-0xa147e0b3    8192 bpf_prog_alloc_no_stats+0x2c/0x118 pages=1 vmalloc
0xa147e0b3-0xb043f532  266240 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xb043f532-0x7f372e98    8192 gen_pool_add_owner+0x34/0x94 pages=1 vmalloc
0x7f372e98-0x22c0f7fa    8192 of_syscon_register+0xb8/0x2a0
phys=0x020c8000 ioremap
0x22c0f7fa-0xbc80b65b    8192 __devm_ioremap+0x94/0xa4 phys=0x020c9000 ioremap
0xbc80b65b-0x5737939a    8192 __devm_ioremap+0x94/0xa4 phys=0x020ca000 ioremap
0x5737939a-0xfaac3f4b    8192 gen_pool_add_owner+0x34/0x94 pages=1 vmalloc
0xfaac3f4b-0x3400434f   20480 of_iomap+0x44/0x68 phys=0x021b0000 ioremap
0x3400434f-0x4b5b39be    8192 imx6_pm_common_init+0x118/0x36c
phys=0x00900000 ioremap
0xfa6109c5-0x8220d86a  266240 __devm_ioremap+0x50/0xa4 phys=0x00900000 ioremap
0x8220d86a-0xbb32fa78    8192 imx6_pm_get_base+0x64/0x98 phys=0x00a02000 ioremap
0xe37ddad7-0x94023f64   20480 imx6_pm_get_base+0x64/0x98 phys=0x021b0000 ioremap
0x94023f64-0x032e50a3    8192 of_syscon_register+0xb8/0x2a0
phys=0x020e0000 ioremap
0xd41722d0-0x69a3231e   20480 imx6_pm_get_base+0x64/0x98 phys=0x020d8000 ioremap
0x69a3231e-0x6dc29018    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x327a8342-0x78efb8e0   20480 imx6_pm_get_base+0x64/0x98 phys=0x020e0000 ioremap
0x78efb8e0-0xe6178284    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x76f38a9b-0x34af82ac   20480 imx6_pm_get_base+0x64/0x98 phys=0x020dc000 ioremap
0x34af82ac-0x81d03489    8192 __devm_ioremap+0x94/0xa4 phys=0x02600000 ioremap
0x63fe0abd-0x6b04db7d   20480 __devm_ioremap+0x94/0xa4 phys=0x020e0000 ioremap
0xb849bd1c-0xc46ae71e   20480 __devm_ioremap+0x94/0xa4 phys=0x0209c000 ioremap
0xc46ae71e-0x1eb811b8    8192 __devm_ioremap+0x94/0xa4 phys=0x02608000 ioremap
0x2c687987-0xbae166ed   20480 __devm_ioremap+0x94/0xa4 phys=0x020a0000 ioremap
0xbae166ed-0xb27fac72    8192 __devm_ioremap+0x94/0xa4 phys=0x02630000 ioremap
0x0868e824-0xa08b93b8   20480 __devm_ioremap+0x94/0xa4 phys=0x020a4000 ioremap
0xa08b93b8-0x73e79d37    8192 __devm_ioremap+0x94/0xa4 phys=0x02638000 ioremap
0x3ff71a53-0x1664550e   20480 __devm_ioremap+0x94/0xa4 phys=0x020a8000 ioremap
0x1664550e-0xdffb9edc    8192 __devm_ioremap+0x94/0xa4 phys=0x02620000 ioremap
0x1d0f2f08-0xb32e296b   20480 __devm_ioremap+0x94/0xa4 phys=0x020ac000 ioremap
0xb32e296b-0x7062006c    8192 __devm_ioremap+0x94/0xa4 phys=0x02668000 ioremap
0xff2f5a70-0xff7ff60a   20480 __devm_ioremap+0x94/0xa4 phys=0x020b0000 ioremap
0xff7ff60a-0x8779d9bc    8192 __devm_ioremap+0x94/0xa4 phys=0x02640000 ioremap
0xccc5d4a4-0xbbd8184e   20480 __devm_ioremap+0x94/0xa4 phys=0x020b4000 ioremap
0xf3211f15-0xdf4e4390   12288 __devm_ioremap+0x94/0xa4 phys=0x00110000 ioremap
0xdf4e4390-0x8b969f88    8192 __devm_ioremap+0x94/0xa4 phys=0x02648000 ioremap
0x67d4c705-0x2844e8ae   20480 __devm_ioremap+0x94/0xa4 phys=0x021a0000 ioremap
0x2844e8ae-0xe969daac    8192 __devm_ioremap+0x94/0xa4 phys=0x02658000 ioremap
0x6c51de7f-0x13285901   20480 __devm_ioremap+0x94/0xa4 phys=0x021a4000 ioremap
0x13285901-0xcf2d44dd    8192 __devm_ioremap+0x94/0xa4 phys=0x02780000 ioremap
0x632c016d-0x81fc4149   20480 __devm_ioremap+0x94/0xa4 phys=0x021a8000 ioremap
0x81fc4149-0xd005970a    8192 __devm_ioremap+0x94/0xa4 phys=0x02660000 ioremap
0xacd62b34-0x2369ad7d   20480 __devm_ioremap+0x94/0xa4 phys=0x021d8000 ioremap
0x2369ad7d-0x6c218545    8192 __devm_ioremap+0x94/0xa4 phys=0x02740000 ioremap
0xd8caee3b-0x8f7b3eae   20480 __devm_ioremap+0x94/0xa4 phys=0x01ffc000 ioremap
0x8f7b3eae-0x7754f3e6    8192 __devm_ioremap+0x94/0xa4 phys=0x02650000 ioremap
0xcf739a9c-0x86505b25   20480 __devm_ioremap+0x94/0xa4 phys=0x020ec000 ioremap
0x86505b25-0x4419339d    8192 __devm_ioremap+0x94/0xa4 phys=0x02a00000 ioremap
0x38550150-0xee5ad30c   20480 of_syscon_register+0xb8/0x2a0
phys=0x021bc000 ioremap
0xee5ad30c-0x73467058    8192 __devm_ioremap+0x94/0xa4 phys=0x02a08000 ioremap
0x7659aedb-0xd37bf098   20480 __devm_ioremap+0x94/0xa4 phys=0x020dc000 ioremap
0xd37bf098-0x6b62199d    8192 __devm_ioremap+0x94/0xa4 phys=0x02a30000 ioremap
0xe2fcb2be-0x83ac2ff4   20480 __devm_ioremap+0x94/0xa4 phys=0x02020000 ioremap
0x83ac2ff4-0x498e66da    8192 __devm_ioremap+0x94/0xa4 phys=0x02a38000 ioremap
0xda200768-0x9519b5b7   20480 __devm_ioremap+0x94/0xa4 phys=0x021e8000 ioremap
0x9519b5b7-0xd8066315    8192 __devm_ioremap+0x94/0xa4 phys=0x02a20000 ioremap
0x327c6cd3-0xb09836e5   20480 __devm_ioremap+0x94/0xa4 phys=0x021f4000 ioremap
0xb09836e5-0x2ee61e13    8192 __devm_ioremap+0x94/0xa4 phys=0x02a68000 ioremap
0x28a28e71-0xfb74b75d   40960 __devm_ioremap+0x94/0xa4 phys=0x00120000 ioremap
0xfb74b75d-0x94731aa5    8192 __devm_ioremap+0x94/0xa4 phys=0x02a40000 ioremap
0x94731aa5-0x9ed95f4b   20480 __devm_ioremap+0x94/0xa4 phys=0x00130000 ioremap
0x9ed95f4b-0xb6679e93    8192 __devm_ioremap+0x94/0xa4 phys=0x02a48000 ioremap
0xd2083a49-0xd15b1ee5   20480 __devm_ioremap+0x94/0xa4 phys=0x00134000 ioremap
0xd15b1ee5-0xb873e80d    8192 __devm_ioremap+0x94/0xa4 phys=0x02a58000 ioremap
0xb873e80d-0xad853c5f    8192 __devm_ioremap+0x94/0xa4 phys=0x02b80000 ioremap
0xad853c5f-0x727a169b    8192 __devm_ioremap+0x94/0xa4 phys=0x02a60000 ioremap
0x79bcf223-0xd8778c7f  528384 devm_pci_remap_cfgspace+0x3c/0x74
phys=0x01f00000 ioremap
0xd8778c7f-0xcd8f995b  135168 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xcd8f995b-0x0e93c50d    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x0e93c50d-0x35d018fd   20480 __devm_ioremap+0x94/0xa4 phys=0x02204000 ioremap
0x35d018fd-0x30dd9119  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x30dd9119-0x1d49a1b3    8192 __devm_ioremap+0x94/0xa4 phys=0x02b40000 ioremap
0x1d49a1b3-0xe202a461    8192 __devm_ioremap+0x94/0xa4 phys=0x02a50000 ioremap
0x3c5f9898-0x7c998da8  135168 __devm_ioremap+0x94/0xa4 phys=0x02700000 ioremap
0x0be6bff2-0xe617431b   12288 __devm_ioremap+0x94/0xa4 phys=0x00112000 ioremap
0xe617431b-0x1894871f    8192 __pci_enable_msix_range+0x1b4/0x50c
phys=0x01420000 ioremap
0xcc3e24ea-0x24fc33d0   69632 __devm_ioremap+0x94/0xa4 phys=0x02760000 ioremap
0x24fc33d0-0x2ad2fe2c   81920 pcpu_create_chunk+0x14c/0x290 pages=19 vmalloc
0x064e8962-0x041a1631    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0x041a1631-0xa78f78b0  135168 __devm_ioremap+0x94/0xa4 phys=0x02b00000 ioremap
0x482eea6f-0xa04223bd   12288 __devm_ioremap+0x94/0xa4 phys=0x00114000 ioremap
0xa04223bd-0x47cd64d8    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0x496ff4b8-0x1b8cd27f   69632 __devm_ioremap+0x94/0xa4 phys=0x02b60000 ioremap
0x1b8cd27f-0x9a03a792 1576960 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x9e844161-0x46bbc5c3    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x46bbc5c3-0x061f37bb   20480 __devm_ioremap+0x94/0xa4 phys=0x02200000 ioremap
0x061f37bb-0x099e44f8   98304 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x099e44f8-0x5a73428f   36864 iscsi_target_init_module+0xb4/0x234
pages=8 vmalloc
0x5a73428f-0x6b24094e   20480 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x8763af88-0xc279660f   20480 __devm_ioremap+0x94/0xa4 phys=0x0200c000 ioremap
0xc279660f-0x0746510e    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xc42e58a5-0x9bb92a15   20480 __devm_ioremap+0x94/0xa4 phys=0x02188000 ioremap
0x9bb92a15-0xbffbc968  135168 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xbffbc968-0xc3135661   36864 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x7f8906cc-0x57602490   20480 __devm_ioremap+0x94/0xa4 phys=0x021e4000 ioremap
0x57602490-0x32a0cd25    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x32a0cd25-0xccf592e4    8192 __devm_ioremap+0x94/0xa4 phys=0x02184000 ioremap
0xccf592e4-0xc3d5117e    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xd80eccd6-0x1eccdd8b  135168 igb_probe+0x150/0x10a4 phys=0x01400000 ioremap
0x1eccdd8b-0x360f1603    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x32fecfc9-0x71e47aa2   20480 __devm_ioremap+0x94/0xa4 phys=0x020c0000 ioremap
0x71e47aa2-0x5098c2fb    8192 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xaf379216-0x24330e7c   20480 __devm_ioremap+0x94/0xa4 phys=0x02198000 ioremap
0x3dd54ba7-0x2392a17a   20480 __devm_ioremap+0x94/0xa4 phys=0x02034000 ioremap
0x2392a17a-0x1e11712d   16384 n_tty_open+0x10/0x9c pages=3 vmalloc
0x300b1fb4-0x33dba900   20480 __devm_ioremap+0x94/0xa4 phys=0x02028000 ioremap
0xf02c73a9-0xfa933595   20480 __devm_ioremap+0x94/0xa4 phys=0x0202c000 ioremap
0xbe5c4daa-0x6af5bd9c  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x6af5bd9c-0x9ea7250e  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0x9ea7250e-0x74bbeefe 1294336 zstd_comp_init+0x58/0xb0 pages=315 vmalloc
0x74bbeefe-0x591c7299  163840 zstd_decomp_init+0x14/0x54 pages=39 vmalloc
0x591c7299-0x27154f89  274432 deflate_comp_init+0x20/0x90 pages=66 vmalloc
0x27154f89-0x3978b460   49152 deflate_decomp_init+0x14/0x58 pages=11 vmalloc
0x3978b460-0x99da8daa  212992 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xe9a5ec5f-0xb0e53888  249856 __devm_ioremap+0x94/0xa4 phys=0x02040000 ioremap
0xb0e53888-0xc24dd16d  528384 dma_common_contiguous_remap+0x88/0xa4 dma-coherent
0xc02cb795-0x054951d9    4096 iotable_init+0x0/0xf0 phys=0x00a00000 ioremap
0x32815c21-0x48bd192d 2097152 pci_reserve_io+0x0/0x30 ioremap
0xba73986b-0x4f91845f  311296 pcpu_get_vm_areas+0x0/0x10c0 vmalloc
0x4f91845f-0x86cbfbfa  311296 pcpu_get_vm_areas+0x0/0x10c0 vmalloc
0x17d9341e-0xbe008562   16384 unpurged vm_area
0xecfce701-0xd35ab9b8    8192 unpurged vm_area
0xce35bdb8-0xd0da9915    8192 unpurged vm_area
0x6b04db7d-0xb849bd1c 15609856 unpurged vm_area
0xe202a461-0x3c5f9898   73728 unpurged vm_area
0x7c998da8-0x0be6bff2   36864 unpurged vm_area
0x2ad2fe2c-0x064e8962   36864 unpurged vm_area
0xa78f78b0-0x482eea6f   36864 unpurged vm_area
0x9a03a792-0x9e844161  442368 unpurged vm_area
0x92d57223-0xd09758da  249856 unpurged vm_area
0xfa933595-0xbe5c4daa   36864 unpurged vm_area

Thanks for your help!

Tim

More information about the linux-arm-kernel mailing list