The test was failing because the implementation details of the stack
guard area in the kernel changed. Previously there was a single guard
page within the vma for the stack, now the kernel treats a range of
addresses just below the vma as the guard region.
The test was placing a fixed mmap region directly below the stack vma.
In the new implementation that means this mmap was over the topmost
portion of the guard region, and there is no guard region between the
stack and this mapping. So when the test blew the stack it would start
modifying the contents of that page, which the test would detect and
treat as a failure.
A simple fix has been comitted to the test, which leaves a gap of one
page between the stack and the mapping. For the old implementation, the
stack will be extended by one page when it hits the original guard
region and then receive SIGSEGV once it hits the new guard page. With
the new implementation the test receives SIGSEGV as soon as it hits the
page directly below the stack. (Note that for this test, receiving
SIGSEGV before modifying the contents of the memory mapping is the
expected result.)
** Changed in: linux (Ubuntu)
Status: Incomplete => Invalid
** Changed in: linux (Ubuntu)
Assignee: (unassigned) => Seth Forshee (sforshee)
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1699751
Title:
test_061_guard_page (CVE-2010-2240) failed with Artful kernel
Status in linux package in Ubuntu:
Invalid
Bug description:
Ubuntu 4.11.0-8.13-generic
This test case failed on both of our testing node archytas and michael
FAIL: test_061_guard_page (__main__.KernelSecurityTest)
Userspace stack guard page exists (CVE-2010-2240)
----------------------------------------------------------------------
Traceback (most recent call last):
File "./test-kernel-security.py", line 512, in test_061_guard_page
self.assertShellExitIn(expected_signals, ["./guard-page"])
File
"/home/ubuntu/autotest/client/tmp/ubuntu_qrt_kernel_security/src/qa-regression-testing/scripts/testlib.py",
line 1139, in assertShellExitIn
self.assertIn(rc, expected, msg + result + report)
AssertionError: Got exit code 0, expected one of -11, -7
Command: './guard-page'
Output:
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
Target: 0x7fff03e6e000
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
7fff03e6f000-7fff03e90000 rw-p 00000000 00:00 0 [stack]
Unexpectedly survived stack crash into mapped segment
Full log: http://pastebin.ubuntu.com/24923862/
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1699751/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
