grsecurity forums

Hello,

Recently, we've had two kernel crashes, on two different machines, that somehow appear to be related to java and the CONFIG_PAX_MEMORY_STACKLEAK option.

We'll be happy to provide any additional information that may help solve the problem.

Best regards,

[1126249.482739] invalid opcode: 0000 [#1] SMP
[1126249.489830] CPU 2
[1126249.489861] Modules linked in: nfsd nfs nfs_acl auth_rpcgss fscache lockd sunrpc bonding 8021q garp bridge stp loop iTCO_wdt iTCO_vendor_support hpilo i7core_edac edac_core radeon ttm drm_kms_helper drm power_supply snd_pcm snd_page_alloc snd_timer snd processor i2c_algo_bit i2c_core hpwdt psmouse container soundcore joydev button serio_raw pcspkr evdev acpi_power_meter ext3 mbcache jbd usbhid hid sg sd_mod crc_t10dif uhci_hcd ehci_hcd usbcore usb_common hpsa thermal thermal_sys bnx2 scsi_mod [last unloaded: scsi_wait_scan]
[1126249.532171]
[1126249.538982] Pid: 4461, comm: java Not tainted 3.2.55 #1 HP ProLiant DL360 G7
[1126249.546043] RIP: 0010:[<ffffffff813b125b>] [<ffffffff813b125b>] pax_erase_kstack+0x4b/0x70
[1126249.552892] RSP: 0018:ffff88027110bf20 EFLAGS: 00010002
[1126249.559652] RAX: ffffffffffff4111 RBX: 0000000004dca100 RCX: 00000000d14e5f20
[1126249.566394] RDX: 0000000000000000 RSI: ffff8800d7c18c68 RDI: ffff88019fc26000
[1126249.573059] RBP: 00006de0da7bf8f0 R08: ffff8800d7c18c68 R09: 0000000000000020
[1126249.579653] R10: 0000000000000004 R11: ffff8800d7c18c68 R12: 0000000000000001
[1126249.586140] R13: 00006de0da7bf8b0 R14: ffffffffffffff92 R15: 0000000000000000
[1126249.592525] FS: 00006de0da7c0700(0000) GS:ffff88019fc20000(0000) knlGS:0000000000000000
[1126249.598847] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[1126249.605075] CR2: ffffffffff600400 CR3: 000000027019e000 CR4: 00000000000006f0
[1126249.611262] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[1126249.617357] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[1126249.623325] Process java (pid: 4461, threadinfo ffff8800d7c18c68, task ffff8800d7c18800)
[1126249.629248] Stack:
[1126249.635032] ffff8801962db800 ffffffffffffffff ffff8800d7c18c68 000000003000fe7f
[1126249.640846] ffffffff813ac5a9 0000000004dca800 00006de0da7bf9c0 00006de0eff7b9b8
[1126249.646630] 00000000050cc700 00006de0da7bf9c0 00006de0eff7b9b8 0000000000000202
[1126249.652344] Call Trace:
[1126249.657919] [<ffffffff813ac5a9>] ? sysret_check+0x1d/0x5c
[1126249.663441] Code: 00 00 c1 e9 03 f2 48 af 67 e3 12 83 f9 10 72 0d b9 10 00 00 00 f3 48 af 67 e3 02 75 dd fc 89 e1 29 f9 48 81 f9 00 20 00 00 72 02 <0f> 0b c1 e9 03 f3 48 ab 49 8b bb 60 ff ff ff 48 81 ef 00 01 00
[1126249.675108] RIP [<ffffffff813b125b>] pax_erase_kstack+0x4b/0x70
[1126249.680605] RSP <ffff88027110bf20>
[1126249.700987] ---[ end trace dfd99c76b12f2e06 ]---
[1126249.706286] grsec: banning user with uid 107 until system restart for suspicious kernel crash

and

[730499.958141] invalid opcode: 0000 [#1] SMP
[730499.958218] CPU 8
[730499.958248] Modules linked in: fuse btrfs crc32c libcrc32c zlib_deflate ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs reiserfs ext4 crc16 jbd2 ext2 efivars dm_mod nfsd nfs nfs_acl auth_rpcgss fscache lockd sunrpc bonding 8021q garp bridge stp loop psmouse i7core_edac edac_core radeon ttm drm_kms_helper drm snd_pcm snd_page_alloc snd_timer snd soundcore power_supply i2c_algo_bit i2c_core iTCO_wdt hpilo iTCO_vendor_support hpwdt joydev pcspkr acpi_power_meter serio_raw evdev processor container button ext3 mbcache jbd usbhid hid sg sd_mod crc_t10dif uhci_hcd ehci_hcd usbcore usb_common thermal hpsa thermal_sys bnx2 scsi_mod [last unloaded: scsi_wait_scan]
[730499.959425]
[730499.959449] Pid: 5435, comm: java Not tainted 3.2.55 #1 HP ProLiant DL360 G7
[730499.959571] RIP: 0010:[<ffffffff813b125b>] [<ffffffff813b125b>] pax_erase_kstack+0x4b/0x70
[730499.959703] RSP: 0018:ffff880240917f20 EFLAGS: 00010002
[730499.959783] RAX: ffffffffffff4111 RBX: 00000000000001f4 RCX: 00000000a0c91f20
[730499.959890] RDX: 0000000000000000 RSI: 00000000ffffff02 RDI: ffff88019fc86000
[730499.959997] RBP: 000073f64b19f3c0 R08: 00000000ffffff02 R09: 0000000000000020
[730499.960103] R10: 0000000000000004 R11: ffff88024ec5e4a8 R12: 00000000000003ec
[730499.960210] R13: 0000000000002000 R14: 000073f66f9d5000 R15: 00000000000001f4
[730499.960317] FS: 000073f64b1a0700(0000) GS:ffff88019fc80000(0000) knlGS:0000000000000000
[730499.960437] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[730499.960524] CR2: 0000000004af7b10 CR3: 000000011d680000 CR4: 00000000000006f0
[730499.960631] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[730499.960737] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[730499.960844] Process java (pid: 5435, threadinfo ffff88024ec5e4a8, task ffff88024ec5e040)
[730499.960964] Stack:
[730499.960994] ffff88019636b800 ffffffffffffffff ffff88024ec5e4a8 000000003000fe7f
[730499.961122] ffffffff813ac5a9 000073f66f9ed800 000073f64b19f558 000073f6c1628340
[730499.965966] 000073f67c27f000 000073f64b19f410 000073f64b19f460 0000000000000293
[730499.970840] Call Trace:
[730499.975690] [<ffffffff813ac5a9>] ? sysret_check+0x1d/0x5c
[730499.980477] Code: 00 00 c1 e9 03 f2 48 af 67 e3 12 83 f9 10 72 0d b9 10 00 00 00 f3 48 af 67 e3 02 75 dd fc 89 e1 29 f9 48 81 f9 00 20 00 00 72 02 <0f> 0b c1 e9 03 f3 48 ab 49 8b bb 60 ff ff ff 48 81 ef 00 01 00
[730499.990420] RIP [<ffffffff813b125b>] pax_erase_kstack+0x4b/0x70
[730499.995169] RSP <ffff880240917f20>
[730500.015470] ---[ end trace 8eafd22df9a190c9 ]---
[730500.020078] grsec: banning user with uid 65534 until system restart for suspicious kernel crash

can you please post your config (the PaX entries are enough)?

Hello,

Sure:

Code: Select all

CONFIG_PAX_USERCOPY_SLABS=y
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
# CONFIG_PAX_EI_PAX is not set
CONFIG_PAX_PT_PAX_FLAGS=y
# CONFIG_PAX_XATTR_PAX_FLAGS is not set
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_MPROTECT_COMPAT is not set
# CONFIG_PAX_ELFRELOCS is not set
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD=""
CONFIG_PAX_ASLR=y
# CONFIG_PAX_RANDKSTACK is not set
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
# CONFIG_PAX_MEMORY_SANITIZE is not set
CONFIG_PAX_MEMORY_STACKLEAK=y
# CONFIG_PAX_MEMORY_STRUCTLEAK is not set
CONFIG_PAX_REFCOUNT=y
CONFIG_PAX_USERCOPY=y
# CONFIG_PAX_USERCOPY_DEBUG is not set
CONFIG_PAX_SIZE_OVERFLOW=y
CONFIG_PAX_LATENT_ENTROPY=y


Thanks