grsecurity forums

Hello,

Yesterday, I tried to update my server with the latest kernel (3.18.2) with latest grsec patch (timestamp 201501111422). All I can say is it doesn't work for me :p . Since this server is "headless", I can only access it via SSH, so it is very hard (impossible ?) to debug. Of course, nothing is written in my system (Archlinux) log because the system doesn't boot. I had no problem with the grsec patch just before this one (for kernel 3.18.1).

This topic may seem useless, but I wanted to warn the developer about that and maybe someone has an idea to help me to debug the boot ?

Some information about my server :

• CPU Intel Xeon E3 1245v2
• 3 SSD with Hardware RAID LSI MegaRAID

Hi,

It is probably due to a bug in the kernfs fix I wrote, which has been corrected in the patches I just released. Sorry about that!

-Brad

I'm also getting panic on my Gentoo ~amd64 PC with grsecurity-3.0-3.18.2-201501120821
3.17.7 grsec and 3.18.2 non-grsec work

photo from my old phone
http://www.imagebam.com/image/9a0562380990817

can you enable frame pointers and also capture the kernel logs via netconsole or similar?

The problem is solved for me with grsecurity-3.0-3.18.2-201501120821 ! Thanks for that very quick patch !

I tried to enable frame pointers - output is similar
qemu - boot now ends with can't find root filesystem
can't try netconsole - have only one usable machine now

with frame pointers the backtrace is much cleaner, that's why we need that screenshot.

edit: another thing you could do is resolve the reported RIP value with addr2line (disable KASLR first, e.g., pass nokaslr on the boot command line): addr2line -e vmlinux -fip <RIP value>

do you happen to have SCHED_STACK_END_CHECK enabled (new in 3.18)?

edit: and also STACKLEAK?

PaX Team wrote:do you happen to have SCHED_STACK_END_CHECK enabled (new in 3.18)?

edit: and also STACKLEAK?

yes
CONFIG_PAX_MEMORY_STACKLEAK=y
CONFIG_SCHED_STACK_END_CHECK=y

I will try with nokaslr tomorrow.

no worries, i already know the underlying problem, should be fixed by tomorrow .