grsecurity forums

Posted: **Tue Oct 20, 2015 11:54 am**

Heres a size overflow detected after enabling CONFIG_PAX_SIZE_OVERFLOW_DISABLE_KILL=y as of the october,20,2015 patches.before this the kernel would hang at loading.There are two detections listed below.

1.First Detection

Code: Select all: Oct 20 11:48:24 none kernel: ACPI : EC: EC started Oct 20 11:48:24 none kernel: ACPI: Interpreter enabled Oct 20 11:48:24 none kernel: ACPI: (supports S0 S5) Oct 20 11:48:24 none kernel: ACPI: Using IOAPIC for interrupt routing Oct 20 11:48:24 none kernel: PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xe0000000-0xefffffff] (base 0xe0000000) Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl; Oct 20 11:48:24 none kernel: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.3-grsec #1 Oct 20 11:48:24 none kernel: Hardware name: System manufacturer System Product Name/M4A88T-V EVO/USB3, BIOS 0307 12/15/2010 Oct 20 11:48:24 none kernel: ffffffff81a0676b 0000000000000000 0000000000000000 0000000000000000 Oct 20 11:48:24 none kernel: ffffc9000000b8e8 ffffffff81641700 0000000000000001 ffffffff818e83f3 Oct 20 11:48:24 none kernel: ffffc9000000b918 ffffffff81121013 ffffffff01400000 0000000000000000 Oct 20 11:48:24 none kernel: Call Trace: Oct 20 11:48:24 none kernel: [<ffffffff81641700>] dump_stack+0x45/0x5d Oct 20 11:48:24 none kernel: [<ffffffff81121013>] report_size_overflow+0x33/0x60 Oct 20 11:48:24 none kernel: [<ffffffff812d2a25>] acpi_ex_do_math_op+0x124/0x135 Oct 20 11:48:24 none kernel: [<ffffffff812d169a>] acpi_ex_opcode_2A_1T_1R+0x7c/0x39b Oct 20 11:48:24 none kernel: [<ffffffff812c83d9>] acpi_ds_exec_end_op+0xdb/0x406 Oct 20 11:48:24 none kernel: [<ffffffff812dc1ba>] acpi_ps_parse_loop+0x52e/0x59a Oct 20 11:48:24 none kernel: [<ffffffff812dcd1d>] acpi_ps_parse_aml+0x95/0x273 Oct 20 11:48:24 none kernel: [<ffffffff812dd5c0>] acpi_ps_execute_method+0x1c8/0x272 Oct 20 11:48:24 none kernel: [<ffffffff812d75e3>] acpi_ns_evaluate+0x1eb/0x281 Oct 20 11:48:24 none kernel: [<ffffffff812e3368>] acpi_ut_evaluate_object+0x67/0x195 Oct 20 11:48:24 none kernel: [<ffffffff812df353>] acpi_rs_get_method_data+0x39/0x77 Oct 20 11:48:24 none kernel: [<ffffffff815749e0>] ? list_add_sorted+0xc0/0xc0 Oct 20 11:48:24 none kernel: [<ffffffff812dfa0c>] acpi_walk_resources+0x7b/0xc5 Oct 20 11:48:24 none kernel: [<ffffffff815748ea>] find_mboard_resource+0x2a/0x60 Oct 20 11:48:24 none kernel: [<ffffffff812da447>] acpi_ns_get_device_callback+0x151/0x17a Oct 20 11:48:24 none kernel: [<ffffffff812da1ff>] acpi_ns_walk_namespace+0xfc/0x1b9 Oct 20 11:48:24 none kernel: [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a Oct 20 11:48:24 none kernel: [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a Oct 20 11:48:24 none kernel: [<ffffffff815748c0>] ? is_acpi_reserved+0xa0/0xa0 Oct 20 11:48:24 none kernel: [<ffffffff812da955>] acpi_get_devices+0x75/0xac Oct 20 11:48:24 none kernel: [<ffffffff815748c0>] ? is_acpi_reserved+0xa0/0xa0 Oct 20 11:48:24 none kernel: [<ffffffff8157486c>] is_acpi_reserved+0x4c/0xa0 Oct 20 11:48:24 none kernel: [<ffffffff81574820>] ? pci_conf2_write+0x160/0x160 Oct 20 11:48:24 none kernel: [<ffffffff8163e818>] is_mmconf_reserved+0x78/0x1a0 Oct 20 11:48:24 none kernel: [<ffffffff8163e9b9>] pci_mmcfg_check_reserved+0x79/0xc0 Oct 20 11:48:24 none kernel: [<ffffffff81c3a119>] __pci_mmcfg_init+0x27/0xad Oct 20 11:48:24 none kernel: [<ffffffff81c31373>] ? acpi_sleep_init+0xea/0xea Oct 20 11:48:24 none kernel: [<ffffffff81c3a969>] pci_mmcfg_late_init+0x35/0x3d Oct 20 11:48:24 none kernel: [<ffffffff81c315d0>] acpi_init+0x25d/0x27b Oct 20 11:48:24 none kernel: [<ffffffff81c31373>] ? acpi_sleep_init+0xea/0xea Oct 20 11:48:24 none kernel: [<ffffffff81c13160>] do_one_initcall+0xf6/0x16d Oct 20 11:48:24 none kernel: [<ffffffff81c132f9>] kernel_init_freeable+0x122/0x1b3 Oct 20 11:48:24 none kernel: [<ffffffff8163d500>] ? rest_init+0x80/0x80 Oct 20 11:48:24 none kernel: [<ffffffff8163d509>] kernel_init+0x9/0xe0 Oct 20 11:48:24 none kernel: [<ffffffff8164a4ce>] ret_from_fork+0x3e/0x70 Oct 20 11:48:24 none kernel: [<ffffffff8163d500>] ? rest_init+0x80/0x80 Oct 20 11:48:24 none kernel: PCI: MMCONFIG at [mem 0xe0000000-0xefffffff] reserved in ACPI motherboard resources Oct 20 11:48:24 none kernel: PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug Oct 20 11:48:24 none kernel: ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff]) Oct 20 11:48:24 none kernel: acpi PNP0A03:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI] Oct 20 11:48:24 none kernel: acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM

2.Second Detection

Code: Select all: Oct 20 11:48:25 none kernel: system 00:04: Plug and Play ACPI device, IDs PNP0c02 (active) Oct 20 11:48:25 none kernel: system 00:05: [io 0x0230-0x023f] has been reserved Oct 20 11:48:25 none kernel: system 00:05: [io 0x0290-0x029f] has been reserved Oct 20 11:48:25 none kernel: system 00:05: [io 0x0300-0x030f] has been reserved Oct 20 11:48:25 none kernel: system 00:05: [io 0x0a30-0x0a3f] has been reserved Oct 20 11:48:25 none kernel: system 00:05: Plug and Play ACPI device, IDs PNP0c02 (active) Oct 20 11:48:25 none kernel: system 00:06: [mem 0xe0000000-0xefffffff] has been reserved Oct 20 11:48:25 none kernel: system 00:06: Plug and Play ACPI device, IDs PNP0c02 (active) Oct 20 11:48:25 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl; Oct 20 11:48:25 none kernel: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.3-grsec #1 Oct 20 11:48:25 none kernel: Hardware name: System manufacturer System Product Name/M4A88T-V EVO/USB3, BIOS 0307 12/15/2010 Oct 20 11:48:25 none kernel: ffffffff81a0676b 0000000000000000 0000000000000000 0000000000000000 Oct 20 11:48:25 none kernel: ffffc9000000b9f8 ffffffff81641700 0000000000000001 ffffffff818e83f3 Oct 20 11:48:25 none kernel: ffffc9000000ba28 ffffffff81121013 ffffffff01400000 0000000000000000 Oct 20 11:48:25 none kernel: Call Trace: Oct 20 11:48:25 none kernel: [<ffffffff81641700>] dump_stack+0x45/0x5d Oct 20 11:48:25 none kernel: [<ffffffff81121013>] report_size_overflow+0x33/0x60 Oct 20 11:48:25 none kernel: [<ffffffff812d2a25>] acpi_ex_do_math_op+0x124/0x135 Oct 20 11:48:25 none kernel: [<ffffffff812d169a>] acpi_ex_opcode_2A_1T_1R+0x7c/0x39b Oct 20 11:48:25 none kernel: [<ffffffff812c83d9>] acpi_ds_exec_end_op+0xdb/0x406 Oct 20 11:48:25 none kernel: [<ffffffff812dc1ba>] acpi_ps_parse_loop+0x52e/0x59a Oct 20 11:48:25 none kernel: [<ffffffff812dcd1d>] acpi_ps_parse_aml+0x95/0x273 Oct 20 11:48:25 none kernel: [<ffffffff812dd5c0>] acpi_ps_execute_method+0x1c8/0x272 Oct 20 11:48:25 none kernel: [<ffffffff812d75e3>] acpi_ns_evaluate+0x1eb/0x281 Oct 20 11:48:25 none kernel: [<ffffffff812e3368>] acpi_ut_evaluate_object+0x67/0x195 Oct 20 11:48:25 none kernel: [<ffffffff812df353>] acpi_rs_get_method_data+0x39/0x77 Oct 20 11:48:25 none kernel: [<ffffffff812f23c0>] ? decode_irq_flags+0xa0/0xa0 Oct 20 11:48:25 none kernel: [<ffffffff812dfa0c>] acpi_walk_resources+0x7b/0xc5 Oct 20 11:48:25 none kernel: [<ffffffff812f26da>] pnpacpi_parse_allocated_resource+0x3a/0x80 Oct 20 11:48:25 none kernel: [<ffffffff81c32db7>] pnpacpi_add_device_handler+0x1b7/0x266 Oct 20 11:48:25 none kernel: [<ffffffff812da447>] acpi_ns_get_device_callback+0x151/0x17a Oct 20 11:48:25 none kernel: [<ffffffff812b750a>] ? acpi_os_signal_semaphore+0x2b/0x41 Oct 20 11:48:25 none kernel: [<ffffffff812da1ff>] acpi_ns_walk_namespace+0xfc/0x1b9 Oct 20 11:48:25 none kernel: [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a Oct 20 11:48:25 none kernel: [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a Oct 20 11:48:25 none kernel: [<ffffffff81c32c00>] ? ispnpidacpi+0x8a/0x8a Oct 20 11:48:25 none kernel: [<ffffffff812da955>] acpi_get_devices+0x75/0xac Oct 20 11:48:25 none kernel: [<ffffffff81c32c00>] ? ispnpidacpi+0x8a/0x8a Oct 20 11:48:25 none kernel: [<ffffffff81c32e66>] ? pnpacpi_add_device_handler+0x266/0x266 Oct 20 11:48:25 none kernel: [<ffffffff81c32eb4>] pnpacpi_init+0x4e/0x74 Oct 20 11:48:25 none kernel: [<ffffffff81c13160>] do_one_initcall+0xf6/0x16d Oct 20 11:48:25 none kernel: [<ffffffff81c132f9>] kernel_init_freeable+0x122/0x1b3 Oct 20 11:48:25 none kernel: [<ffffffff8163d500>] ? rest_init+0x80/0x80 Oct 20 11:48:25 none kernel: [<ffffffff8163d509>] kernel_init+0x9/0xe0 Oct 20 11:48:25 none kernel: [<ffffffff8164a4ce>] ret_from_fork+0x3e/0x70 Oct 20 11:48:25 none kernel: [<ffffffff8163d500>] ? rest_init+0x80/0x80 Oct 20 11:48:25 none kernel: system 00:07: [mem 0x00000000-0x0009ffff] could not be reserved Oct 20 11:48:25 none kernel: system 00:07: [mem 0x000c0000-0x000cffff] could not be reserved Oct 20 11:48:25 none kernel: system 00:07: [mem 0x000e0000-0x000fffff] could not be reserved Oct 20 11:48:25 none kernel: system 00:07: [mem 0x00100000-0xcfefffff] could not be reserved Oct 20 11:48:25 none kernel: system 00:07: [mem 0xfec00000-0xffffffff] could not be reserved Oct 20 11:48:25 none kernel: system 00:07: Plug and Play ACPI device, IDs PNP0c01 (active)

Posted: **Tue Oct 20, 2015 1:42 pm**

Hello,

Same for me with grsecurity-3.1-4.2.3-201510200858.patch, I have 2 different errors :

1) at boot only :

Code: Select all: PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer; CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.2.3.201510200858-1-grsec-custom #1 Hardware name: System manufacturer System Product Name/P8Z77-M ffffffffb1a0a843 0000000000000000 0000000000000000 ffffffffb18f5b81 ffffc9000000b9b8 ffffffffb15e86e1 00000000000000b2 ffffffffb18f5b69 ffffc9000000b9e8 ffffffffb119f303 0000000000000039 f000000000000000 Call Trace: [<ffffffffb15e86e1>] dump_stack+0x45/0x5d [<ffffffffb119f303>] report_size_overflow+0x33/0x60 [<ffffffffb136fe52>] acpi_ex_opcode_1A_1T_1R+0x231/0x66b [<ffffffffb1367145>] ? acpi_ds_create_operands+0x7b/0xe6 [<ffffffffb136767b>] acpi_ds_exec_end_op+0xdb/0x406 [<ffffffffb137b618>] acpi_ps_parse_loop+0x52e/0x59a [<ffffffffb137c17b>] acpi_ps_parse_aml+0x95/0x273 [<ffffffffb137ca29>] acpi_ps_execute_method+0x1c8/0x272 [<ffffffffb13769e0>] acpi_ns_evaluate+0x1eb/0x281 [<ffffffffb1382820>] acpi_ut_evaluate_object+0x6c/0x19a [<ffffffffb137e7c1>] acpi_rs_get_method_data+0x39/0x77 [<ffffffffb1391030>] ? decode_irq_flags+0xa0/0xa0 [<ffffffffb137ed28>] acpi_walk_resources+0x7b/0xc5 [<ffffffffb139134a>] pnpacpi_parse_allocated_resource+0x3a/0x70 [<ffffffffb1c484d9>] pnpacpi_add_device_handler+0x1b7/0x266 [<ffffffffb1379daf>] acpi_ns_get_device_callback+0x151/0x17a [<ffffffffb1353bdb>] ? acpi_os_signal_semaphore+0x2b/0x41 [<ffffffffb137963c>] acpi_ns_walk_namespace+0xfc/0x1b9 [<ffffffffb1379c5e>] ? acpi_walk_namespace+0xcc/0xcc [<ffffffffb1379c5e>] ? acpi_walk_namespace+0xcc/0xcc [<ffffffffb1c48322>] ? ispnpidacpi+0x8a/0x8a [<ffffffffb1379b5b>] acpi_get_devices+0x75/0xac [<ffffffffb1c48322>] ? ispnpidacpi+0x8a/0x8a [<ffffffffb1c48588>] ? pnpacpi_add_device_handler+0x266/0x266 [<ffffffffb1c485d6>] pnpacpi_init+0x4e/0x74 [<ffffffffb100039d>] do_one_initcall+0x8d/0x190 [<ffffffffb1c123a0>] kernel_init_freeable+0x183/0x22d [<ffffffffb15dca60>] ? rest_init+0x80/0x80 [<ffffffffb15dca69>] kernel_init+0x9/0xf0 [<ffffffffb15ee7ce>] ret_from_fork+0x3e/0x70 [<ffffffffb15dca60>] ? rest_init+0x80/0x80

2) Everytime (very often) :

Code: Select all: PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff; CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-1-grsec-custom #1 Hardware name: System manufacturer System Product Name/P8Z77-M ffffffffb1a0a843 8407677e19d803d4 0000000000000000 ffffffffb18ff5ec ffff88081fa03cc8 ffffffffb15e86e1 0000000000000097 ffffffffb192ff42 ffff88081fa03cf8 ffffffffb119f303 000000000000003a 0000000000000028 Call Trace: <IRQ> [<ffffffffb15e86e1>] dump_stack+0x45/0x5d [<ffffffffb119f303>] report_size_overflow+0x33/0x60 [<ffffffffb15c3f71>] ipv6_gro_receive+0xa11/0xb10 [<ffffffffb14b193c>] dev_gro_receive+0x29c/0x670 [<ffffffffb12f46dc>] ? swiotlb_sync_single+0x4c/0x70 [<ffffffffb14b2030>] napi_gro_receive+0x20/0x90 [<ffffffffc02a125f>] rtl8169_poll+0x2bf/0x650 [r8169] [<ffffffffb14b31c3>] net_rx_action+0x1f3/0x300 [<ffffffffb1068a77>] __do_softirq+0xf7/0x210 [<ffffffffb1068cca>] irq_exit+0x6a/0x70 [<ffffffffb1005655>] do_IRQ+0x55/0xf0 [<ffffffffb15eef1a>] common_interrupt+0x9a/0x9a <EOI> [<ffffffffb1462cd6>] ? cpuidle_enter_state+0x156/0x210 [<ffffffffb1462df4>] cpuidle_enter+0x24/0x40 [<ffffffffb10a922b>] call_cpuidle+0x3b/0x70 [<ffffffffb10a9401>] cpu_startup_entry+0x1a1/0x260 [<ffffffffb15dca57>] rest_init+0x77/0x80 [<ffffffffb1c121f8>] 0xffffffffb1c121f8 [<ffffffffb1c11120>] ? 0xffffffffb1c11120 [<ffffffffb1c11328>] 0xffffffffb1c11328 [<ffffffffb1c1141e>] 0xffffffffb1c1141e

Posted: **Tue Oct 20, 2015 4:44 pm**

Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer

Thanks for the report, they will be fixed in the next grsec patch.

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

Could you please apply this patch and send me the result from dmesg?

Code: Select all: --- net/ipv6/ip6_offload.c.orig 2015-10-20 23:03:13.139805700 +0200 +++ net/ipv6/ip6_offload.c 2015-10-20 23:09:50.795787971 +0200 @@ -197,6 +197,7 @@ if (!ops || !ops->callbacks.gro_receive) { __pskb_pull(skb, skb_gro_offset(skb)); proto = ipv6_gso_pull_exthdrs(skb, proto); + printk(KERN_ERR "PAX overflow: head: %p, header: %hx, data: %p\n", skb->head, skb->transport_header, skb->data); skb_gro_pull(skb, -skb_transport_offset(skb)); skb_reset_transport_header(skb); __skb_push(skb, skb_gro_offset(skb));

Posted: **Tue Oct 20, 2015 4:55 pm**

Ok I'm compiling the kernel with this patch, but be careful when you copy paste because I had to replace spaces with tabs for this patch to work haha.

Posted: **Tue Oct 20, 2015 5:33 pm**

Results :

I have now a lot of lines like these :

Code: Select all: [ 9.450086] PAX overflow: head: ffff8807e2aaf880, header: 76, data: ffff8807e2aaf8f6 [ 9.450129] PAX overflow: head: ffff8807e2aaf680, header: 76, data: ffff8807e2aaf6f6 [ 10.637674] PAX overflow: head: ffff8807e21c44c0, header: 76, data: ffff8807e21c4536 [ 22.346769] PAX overflow: head: ffff8807e2aae7c0, header: 76, data: ffff8807e2aae836 [ 24.826671] PAX overflow: head: ffff8807dccb55c0, header: 76, data: ffff8807dccb5636 [ 27.538437] PAX overflow: head: ffff8807e2aab140, header: 76, data: ffff8807e2aab1b6 [ 29.836006] PAX overflow: head: ffff8807e2aa9f00, header: 76, data: ffff8807e2aa9f76 [ 34.853553] PAX overflow: head: ffff8807e2aa9cc0, header: 76, data: ffff8807e2aa9d36 [ 37.555678] PAX overflow: head: ffff8807e2aa8080, header: 76, data: ffff8807e2aa80f6 [ 38.554670] PAX overflow: head: ffff8807e2aaf640, header: 76, data: ffff8807e2aaf6b6 [ 39.431445] PAX overflow: head: ffff8807da7d60c0, header: 76, data: ffff8807da7d6136 [ 39.440229] PAX overflow: head: ffff8807da7d0940, header: 76, data: ffff8807da7d09b6 [ 39.467055] PAX overflow: head: ffff8807da7f2980, header: 76, data: ffff8807da7f29f6 [ 39.467103] PAX overflow: head: ffff8807da7f22c0, header: 76, data: ffff8807da7f2336 [ 39.467128] PAX overflow: head: ffff8807da7f2000, header: 76, data: ffff8807da7f2076 [ 39.467160] PAX overflow: head: ffff8807da7f1940, header: 76, data: ffff8807da7f19b6 [ 39.467184] PAX overflow: head: ffff8807da7f1280, header: 76, data: ffff8807da7f12f6 [ 39.467207] PAX overflow: head: ffff8807da7f0f80, header: 76, data: ffff8807da7f0ff6 [ 39.484739] PAX overflow: head: ffff8807da7d4d00, header: 76, data: ffff8807da7d4d76 [ 39.484780] PAX overflow: head: ffff8807da7d4a40, header: 76, data: ffff8807da7d4ab6 [ 39.554171] PAX overflow: head: ffff8807da7c8c80, header: 76, data: ffff8807da7c8cf6 [ 39.573188] PAX overflow: head: ffff8807da7d0100, header: 76, data: ffff8807da7d0176 [ 39.573217] PAX overflow: head: ffff8807da7cfd40, header: 76, data: ffff8807da7cfdb6 [ 39.575247] PAX overflow: head: ffff8807e2beabc0, header: 76, data: ffff8807e2beac36 [ 39.575289] PAX overflow: head: ffff8807e2bea900, header: 76, data: ffff8807e2bea976 [ 39.658925] PAX overflow: head: ffff8807e2aa9740, header: 76, data: ffff8807e2aa97b6 [ 39.658968] PAX overflow: head: ffff8807e2aa9540, header: 76, data: ffff8807e2aa95b6 [ 39.818776] PAX overflow: head: ffff8807e2aa96c0, header: 76, data: ffff8807e2aa9736 [ 39.827443] PAX overflow: head: ffff8807e2aa8e00, header: 76, data: ffff8807e2aa8e76 [ 40.215579] PAX overflow: head: ffff8807e2aa8f00, header: 76, data: ffff8807e2aa8f76 [ 40.601756] PAX overflow: head: ffff8807e2aad8c0, header: 76, data: ffff8807e2aad936 [ 63.296201] PAX overflow: head: ffff8807e2aa9000, header: 76, data: ffff8807e2aa9076 [ 64.294019] PAX overflow: head: ffff8807dccb4c80, header: 76, data: ffff8807dccb4cf6 [ 65.296174] PAX overflow: head: ffff8807da7cd700, header: 76, data: ffff8807da7cd776 [ 79.261389] PAX overflow: head: ffff8807e2aa9a00, header: 76, data: ffff8807e2aa9a76 [ 84.262432] PAX overflow: head: ffff8807e2aa9380, header: 76, data: ffff8807e2aa93f6 [ 90.344921] PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e [ 90.345157] PAX overflow: head: ffff8807e2aae9c0, header: 76, data: ffff8807e2aaea3e [ 90.480358] PAX overflow: head: ffff8807e2aae7c0, header: 76, data: ffff8807e2aae83e [ 90.481381] PAX overflow: head: ffff8807e2aae5c0, header: 76, data: ffff8807e2aae63e [ 90.493867] PAX overflow: head: ffff8807e2aae3c0, header: 76, data: ffff8807e2aae43e [ 90.592953] PAX overflow: head: ffff8807e2aad840, header: 76, data: ffff8807e2aad8be [ 90.594687] PAX overflow: head: ffff8807e2aad640, header: 76, data: ffff8807e2aad6be [ 90.743709] PAX overflow: head: ffff8807e2aad440, header: 76, data: ffff8807e2aad4be [ 90.745774] PAX overflow: head: ffff8807e2aad240, header: 76, data: ffff8807e2aad2be [ 90.946151] PAX overflow: head: ffff8807e2aace80, header: 76, data: ffff8807e2aacefe [ 90.968702] PAX overflow: head: ffff8807e2aacc80, header: 76, data: ffff8807e2aaccfe [ 90.969590] PAX overflow: head: ffff8807e2aaca80, header: 76, data: ffff8807e2aacafe [ 90.970452] PAX overflow: head: ffff8807e2aac880, header: 76, data: ffff8807e2aac8fe [ 90.971311] PAX overflow: head: ffff8807e2aac680, header: 76, data: ffff8807e2aac6fe [ 186.300007] PAX overflow: head: ffff8807e2aae380, header: 76, data: ffff8807e2aae3f6 [ 187.380896] PAX overflow: head: ffff8807e2aadd80, header: 76, data: ffff8807e2aaddf6 [ 188.469747] PAX overflow: head: ffff8807e2aad980, header: 76, data: ffff8807e2aad9f6 [ 215.674039] PAX overflow: head: ffff8807e2aac100, header: 76, data: ffff8807e2aac17e [ 215.762678] PAX overflow: head: ffff8807e2aabf00, header: 76, data: ffff8807e2aabf7e [ 215.765483] PAX overflow: head: ffff8807e2aabd00, header: 76, data: ffff8807e2aabd7e [ 216.019843] PAX overflow: head: ffff8807e2aabb00, header: 76, data: ffff8807e2aabb7e [ 216.022950] PAX overflow: head: ffff8807e2aab900, header: 76, data: ffff8807e2aab97e [ 216.061069] PAX overflow: head: ffff8807e2aab300, header: 76, data: ffff8807e2aab37e [ 216.261829] PAX overflow: head: ffff8807e2aaac80, header: 76, data: ffff8807e2aaacfe [ 216.265002] PAX overflow: head: ffff8807e2aaaa80, header: 76, data: ffff8807e2aaaafe [ 216.268109] PAX overflow: head: ffff8807e2aaa880, header: 76, data: ffff8807e2aaa8fe [ 216.271501] PAX overflow: head: ffff8807e2be92c0, header: 76, data: ffff8807e2be933e [ 216.274633] PAX overflow: head: ffff8807e2be90c0, header: 76, data: ffff8807e2be913e [ 216.423651] PAX overflow: head: ffff8807e2aaa680, header: 76, data: ffff8807e2aaa6fe [ 216.424709] PAX overflow: head: ffff8807e2aaa480, header: 76, data: ffff8807e2aaa4fe [ 216.513672] PAX overflow: head: ffff8807e2aaa280, header: 76, data: ffff8807e2aaa2fe [ 216.514696] PAX overflow: head: ffff8807e2aaa080, header: 76, data: ffff8807e2aaa0fe [ 309.287479] PAX overflow: head: ffff8807e2aac680, header: 76, data: ffff8807e2aac6f6 [ 310.286853] PAX overflow: head: ffff8807e2aac240, header: 76, data: ffff8807e2aac2b6 [ 311.286007] PAX overflow: head: ffff8807e2aab640, header: 76, data: ffff8807e2aab6b6 [ 341.190166] PAX overflow: head: ffff8807e2aaef40, header: 76, data: ffff8807e2aaefbe [ 341.192888] PAX overflow: head: ffff8807e2aaed40, header: 76, data: ffff8807e2aaedbe [ 341.195723] PAX overflow: head: ffff8807e2aaeb40, header: 76, data: ffff8807e2aaebbe [ 341.198897] PAX overflow: head: ffff8807e21d6d80, header: 76, data: ffff8807e21d6dfe [ 341.202265] PAX overflow: head: ffff8807e21d6b80, header: 76, data: ffff8807e21d6bfe [ 341.205520] PAX overflow: head: ffff8807e21d6980, header: 76, data: ffff8807e21d69fe [ 341.355753] PAX overflow: head: ffff8807e2aae940, header: 76, data: ffff8807e2aae9be [ 341.503082] PAX overflow: head: ffff8807e2aae740, header: 76, data: ffff8807e2aae7be [ 341.603887] PAX overflow: head: ffff8807e2aae540, header: 76, data: ffff8807e2aae5be [ 341.607001] PAX overflow: head: ffff8807e2aae340, header: 76, data: ffff8807e2aae3be [ 341.688754] PAX overflow: head: ffff8807e2aae140, header: 76, data: ffff8807e2aae1be [ 341.698663] PAX overflow: head: ffff8807e2aadf40, header: 76, data: ffff8807e2aadfbe [ 341.699716] PAX overflow: head: ffff8807e2aadd40, header: 76, data: ffff8807e2aaddbe [ 383.278181] PAX overflow: head: ffff8807e2aab980, header: 76, data: ffff8807e2aab9f6 [ 388.307731] PAX overflow: head: ffff8807e2aa8f00, header: 76, data: ffff8807e2aa8f76 [ 432.275487] PAX overflow: head: ffff8807d65d4a00, header: 76, data: ffff8807d65d4a76 [ 433.276853] PAX overflow: head: ffff8807d65d3b40, header: 76, data: ffff8807d65d3bb6 [ 434.274518] PAX overflow: head: ffff8807d65d27c0, header: 76, data: ffff8807d65d2836 [ 466.626310] PAX overflow: head: ffff8807d65d1dc0, header: 76, data: ffff8807d65d1e3e [ 466.784042] PAX overflow: head: ffff8807d65d1200, header: 76, data: ffff8807d65d127e [ 466.786864] PAX overflow: head: ffff8807d65d1000, header: 76, data: ffff8807d65d107e [ 466.874015] PAX overflow: head: ffff8807d65d0180, header: 76, data: ffff8807d65d01fe [ 466.877124] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e7e [ 466.880225] PAX overflow: head: ffff8807d65d7c00, header: 76, data: ffff8807d65d7c7e [ 466.883293] PAX overflow: head: ffff8807d65d7a00, header: 76, data: ffff8807d65d7a7e [ 466.886361] PAX overflow: head: ffff8807d65d7800, header: 76, data: ffff8807d65d787e [ 467.033854] PAX overflow: head: ffff8807d65d6940, header: 76, data: ffff8807d65d69be [ 467.123922] PAX overflow: head: ffff8807d65d6140, header: 76, data: ffff8807d65d61be [ 467.127008] PAX overflow: head: ffff8807d65d5f40, header: 76, data: ffff8807d65d5fbe [ 467.128055] PAX overflow: head: ffff8807d65d5d40, header: 76, data: ffff8807d65d5dbe [ 467.129117] PAX overflow: head: ffff8807d65d5b40, header: 76, data: ffff8807d65d5bbe [ 500.158217] PAX overflow: head: ffff8807d65d4540, header: 76, data: ffff8807d65d45b6 [ 501.157524] PAX overflow: head: ffff8807d65d3fc0, header: 76, data: ffff8807d65d4036 [ 502.156942] PAX overflow: head: ffff8807d65d3c00, header: 76, data: ffff8807d65d3c76 [ 541.343455] PAX overflow: head: ffff8807d65d0ac0, header: 76, data: ffff8807d65d0b36 [ 542.412005] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e76 [ 543.497534] PAX overflow: head: ffff8807d65d7680, header: 76, data: ffff8807d65d76f6

And errors like before

Code: Select all: PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.145_218 min, count: 36, decl: len; num: 0; context: sk_buff; CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-2-grsec-custom #1 Hardware name: System manufacturer System Product Name/P8Z77-M ffffffffbda0a86b 5637e362e5084bb0 0000000000000000 ffffffffbd90188c ffff88081fa03cc8 ffffffffbd5e9575 0000000000000097 ffffffffbd9321e2 ffff88081fa03cf8 ffffffffbd19f243 fffffffffffffff8 0000000000000000 Call Trace: <IRQ> [<ffffffffbd5e9575>] dump_stack+0x45/0x5d [<ffffffffbd19f243>] report_size_overflow+0x33/0x60 [<ffffffffbd5c4999>] ipv6_gro_receive+0x469/0x910 [<ffffffffbd4b274c>] dev_gro_receive+0x29c/0x670 [<ffffffffbd2f567c>] ? swiotlb_sync_single+0x4c/0x70 [<ffffffffbd4b2e40>] napi_gro_receive+0x20/0x90 [<ffffffffc02c525f>] rtl8169_poll+0x2bf/0x650 [r8169] [<ffffffffbd4b3fd3>] net_rx_action+0x1f3/0x300 [<ffffffffbd0689f7>] __do_softirq+0xf7/0x210 [<ffffffffbd068c4a>] irq_exit+0x6a/0x70 [<ffffffffbd005635>] do_IRQ+0x55/0xf0 [<ffffffffbd5efdda>] common_interrupt+0x9a/0x9a <EOI> [<ffffffffbd463ab6>] ? cpuidle_enter_state+0x156/0x210 [<ffffffffbd463bd4>] cpuidle_enter+0x24/0x40 [<ffffffffbd0a902b>] call_cpuidle+0x3b/0x70 [<ffffffffbd0a9201>] cpu_startup_entry+0x1a1/0x260 [<ffffffffbd5dd8b7>] rest_init+0x77/0x80 [<ffffffffbdc121f8>] 0xffffffffbdc121f8 [<ffffffffbdc11120>] ? 0xffffffffbdc11120 [<ffffffffbdc11328>] 0xffffffffbdc11328 [<ffffffffbdc1141e>] 0xffffffffbdc1141e

Posted: **Tue Oct 20, 2015 6:12 pm**

ephox wrote:
Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer

Thanks for the report, they will be fixed in the next grsec patch.

Thanks for the fix

.

Posted: **Tue Oct 20, 2015 6:20 pm**

rfnx wrote:I have now a lot of lines like these :
Code: Select all
[ 541.343455] PAX overflow: head: ffff8807d65d0ac0, header: 76, data: ffff8807d65d0b36 [ 542.412005] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e76 [ 543.497534] PAX overflow: head: ffff8807d65d7680, header: 76, data: ffff8807d65d76f6

which of those lines is the last that appears just before the overflow report?

Posted: **Tue Oct 20, 2015 6:56 pm**

The last error line "pax overflow: head: ..." that appears before the first overflow "pax: size overflow detected..." is :

Code: Select all: PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e

EDIT : here is the part of the log where the first overflow happens (shortly after boot) :

Code: Select all: [...] PAX overflow: head: ffff8807e2aa9a00, header: 76, data: ffff8807e2aa9a76 PAX overflow: head: ffff8807e2aa9380, header: 76, data: ffff8807e2aa93f6 PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e report_size_overflow: 5 callbacks suppressed PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.145_218 min, count: 36, decl: len; num: 0; context: sk_buff; CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-2-grsec-custom #1 Hardware name: System manufacturer System Product Name/P8Z77-M ffffffffbda0a86b 5637e362e5084bb0 0000000000000000 ffffffffbd90188c ffff88081fa03cc8 ffffffffbd5e9575 0000000000000097 ffffffffbd9321e2 ffff88081fa03cf8 ffffffffbd19f243 fffffffffffffff8 0000000000000000 Call Trace: <IRQ> [<ffffffffbd5e9575>] dump_stack+0x45/0x5d [<ffffffffbd19f243>] report_size_overflow+0x33/0x60 [<ffffffffbd5c4999>] ipv6_gro_receive+0x469/0x910 [<ffffffffbd4b274c>] dev_gro_receive+0x29c/0x670 [<ffffffffbd2f567c>] ? swiotlb_sync_single+0x4c/0x70 [<ffffffffbd4b2e40>] napi_gro_receive+0x20/0x90 [<ffffffffc02c525f>] rtl8169_poll+0x2bf/0x650 [r8169] [<ffffffffbd4b3fd3>] net_rx_action+0x1f3/0x300 [<ffffffffbd0689f7>] __do_softirq+0xf7/0x210 [<ffffffffbd068c4a>] irq_exit+0x6a/0x70 [<ffffffffbd005635>] do_IRQ+0x55/0xf0 [<ffffffffbd5efdda>] common_interrupt+0x9a/0x9a <EOI> [<ffffffffbd463ab6>] ? cpuidle_enter_state+0x156/0x210 [<ffffffffbd463bd4>] cpuidle_enter+0x24/0x40 [<ffffffffbd0a902b>] call_cpuidle+0x3b/0x70 [<ffffffffbd0a9201>] cpu_startup_entry+0x1a1/0x260 [<ffffffffbd5dd8b7>] rest_init+0x77/0x80 [<ffffffffbdc121f8>] 0xffffffffbdc121f8 [<ffffffffbdc11120>] ? 0xffffffffbdc11120 [<ffffffffbdc11328>] 0xffffffffbdc11328 [<ffffffffbdc1141e>] 0xffffffffbdc1141e [...]

Posted: **Tue Oct 20, 2015 7:17 pm**

Hello, with the latest patch (grsecurity-3.1-4.2.3-201510200858.patch) I get error messages about size overflow too. More specifically:

Code: Select all: Oct 21 00:35:58 fux-laptop kernel: PAX: size overflow detected in function proc_do_submiturb drivers/usb/core/devio.c:1502 cicus.726_1394 max, count: 109, decl: pipe; num: 0; context: urb; Oct 21 00:35:58 fux-laptop kernel: CPU: 1 PID: 373 Comm: mtp-probe Not tainted 4.2.3-grsec-20151020 #1 Oct 21 00:35:58 fux-laptop kernel: Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011 Oct 21 00:35:58 fux-laptop kernel: ffffc9000099bb58 589b371f1a9d627b 0000000000000000 0000000000000000 Oct 21 00:35:58 fux-laptop kernel: ffffc9000099bb78 ffffffffb94fbfb1 0000000000000007 ffffffffc02158fb Oct 21 00:35:58 fux-laptop kernel: ffffc9000099bbb8 ffffffffb9169323 ffffc9000099bbb8 ffffffffc0215c13 Oct 21 00:35:58 fux-laptop kernel: Call Trace: Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb94fbfb1>] dump_stack+0x4c/0x7f Oct 21 00:35:58 fux-laptop kernel: [<ffffffffc02158fb>] ? usb_exit+0x5d10/0xe695 [usbcore] Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb9169323>] report_size_overflow+0x4f/0x60 Oct 21 00:35:58 fux-laptop kernel: [<ffffffffc0215c13>] ? usb_exit+0x6028/0xe695 [usbcore] Oct 21 00:35:58 fux-laptop kernel: [<ffffffffc020aeca>] proc_do_submiturb+0x985/0x1253 [usbcore] Oct 21 00:35:58 fux-laptop kernel: [<ffffffffc020c6b0>] usbdev_do_ioctl+0x9d9/0x1363 [usbcore] Oct 21 00:35:58 fux-laptop kernel: [<ffffffffc020d08d>] usbdev_ioctl+0x23/0x2d [usbcore] Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb9175d96>] vfs_ioctl+0x41/0x55 Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb9176a47>] do_vfs_ioctl+0x487/0x7d1 Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb91819c0>] ? __fget+0x80/0x92 Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb9176de9>] SyS_ioctl+0x58/0x83 Oct 21 00:35:58 fux-laptop kernel: [<ffffffffb95017e9>] entry_SYSCALL_64_fastpath+0x12/0x83

and:

Code: Select all: Oct 21 00:36:20 fux-laptop kernel: PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1056 cicus.232_207 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate; Oct 21 00:36:21 fux-laptop kernel: CPU: 1 PID: 697 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1 Oct 21 00:36:21 fux-laptop kernel: Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011 Oct 21 00:36:21 fux-laptop kernel: ffffc900009b35f8 a0490a9f6f5dce67 0000000000000000 0000000000000000 Oct 21 00:36:21 fux-laptop kernel: ffffc900009b3618 ffffffffb94fbfb1 0000000000000007 ffffffffc05acc04 Oct 21 00:36:21 fux-laptop kernel: ffffc900009b3658 ffffffffb9169323 ffffffffffff4111 ffffffffc05acc7e Oct 21 00:36:21 fux-laptop kernel: Call Trace: Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb94fbfb1>] dump_stack+0x4c/0x7f Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc05acc04>] ? ieee80211_exit+0x10122/0x1c566 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb9169323>] report_size_overflow+0x4f/0x60 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc05acc7e>] ? ieee80211_exit+0x1019c/0x1c566 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc059ae2e>] minstrel_ht_get_rate+0x3f2/0x497 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc0567cc5>] rate_control_get_rate+0xd5/0x142 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc0576b4c>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc057774f>] invoke_tx_handlers+0x4df/0xfb4 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc0575e46>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc0578411>] ieee80211_tx+0xad/0xf5 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc057a7a0>] ieee80211_xmit+0x18e/0x1a3 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc057bb0b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93e498d>] ? __alloc_skb+0x84/0x273 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb9149e4e>] ? __kmalloc_node_track_caller+0x47/0x19f Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93e498d>] ? __alloc_skb+0x84/0x273 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffc057bc12>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211] Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93fba66>] dev_hard_start_xmit+0x380/0x417 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb942286a>] sch_direct_xmit+0xa7/0x251 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93fbef5>] __dev_queue_xmit+0x2b7/0x4d2 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93fc123>] dev_queue_xmit_sk+0x13/0x1d Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb94dd9a3>] ? ipv6_mc_check_mld+0x615/0x615 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb94dd9b8>] dev_queue_xmit+0x15/0x1f Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb94dd9a3>] ? ipv6_mc_check_mld+0x615/0x615 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb94e4da4>] packet_sendmsg+0x174c/0x18f9 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93d94bb>] sock_sendmsg+0x44/0x5d Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb93dae58>] SyS_sendto+0x138/0x183 Oct 21 00:36:21 fux-laptop kernel: [<ffffffffb95017e9>] entry_SYSCALL_64_fastpath+0x12/0x83

Posted: **Tue Oct 20, 2015 7:45 pm**

the devio.c one will be fixed in the next patch, however the other one is new and doesn't at first look like an obvious false positive so we'll need some runtime values. can you stick a printk into net/mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate like this and report back the results please:

Code: Select all: --- a/net/mac80211/rc80211_minstrel_ht.c 2015-09-09 11:17:48.835255341 +0200 +++ b/net/mac80211/rc80211_minstrel_ht.c 2015-10-21 01:37:22.825136596 +0200 @@ -1053,6 +1053,7 @@ ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES, sample_group->streams); } else { + pr_err("PAX: sample_idx:%x streams:%x\n", sample_idx, sample_group->streams); rate->idx = sample_idx % MCS_GROUP_RATES + (sample_group->streams - 1) * 8; }

Posted: **Tue Oct 20, 2015 9:28 pm**

Thanks for your work !

Since the latest patch (grsecurity-3.1-4.2.3-201510202025.patch), my first error that happened only at boot is gone :

Code: Select all: PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer;

But the second one is still here :

Code: Select all: PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

And a new one appeared, at boot only :

Code: Select all: PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

Posted: **Wed Oct 21, 2015 12:08 pm**

PaX Team wrote:the devio.c one will be fixed in the next patch, however the other one is new and doesn't at first look like an obvious false positive so we'll need some runtime values. can you stick a printk into net/mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate like this and report back the results please:
Code: Select all
--- a/net/mac80211/rc80211_minstrel_ht.c 2015-09-09 11:17:48.835255341 +0200 +++ b/net/mac80211/rc80211_minstrel_ht.c 2015-10-21 01:37:22.825136596 +0200 @@ -1053,6 +1053,7 @@ ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES, sample_group->streams); } else { + pr_err("PAX: sample_idx:%x streams:%x\n", sample_idx, sample_group->streams); rate->idx = sample_idx % MCS_GROUP_RATES + (sample_group->streams - 1) * 8; }

This is what I get:

Code: Select all: [ 50.759495] PAX: sample_idx:1b streams:1 [ 50.759517] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate; [ 50.759915] CPU: 1 PID: 779 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1 [ 50.759923] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011 [ 50.759931] ffffc90000f936e8 b7b33e976656336a 0000000000000000 0000000000000000 [ 50.759946] ffffc90000f93708 ffffffff8d4fadf6 0000000000000007 ffffffffc05acca4 [ 50.759959] ffffc90000f93748 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f [ 50.759971] Call Trace: [ 50.759996] [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f [ 50.760032] [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211] [ 50.760044] [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88 [ 50.760069] [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211] [ 50.760099] [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211] [ 50.760134] [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211] [ 50.760172] [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211] [ 50.760208] [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211] [ 50.760244] [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211] [ 50.760279] [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211] [ 50.760317] [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211] [ 50.760352] [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211] [ 50.760365] [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273 [ 50.760377] [<ffffffff8d149f39>] ? __kmalloc_node_track_caller+0x47/0x19c [ 50.760387] [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273 [ 50.760422] [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211] [ 50.760436] [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417 [ 50.760451] [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251 [ 50.760462] [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2 [ 50.760473] [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d [ 50.760484] [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615 [ 50.760493] [<ffffffff8d4dc7ef>] dev_queue_xmit+0x15/0x1f [ 50.760503] [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615 [ 50.760513] [<ffffffff8d4e3be2>] packet_sendmsg+0x174c/0x18f9 [ 50.760528] [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d [ 50.760538] [<ffffffff8d3d9e6e>] SyS_sendto+0x138/0x183 [ 50.760555] [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83 [ 50.761955] PAX: sample_idx:3 streams:1 [ 50.761973] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate; [ 50.762312] CPU: 1 PID: 713 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1 [ 50.762318] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011 [ 50.762325] ffffc90000b735f8 4657560f66159747 0000000000000000 0000000000000000 [ 50.762339] ffffc90000b73618 ffffffff8d4fadf6 00000000ffffffff ffffffffc05acca4 [ 50.762351] ffffc90000b73658 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f [ 50.762363] Call Trace: [ 50.762386] [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f [ 50.762419] [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211] [ 50.762430] [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88 [ 50.762455] [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211] [ 50.762483] [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211] [ 50.762516] [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211] [ 50.762552] [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211] [ 50.762588] [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211] [ 50.762622] [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211] [ 50.762657] [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211] [ 50.762694] [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211] [ 50.762730] [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211] [ 50.762743] [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273 [ 50.762755] [<ffffffff8d149f39>] ? __kmalloc_node_track_caller+0x47/0x19c [ 50.762764] [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273 [ 50.762800] [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211] [ 50.762812] [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417 [ 50.762826] [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251 [ 50.762837] [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2 [ 50.762848] [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d [ 50.762858] [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615 [ 50.762867] [<ffffffff8d4dc7ef>] dev_queue_xmit+0x15/0x1f [ 50.762876] [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615 [ 50.762887] [<ffffffff8d4e3be2>] packet_sendmsg+0x174c/0x18f9 [ 50.762901] [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d [ 50.762911] [<ffffffff8d3d9e6e>] SyS_sendto+0x138/0x183 [ 50.762927] [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83 [ 50.762941] [<ffffffff8d500659>] ? entry_SYSCALL_64_fastpath+0x42/0x83 [ 51.387360] PAX: sample_idx:19 streams:1 [ 51.387382] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate; [ 51.387716] CPU: 0 PID: 675 Comm: ntpd Not tainted 4.2.3-grsec-20151020 #1 [ 51.387723] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011 [ 51.387731] ffffc90000de3178 05fd07c48e976f68 0000000000000000 0000000000000000 [ 51.387744] ffffc90000de3198 ffffffff8d4fadf6 00000000ffffffff ffffffffc05acca4 [ 51.387757] ffffc90000de31d8 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f [ 51.387769] Call Trace: [ 51.387791] [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f [ 51.387825] [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211] [ 51.387837] [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88 [ 51.387862] [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211] [ 51.387890] [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211] [ 51.387924] [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211] [ 51.387960] [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211] [ 51.387997] [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211] [ 51.388008] [<ffffffff8d28347b>] ? list_del+0x11/0x2c [ 51.388041] [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211] [ 51.388076] [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211] [ 51.388113] [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211] [ 51.388149] [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211] [ 51.388161] [<ffffffff8d0fd1f9>] ? __alloc_pages_nodemask+0x189/0x81c [ 51.388174] [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273 [ 51.388210] [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211] [ 51.388222] [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417 [ 51.388235] [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251 [ 51.388246] [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2 [ 51.388257] [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d [ 51.388266] [<ffffffff8d3faff4>] ? __dev_queue_xmit+0x4d2/0x4d2 [ 51.388277] [<ffffffff8d46c823>] arp_xmit.part.0+0x20/0x2a [ 51.388286] [<ffffffff8d46c855>] arp_xmit+0x28/0x95 [ 51.388297] [<ffffffff8d46cb28>] arp_send+0x55/0x5d [ 51.388307] [<ffffffff8d46d2e5>] arp_solicit+0x1a7/0x1d2 [ 51.388317] [<ffffffff8d3e241c>] ? copy_skb_header+0x18/0x97 [ 51.388328] [<ffffffff8d43b801>] ? ip_forward_options+0xa9/0x165 [ 51.388338] [<ffffffff8d406ab1>] neigh_probe+0x54/0x79 [ 51.388347] [<ffffffff8d409b90>] __neigh_event_send+0x1a6/0x239 [ 51.388357] [<ffffffff8d43b8bd>] ? ip_forward_options+0x165/0x165 [ 51.388367] [<ffffffff8d409c81>] neigh_resolve_output+0x5e/0x227 [ 51.388377] [<ffffffff8d43b8bd>] ? ip_forward_options+0x165/0x165 [ 51.388387] [<ffffffff8d43bc87>] ip_finish_output2+0x310/0x375 [ 51.388398] [<ffffffff8d4319b8>] ? nf_iterate+0x69/0xb6 [ 51.388408] [<ffffffff8d43db97>] ip_finish_output+0x190/0x1a2 [ 51.388418] [<ffffffff8d43e5c8>] ip_output+0x7a/0xe2 [ 51.388429] [<ffffffff8d43da07>] ? ip_fragment.constprop.5+0xa9/0xa9 [ 51.388439] [<ffffffff8d43dd10>] ip_local_out_sk+0x38/0x43 [ 51.388448] [<ffffffff8d43f225>] ip_send_skb+0x1d/0x4b [ 51.388458] [<ffffffff8d467e0e>] udp_send_skb+0x1ae/0x218 [ 51.388468] [<ffffffff8d469607>] udp_sendmsg+0x57b/0x7c1 [ 51.388478] [<ffffffff8d43cab2>] ? ip_reply_glue_bits+0x7e/0x7e [ 51.388490] [<ffffffff8d278257>] ? import_iovec+0x87/0xc5 [ 51.388502] [<ffffffff8d474206>] inet_sendmsg+0x80/0xaf [ 51.388513] [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d [ 51.388522] [<ffffffff8d3d8fb9>] ___sys_sendmsg+0x2a6/0x390 [ 51.388537] [<ffffffff8d181728>] ? __fget+0x83/0x95 [ 51.388547] [<ffffffff8d1817c9>] ? __fget_light+0x52/0x63 [ 51.388557] [<ffffffff8d1817f2>] ? __fdget+0x18/0x20 [ 51.388568] [<ffffffff8d3da563>] __sys_sendmmsg+0x10e/0x18b [ 51.388582] [<ffffffff8d3da618>] SyS_sendmmsg+0x38/0x42 [ 51.388593] [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83 [ 51.391318] PAX: sample_idx:1c streams:1 [ 57.601872] PAX: sample_idx:4 streams:1 [ 58.087313] PAX: sample_idx:1d streams:1 [ 58.429779] PAX: sample_idx:5 streams:1 [ 58.486991] PAX: sample_idx:1e streams:1 [ 58.571189] PAX: sample_idx:6 streams:1 [ 58.599311] PAX: sample_idx:1f streams:1 [ 58.656704] PAX: sample_idx:7 streams:1 [ 58.680897] PAX: sample_idx:1a streams:1 [ 58.720357] PAX: sample_idx:2 streams:1 [ 58.815981] PAX: sample_idx:1 streams:1 [ 58.857333] PAX: sample_idx:18 streams:1

Hope it helps

Posted: **Thu Oct 22, 2015 9:50 pm**

Hello,

Since the latest patch (grsecurity-3.1-4.2.4-201510222059.patch), the 2 errors I have are still here :

1) At boot only (I have a LSI megaraid card) :

Code: Select all: PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

2) Constantly : every 2 minutes and 5 seconds (it's accurate) 3 new lines like the one below are logged :

Code: Select all: PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

Posted: **Sat Oct 24, 2015 11:00 am**

Still broken with grsecurity-3.1-4.2.4-201510240907.patch . Situation is becoming really annoying... Tell us what we can do to help.

Posted: **Sat Oct 24, 2015 3:23 pm**

rfnx wrote:Hello,

Since the latest patch (grsecurity-3.1-4.2.4-201510222059.patch), the 2 errors I have are still here :

1) At boot only (I have a LSI megaraid card) :
Code: Select all
PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

Could you please send me the results (drivers/scsi/megaraid/megaraid_sas_base.c.*) of make drivers/scsi/megaraid/megaraid_sas_base.o EXTRA_CFLAGS="-fdump-tree-all -fdump-ipa-all" ? Which gcc version did you use?

grsecurity forums

PAX: size overflow detected in function acpi_ex_do_math_op

PAX: size overflow detected in function acpi_ex_do_math_op

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_

Re: PAX: size overflow detected in function acpi_ex_do_math_