PAX: size overflow detected in function acpi_ex_do_math_op

[xxterry1xx]

Heres a size overflow detected after enabling CONFIG_PAX_SIZE_OVERFLOW_DISABLE_KILL=y as of the october,20,2015 patches.before this the kernel would hang at loading.There are two detections listed below.

1.First Detection

Code: Select all

Oct 20 11:48:24 none kernel: ACPI : EC: EC started
Oct 20 11:48:24 none kernel: ACPI: Interpreter enabled
Oct 20 11:48:24 none kernel: ACPI: (supports S0 S5)
Oct 20 11:48:24 none kernel: ACPI: Using IOAPIC for interrupt routing
Oct 20 11:48:24 none kernel: PCI: MMCONFIG for domain 0000 [bus 00-ff] at [mem 0xe0000000-0xefffffff] (base 0xe0000000)
Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
Oct 20 11:48:24 none kernel: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.3-grsec #1
Oct 20 11:48:24 none kernel: Hardware name: System manufacturer System Product Name/M4A88T-V EVO/USB3, BIOS 0307    12/15/2010
Oct 20 11:48:24 none kernel:  ffffffff81a0676b 0000000000000000 0000000000000000 0000000000000000
Oct 20 11:48:24 none kernel:  ffffc9000000b8e8 ffffffff81641700 0000000000000001 ffffffff818e83f3
Oct 20 11:48:24 none kernel:  ffffc9000000b918 ffffffff81121013 ffffffff01400000 0000000000000000
Oct 20 11:48:24 none kernel: Call Trace:
Oct 20 11:48:24 none kernel:  [<ffffffff81641700>] dump_stack+0x45/0x5d
Oct 20 11:48:24 none kernel:  [<ffffffff81121013>] report_size_overflow+0x33/0x60
Oct 20 11:48:24 none kernel:  [<ffffffff812d2a25>] acpi_ex_do_math_op+0x124/0x135
Oct 20 11:48:24 none kernel:  [<ffffffff812d169a>] acpi_ex_opcode_2A_1T_1R+0x7c/0x39b
Oct 20 11:48:24 none kernel:  [<ffffffff812c83d9>] acpi_ds_exec_end_op+0xdb/0x406
Oct 20 11:48:24 none kernel:  [<ffffffff812dc1ba>] acpi_ps_parse_loop+0x52e/0x59a
Oct 20 11:48:24 none kernel:  [<ffffffff812dcd1d>] acpi_ps_parse_aml+0x95/0x273
Oct 20 11:48:24 none kernel:  [<ffffffff812dd5c0>] acpi_ps_execute_method+0x1c8/0x272
Oct 20 11:48:24 none kernel:  [<ffffffff812d75e3>] acpi_ns_evaluate+0x1eb/0x281
Oct 20 11:48:24 none kernel:  [<ffffffff812e3368>] acpi_ut_evaluate_object+0x67/0x195
Oct 20 11:48:24 none kernel:  [<ffffffff812df353>] acpi_rs_get_method_data+0x39/0x77
Oct 20 11:48:24 none kernel:  [<ffffffff815749e0>] ? list_add_sorted+0xc0/0xc0
Oct 20 11:48:24 none kernel:  [<ffffffff812dfa0c>] acpi_walk_resources+0x7b/0xc5
Oct 20 11:48:24 none kernel:  [<ffffffff815748ea>] find_mboard_resource+0x2a/0x60
Oct 20 11:48:24 none kernel:  [<ffffffff812da447>] acpi_ns_get_device_callback+0x151/0x17a
Oct 20 11:48:24 none kernel:  [<ffffffff812da1ff>] acpi_ns_walk_namespace+0xfc/0x1b9
Oct 20 11:48:24 none kernel:  [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a
Oct 20 11:48:24 none kernel:  [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a
Oct 20 11:48:24 none kernel:  [<ffffffff815748c0>] ? is_acpi_reserved+0xa0/0xa0
Oct 20 11:48:24 none kernel:  [<ffffffff812da955>] acpi_get_devices+0x75/0xac
Oct 20 11:48:24 none kernel:  [<ffffffff815748c0>] ? is_acpi_reserved+0xa0/0xa0
Oct 20 11:48:24 none kernel:  [<ffffffff8157486c>] is_acpi_reserved+0x4c/0xa0
Oct 20 11:48:24 none kernel:  [<ffffffff81574820>] ? pci_conf2_write+0x160/0x160
Oct 20 11:48:24 none kernel:  [<ffffffff8163e818>] is_mmconf_reserved+0x78/0x1a0
Oct 20 11:48:24 none kernel:  [<ffffffff8163e9b9>] pci_mmcfg_check_reserved+0x79/0xc0
Oct 20 11:48:24 none kernel:  [<ffffffff81c3a119>] __pci_mmcfg_init+0x27/0xad
Oct 20 11:48:24 none kernel:  [<ffffffff81c31373>] ? acpi_sleep_init+0xea/0xea
Oct 20 11:48:24 none kernel:  [<ffffffff81c3a969>] pci_mmcfg_late_init+0x35/0x3d
Oct 20 11:48:24 none kernel:  [<ffffffff81c315d0>] acpi_init+0x25d/0x27b
Oct 20 11:48:24 none kernel:  [<ffffffff81c31373>] ? acpi_sleep_init+0xea/0xea
Oct 20 11:48:24 none kernel:  [<ffffffff81c13160>] do_one_initcall+0xf6/0x16d
Oct 20 11:48:24 none kernel:  [<ffffffff81c132f9>] kernel_init_freeable+0x122/0x1b3
Oct 20 11:48:24 none kernel:  [<ffffffff8163d500>] ? rest_init+0x80/0x80
Oct 20 11:48:24 none kernel:  [<ffffffff8163d509>] kernel_init+0x9/0xe0
Oct 20 11:48:24 none kernel:  [<ffffffff8164a4ce>] ret_from_fork+0x3e/0x70
Oct 20 11:48:24 none kernel:  [<ffffffff8163d500>] ? rest_init+0x80/0x80
Oct 20 11:48:24 none kernel: PCI: MMCONFIG at [mem 0xe0000000-0xefffffff] reserved in ACPI motherboard resources
Oct 20 11:48:24 none kernel: PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
Oct 20 11:48:24 none kernel: ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
Oct 20 11:48:24 none kernel: acpi PNP0A03:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI]
Oct 20 11:48:24 none kernel: acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM

2.Second Detection

Code: Select all

Oct 20 11:48:25 none kernel: system 00:04: Plug and Play ACPI device, IDs PNP0c02 (active)
Oct 20 11:48:25 none kernel: system 00:05: [io  0x0230-0x023f] has been reserved
Oct 20 11:48:25 none kernel: system 00:05: [io  0x0290-0x029f] has been reserved
Oct 20 11:48:25 none kernel: system 00:05: [io  0x0300-0x030f] has been reserved
Oct 20 11:48:25 none kernel: system 00:05: [io  0x0a30-0x0a3f] has been reserved
Oct 20 11:48:25 none kernel: system 00:05: Plug and Play ACPI device, IDs PNP0c02 (active)
Oct 20 11:48:25 none kernel: system 00:06: [mem 0xe0000000-0xefffffff] has been reserved
Oct 20 11:48:25 none kernel: system 00:06: Plug and Play ACPI device, IDs PNP0c02 (active)
Oct 20 11:48:25 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
Oct 20 11:48:25 none kernel: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.3-grsec #1
Oct 20 11:48:25 none kernel: Hardware name: System manufacturer System Product Name/M4A88T-V EVO/USB3, BIOS 0307    12/15/2010
Oct 20 11:48:25 none kernel:  ffffffff81a0676b 0000000000000000 0000000000000000 0000000000000000
Oct 20 11:48:25 none kernel:  ffffc9000000b9f8 ffffffff81641700 0000000000000001 ffffffff818e83f3
Oct 20 11:48:25 none kernel:  ffffc9000000ba28 ffffffff81121013 ffffffff01400000 0000000000000000
Oct 20 11:48:25 none kernel: Call Trace:
Oct 20 11:48:25 none kernel:  [<ffffffff81641700>] dump_stack+0x45/0x5d
Oct 20 11:48:25 none kernel:  [<ffffffff81121013>] report_size_overflow+0x33/0x60
Oct 20 11:48:25 none kernel:  [<ffffffff812d2a25>] acpi_ex_do_math_op+0x124/0x135
Oct 20 11:48:25 none kernel:  [<ffffffff812d169a>] acpi_ex_opcode_2A_1T_1R+0x7c/0x39b
Oct 20 11:48:25 none kernel:  [<ffffffff812c83d9>] acpi_ds_exec_end_op+0xdb/0x406
Oct 20 11:48:25 none kernel:  [<ffffffff812dc1ba>] acpi_ps_parse_loop+0x52e/0x59a
Oct 20 11:48:25 none kernel:  [<ffffffff812dcd1d>] acpi_ps_parse_aml+0x95/0x273
Oct 20 11:48:25 none kernel:  [<ffffffff812dd5c0>] acpi_ps_execute_method+0x1c8/0x272
Oct 20 11:48:25 none kernel:  [<ffffffff812d75e3>] acpi_ns_evaluate+0x1eb/0x281
Oct 20 11:48:25 none kernel:  [<ffffffff812e3368>] acpi_ut_evaluate_object+0x67/0x195
Oct 20 11:48:25 none kernel:  [<ffffffff812df353>] acpi_rs_get_method_data+0x39/0x77
Oct 20 11:48:25 none kernel:  [<ffffffff812f23c0>] ? decode_irq_flags+0xa0/0xa0
Oct 20 11:48:25 none kernel:  [<ffffffff812dfa0c>] acpi_walk_resources+0x7b/0xc5
Oct 20 11:48:25 none kernel:  [<ffffffff812f26da>] pnpacpi_parse_allocated_resource+0x3a/0x80
Oct 20 11:48:25 none kernel:  [<ffffffff81c32db7>] pnpacpi_add_device_handler+0x1b7/0x266
Oct 20 11:48:25 none kernel:  [<ffffffff812da447>] acpi_ns_get_device_callback+0x151/0x17a
Oct 20 11:48:25 none kernel:  [<ffffffff812b750a>] ? acpi_os_signal_semaphore+0x2b/0x41
Oct 20 11:48:25 none kernel:  [<ffffffff812da1ff>] acpi_ns_walk_namespace+0xfc/0x1b9
Oct 20 11:48:25 none kernel:  [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a
Oct 20 11:48:25 none kernel:  [<ffffffff812da2f6>] ? acpi_os_allocate_zeroed+0x3a/0x3a
Oct 20 11:48:25 none kernel:  [<ffffffff81c32c00>] ? ispnpidacpi+0x8a/0x8a
Oct 20 11:48:25 none kernel:  [<ffffffff812da955>] acpi_get_devices+0x75/0xac
Oct 20 11:48:25 none kernel:  [<ffffffff81c32c00>] ? ispnpidacpi+0x8a/0x8a
Oct 20 11:48:25 none kernel:  [<ffffffff81c32e66>] ? pnpacpi_add_device_handler+0x266/0x266
Oct 20 11:48:25 none kernel:  [<ffffffff81c32eb4>] pnpacpi_init+0x4e/0x74
Oct 20 11:48:25 none kernel:  [<ffffffff81c13160>] do_one_initcall+0xf6/0x16d
Oct 20 11:48:25 none kernel:  [<ffffffff81c132f9>] kernel_init_freeable+0x122/0x1b3
Oct 20 11:48:25 none kernel:  [<ffffffff8163d500>] ? rest_init+0x80/0x80
Oct 20 11:48:25 none kernel:  [<ffffffff8163d509>] kernel_init+0x9/0xe0
Oct 20 11:48:25 none kernel:  [<ffffffff8164a4ce>] ret_from_fork+0x3e/0x70
Oct 20 11:48:25 none kernel:  [<ffffffff8163d500>] ? rest_init+0x80/0x80
Oct 20 11:48:25 none kernel: system 00:07: [mem 0x00000000-0x0009ffff] could not be reserved
Oct 20 11:48:25 none kernel: system 00:07: [mem 0x000c0000-0x000cffff] could not be reserved
Oct 20 11:48:25 none kernel: system 00:07: [mem 0x000e0000-0x000fffff] could not be reserved
Oct 20 11:48:25 none kernel: system 00:07: [mem 0x00100000-0xcfefffff] could not be reserved
Oct 20 11:48:25 none kernel: system 00:07: [mem 0xfec00000-0xffffffff] could not be reserved
Oct 20 11:48:25 none kernel: system 00:07: Plug and Play ACPI device, IDs PNP0c01 (active)

[rfnx]

Hello,

Same for me with grsecurity-3.1-4.2.3-201510200858.patch, I have 2 different errors :

1) at boot only :

Code: Select all

PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer;
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.2.3.201510200858-1-grsec-custom #1
Hardware name: System manufacturer System Product Name/P8Z77-M
 ffffffffb1a0a843 0000000000000000 0000000000000000 ffffffffb18f5b81
 ffffc9000000b9b8 ffffffffb15e86e1 00000000000000b2 ffffffffb18f5b69
 ffffc9000000b9e8 ffffffffb119f303 0000000000000039 f000000000000000
Call Trace:
 [<ffffffffb15e86e1>] dump_stack+0x45/0x5d
 [<ffffffffb119f303>] report_size_overflow+0x33/0x60
 [<ffffffffb136fe52>] acpi_ex_opcode_1A_1T_1R+0x231/0x66b
 [<ffffffffb1367145>] ? acpi_ds_create_operands+0x7b/0xe6
 [<ffffffffb136767b>] acpi_ds_exec_end_op+0xdb/0x406
 [<ffffffffb137b618>] acpi_ps_parse_loop+0x52e/0x59a
 [<ffffffffb137c17b>] acpi_ps_parse_aml+0x95/0x273
 [<ffffffffb137ca29>] acpi_ps_execute_method+0x1c8/0x272
 [<ffffffffb13769e0>] acpi_ns_evaluate+0x1eb/0x281
 [<ffffffffb1382820>] acpi_ut_evaluate_object+0x6c/0x19a
 [<ffffffffb137e7c1>] acpi_rs_get_method_data+0x39/0x77
 [<ffffffffb1391030>] ? decode_irq_flags+0xa0/0xa0
 [<ffffffffb137ed28>] acpi_walk_resources+0x7b/0xc5
 [<ffffffffb139134a>] pnpacpi_parse_allocated_resource+0x3a/0x70
 [<ffffffffb1c484d9>] pnpacpi_add_device_handler+0x1b7/0x266
 [<ffffffffb1379daf>] acpi_ns_get_device_callback+0x151/0x17a
 [<ffffffffb1353bdb>] ? acpi_os_signal_semaphore+0x2b/0x41
 [<ffffffffb137963c>] acpi_ns_walk_namespace+0xfc/0x1b9
 [<ffffffffb1379c5e>] ? acpi_walk_namespace+0xcc/0xcc
 [<ffffffffb1379c5e>] ? acpi_walk_namespace+0xcc/0xcc
 [<ffffffffb1c48322>] ? ispnpidacpi+0x8a/0x8a
 [<ffffffffb1379b5b>] acpi_get_devices+0x75/0xac
 [<ffffffffb1c48322>] ? ispnpidacpi+0x8a/0x8a
 [<ffffffffb1c48588>] ? pnpacpi_add_device_handler+0x266/0x266
 [<ffffffffb1c485d6>] pnpacpi_init+0x4e/0x74
 [<ffffffffb100039d>] do_one_initcall+0x8d/0x190
 [<ffffffffb1c123a0>] kernel_init_freeable+0x183/0x22d
 [<ffffffffb15dca60>] ? rest_init+0x80/0x80
 [<ffffffffb15dca69>] kernel_init+0x9/0xf0
 [<ffffffffb15ee7ce>] ret_from_fork+0x3e/0x70
 [<ffffffffb15dca60>] ? rest_init+0x80/0x80

2) Everytime (very often) :

Code: Select all

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-1-grsec-custom #1
Hardware name: System manufacturer System Product Name/P8Z77-M
 ffffffffb1a0a843 8407677e19d803d4 0000000000000000 ffffffffb18ff5ec
 ffff88081fa03cc8 ffffffffb15e86e1 0000000000000097 ffffffffb192ff42
 ffff88081fa03cf8 ffffffffb119f303 000000000000003a 0000000000000028
Call Trace:
 <IRQ>  [<ffffffffb15e86e1>] dump_stack+0x45/0x5d
 [<ffffffffb119f303>] report_size_overflow+0x33/0x60
 [<ffffffffb15c3f71>] ipv6_gro_receive+0xa11/0xb10
 [<ffffffffb14b193c>] dev_gro_receive+0x29c/0x670
 [<ffffffffb12f46dc>] ? swiotlb_sync_single+0x4c/0x70
 [<ffffffffb14b2030>] napi_gro_receive+0x20/0x90
 [<ffffffffc02a125f>] rtl8169_poll+0x2bf/0x650 [r8169]
 [<ffffffffb14b31c3>] net_rx_action+0x1f3/0x300
 [<ffffffffb1068a77>] __do_softirq+0xf7/0x210
 [<ffffffffb1068cca>] irq_exit+0x6a/0x70
 [<ffffffffb1005655>] do_IRQ+0x55/0xf0
 [<ffffffffb15eef1a>] common_interrupt+0x9a/0x9a
 <EOI>  [<ffffffffb1462cd6>] ? cpuidle_enter_state+0x156/0x210
 [<ffffffffb1462df4>] cpuidle_enter+0x24/0x40
 [<ffffffffb10a922b>] call_cpuidle+0x3b/0x70
 [<ffffffffb10a9401>] cpu_startup_entry+0x1a1/0x260
 [<ffffffffb15dca57>] rest_init+0x77/0x80
 [<ffffffffb1c121f8>] 0xffffffffb1c121f8
 [<ffffffffb1c11120>] ? 0xffffffffb1c11120
 [<ffffffffb1c11328>] 0xffffffffb1c11328
 [<ffffffffb1c1141e>] 0xffffffffb1c1141e

[ephox]

Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer

Thanks for the report, they will be fixed in the next grsec patch.

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

Could you please apply this patch and send me the result from dmesg?

Code: Select all

--- net/ipv6/ip6_offload.c.orig 2015-10-20 23:03:13.139805700 +0200
+++ net/ipv6/ip6_offload.c      2015-10-20 23:09:50.795787971 +0200
@@ -197,6 +197,7 @@
        if (!ops || !ops->callbacks.gro_receive) {
                __pskb_pull(skb, skb_gro_offset(skb));
                proto = ipv6_gso_pull_exthdrs(skb, proto);
+               printk(KERN_ERR "PAX overflow: head: %p, header: %hx, data: %p\n", skb->head, skb->transport_header, skb->data);
                skb_gro_pull(skb, -skb_transport_offset(skb));
                skb_reset_transport_header(skb);
                __skb_push(skb, skb_gro_offset(skb));


[rfnx]

Ok I'm compiling the kernel with this patch, but be careful when you copy paste because I had to replace spaces with tabs for this patch to work haha.

[rfnx]

Results :

I have now a lot of lines like these :

Code: Select all

[    9.450086] PAX overflow: head: ffff8807e2aaf880, header: 76, data: ffff8807e2aaf8f6
[    9.450129] PAX overflow: head: ffff8807e2aaf680, header: 76, data: ffff8807e2aaf6f6
[   10.637674] PAX overflow: head: ffff8807e21c44c0, header: 76, data: ffff8807e21c4536
[   22.346769] PAX overflow: head: ffff8807e2aae7c0, header: 76, data: ffff8807e2aae836
[   24.826671] PAX overflow: head: ffff8807dccb55c0, header: 76, data: ffff8807dccb5636
[   27.538437] PAX overflow: head: ffff8807e2aab140, header: 76, data: ffff8807e2aab1b6
[   29.836006] PAX overflow: head: ffff8807e2aa9f00, header: 76, data: ffff8807e2aa9f76
[   34.853553] PAX overflow: head: ffff8807e2aa9cc0, header: 76, data: ffff8807e2aa9d36
[   37.555678] PAX overflow: head: ffff8807e2aa8080, header: 76, data: ffff8807e2aa80f6
[   38.554670] PAX overflow: head: ffff8807e2aaf640, header: 76, data: ffff8807e2aaf6b6
[   39.431445] PAX overflow: head: ffff8807da7d60c0, header: 76, data: ffff8807da7d6136
[   39.440229] PAX overflow: head: ffff8807da7d0940, header: 76, data: ffff8807da7d09b6
[   39.467055] PAX overflow: head: ffff8807da7f2980, header: 76, data: ffff8807da7f29f6
[   39.467103] PAX overflow: head: ffff8807da7f22c0, header: 76, data: ffff8807da7f2336
[   39.467128] PAX overflow: head: ffff8807da7f2000, header: 76, data: ffff8807da7f2076
[   39.467160] PAX overflow: head: ffff8807da7f1940, header: 76, data: ffff8807da7f19b6
[   39.467184] PAX overflow: head: ffff8807da7f1280, header: 76, data: ffff8807da7f12f6
[   39.467207] PAX overflow: head: ffff8807da7f0f80, header: 76, data: ffff8807da7f0ff6
[   39.484739] PAX overflow: head: ffff8807da7d4d00, header: 76, data: ffff8807da7d4d76
[   39.484780] PAX overflow: head: ffff8807da7d4a40, header: 76, data: ffff8807da7d4ab6
[   39.554171] PAX overflow: head: ffff8807da7c8c80, header: 76, data: ffff8807da7c8cf6
[   39.573188] PAX overflow: head: ffff8807da7d0100, header: 76, data: ffff8807da7d0176
[   39.573217] PAX overflow: head: ffff8807da7cfd40, header: 76, data: ffff8807da7cfdb6
[   39.575247] PAX overflow: head: ffff8807e2beabc0, header: 76, data: ffff8807e2beac36
[   39.575289] PAX overflow: head: ffff8807e2bea900, header: 76, data: ffff8807e2bea976
[   39.658925] PAX overflow: head: ffff8807e2aa9740, header: 76, data: ffff8807e2aa97b6
[   39.658968] PAX overflow: head: ffff8807e2aa9540, header: 76, data: ffff8807e2aa95b6
[   39.818776] PAX overflow: head: ffff8807e2aa96c0, header: 76, data: ffff8807e2aa9736
[   39.827443] PAX overflow: head: ffff8807e2aa8e00, header: 76, data: ffff8807e2aa8e76
[   40.215579] PAX overflow: head: ffff8807e2aa8f00, header: 76, data: ffff8807e2aa8f76
[   40.601756] PAX overflow: head: ffff8807e2aad8c0, header: 76, data: ffff8807e2aad936
[   63.296201] PAX overflow: head: ffff8807e2aa9000, header: 76, data: ffff8807e2aa9076
[   64.294019] PAX overflow: head: ffff8807dccb4c80, header: 76, data: ffff8807dccb4cf6
[   65.296174] PAX overflow: head: ffff8807da7cd700, header: 76, data: ffff8807da7cd776
[   79.261389] PAX overflow: head: ffff8807e2aa9a00, header: 76, data: ffff8807e2aa9a76
[   84.262432] PAX overflow: head: ffff8807e2aa9380, header: 76, data: ffff8807e2aa93f6
[   90.344921] PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e
[   90.345157] PAX overflow: head: ffff8807e2aae9c0, header: 76, data: ffff8807e2aaea3e
[   90.480358] PAX overflow: head: ffff8807e2aae7c0, header: 76, data: ffff8807e2aae83e
[   90.481381] PAX overflow: head: ffff8807e2aae5c0, header: 76, data: ffff8807e2aae63e
[   90.493867] PAX overflow: head: ffff8807e2aae3c0, header: 76, data: ffff8807e2aae43e
[   90.592953] PAX overflow: head: ffff8807e2aad840, header: 76, data: ffff8807e2aad8be
[   90.594687] PAX overflow: head: ffff8807e2aad640, header: 76, data: ffff8807e2aad6be
[   90.743709] PAX overflow: head: ffff8807e2aad440, header: 76, data: ffff8807e2aad4be
[   90.745774] PAX overflow: head: ffff8807e2aad240, header: 76, data: ffff8807e2aad2be
[   90.946151] PAX overflow: head: ffff8807e2aace80, header: 76, data: ffff8807e2aacefe
[   90.968702] PAX overflow: head: ffff8807e2aacc80, header: 76, data: ffff8807e2aaccfe
[   90.969590] PAX overflow: head: ffff8807e2aaca80, header: 76, data: ffff8807e2aacafe
[   90.970452] PAX overflow: head: ffff8807e2aac880, header: 76, data: ffff8807e2aac8fe
[   90.971311] PAX overflow: head: ffff8807e2aac680, header: 76, data: ffff8807e2aac6fe
[  186.300007] PAX overflow: head: ffff8807e2aae380, header: 76, data: ffff8807e2aae3f6
[  187.380896] PAX overflow: head: ffff8807e2aadd80, header: 76, data: ffff8807e2aaddf6
[  188.469747] PAX overflow: head: ffff8807e2aad980, header: 76, data: ffff8807e2aad9f6
[  215.674039] PAX overflow: head: ffff8807e2aac100, header: 76, data: ffff8807e2aac17e
[  215.762678] PAX overflow: head: ffff8807e2aabf00, header: 76, data: ffff8807e2aabf7e
[  215.765483] PAX overflow: head: ffff8807e2aabd00, header: 76, data: ffff8807e2aabd7e
[  216.019843] PAX overflow: head: ffff8807e2aabb00, header: 76, data: ffff8807e2aabb7e
[  216.022950] PAX overflow: head: ffff8807e2aab900, header: 76, data: ffff8807e2aab97e
[  216.061069] PAX overflow: head: ffff8807e2aab300, header: 76, data: ffff8807e2aab37e
[  216.261829] PAX overflow: head: ffff8807e2aaac80, header: 76, data: ffff8807e2aaacfe
[  216.265002] PAX overflow: head: ffff8807e2aaaa80, header: 76, data: ffff8807e2aaaafe
[  216.268109] PAX overflow: head: ffff8807e2aaa880, header: 76, data: ffff8807e2aaa8fe
[  216.271501] PAX overflow: head: ffff8807e2be92c0, header: 76, data: ffff8807e2be933e
[  216.274633] PAX overflow: head: ffff8807e2be90c0, header: 76, data: ffff8807e2be913e
[  216.423651] PAX overflow: head: ffff8807e2aaa680, header: 76, data: ffff8807e2aaa6fe
[  216.424709] PAX overflow: head: ffff8807e2aaa480, header: 76, data: ffff8807e2aaa4fe
[  216.513672] PAX overflow: head: ffff8807e2aaa280, header: 76, data: ffff8807e2aaa2fe
[  216.514696] PAX overflow: head: ffff8807e2aaa080, header: 76, data: ffff8807e2aaa0fe
[  309.287479] PAX overflow: head: ffff8807e2aac680, header: 76, data: ffff8807e2aac6f6
[  310.286853] PAX overflow: head: ffff8807e2aac240, header: 76, data: ffff8807e2aac2b6
[  311.286007] PAX overflow: head: ffff8807e2aab640, header: 76, data: ffff8807e2aab6b6
[  341.190166] PAX overflow: head: ffff8807e2aaef40, header: 76, data: ffff8807e2aaefbe
[  341.192888] PAX overflow: head: ffff8807e2aaed40, header: 76, data: ffff8807e2aaedbe
[  341.195723] PAX overflow: head: ffff8807e2aaeb40, header: 76, data: ffff8807e2aaebbe
[  341.198897] PAX overflow: head: ffff8807e21d6d80, header: 76, data: ffff8807e21d6dfe
[  341.202265] PAX overflow: head: ffff8807e21d6b80, header: 76, data: ffff8807e21d6bfe
[  341.205520] PAX overflow: head: ffff8807e21d6980, header: 76, data: ffff8807e21d69fe
[  341.355753] PAX overflow: head: ffff8807e2aae940, header: 76, data: ffff8807e2aae9be
[  341.503082] PAX overflow: head: ffff8807e2aae740, header: 76, data: ffff8807e2aae7be
[  341.603887] PAX overflow: head: ffff8807e2aae540, header: 76, data: ffff8807e2aae5be
[  341.607001] PAX overflow: head: ffff8807e2aae340, header: 76, data: ffff8807e2aae3be
[  341.688754] PAX overflow: head: ffff8807e2aae140, header: 76, data: ffff8807e2aae1be
[  341.698663] PAX overflow: head: ffff8807e2aadf40, header: 76, data: ffff8807e2aadfbe
[  341.699716] PAX overflow: head: ffff8807e2aadd40, header: 76, data: ffff8807e2aaddbe
[  383.278181] PAX overflow: head: ffff8807e2aab980, header: 76, data: ffff8807e2aab9f6
[  388.307731] PAX overflow: head: ffff8807e2aa8f00, header: 76, data: ffff8807e2aa8f76
[  432.275487] PAX overflow: head: ffff8807d65d4a00, header: 76, data: ffff8807d65d4a76
[  433.276853] PAX overflow: head: ffff8807d65d3b40, header: 76, data: ffff8807d65d3bb6
[  434.274518] PAX overflow: head: ffff8807d65d27c0, header: 76, data: ffff8807d65d2836
[  466.626310] PAX overflow: head: ffff8807d65d1dc0, header: 76, data: ffff8807d65d1e3e
[  466.784042] PAX overflow: head: ffff8807d65d1200, header: 76, data: ffff8807d65d127e
[  466.786864] PAX overflow: head: ffff8807d65d1000, header: 76, data: ffff8807d65d107e
[  466.874015] PAX overflow: head: ffff8807d65d0180, header: 76, data: ffff8807d65d01fe
[  466.877124] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e7e
[  466.880225] PAX overflow: head: ffff8807d65d7c00, header: 76, data: ffff8807d65d7c7e
[  466.883293] PAX overflow: head: ffff8807d65d7a00, header: 76, data: ffff8807d65d7a7e
[  466.886361] PAX overflow: head: ffff8807d65d7800, header: 76, data: ffff8807d65d787e
[  467.033854] PAX overflow: head: ffff8807d65d6940, header: 76, data: ffff8807d65d69be
[  467.123922] PAX overflow: head: ffff8807d65d6140, header: 76, data: ffff8807d65d61be
[  467.127008] PAX overflow: head: ffff8807d65d5f40, header: 76, data: ffff8807d65d5fbe
[  467.128055] PAX overflow: head: ffff8807d65d5d40, header: 76, data: ffff8807d65d5dbe
[  467.129117] PAX overflow: head: ffff8807d65d5b40, header: 76, data: ffff8807d65d5bbe
[  500.158217] PAX overflow: head: ffff8807d65d4540, header: 76, data: ffff8807d65d45b6
[  501.157524] PAX overflow: head: ffff8807d65d3fc0, header: 76, data: ffff8807d65d4036
[  502.156942] PAX overflow: head: ffff8807d65d3c00, header: 76, data: ffff8807d65d3c76
[  541.343455] PAX overflow: head: ffff8807d65d0ac0, header: 76, data: ffff8807d65d0b36
[  542.412005] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e76
[  543.497534] PAX overflow: head: ffff8807d65d7680, header: 76, data: ffff8807d65d76f6

And errors like before

Code: Select all

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.145_218 min, count: 36, decl: len; num: 0; context: sk_buff;
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-2-grsec-custom #1
Hardware name: System manufacturer System Product Name/P8Z77-M
 ffffffffbda0a86b 5637e362e5084bb0 0000000000000000 ffffffffbd90188c
 ffff88081fa03cc8 ffffffffbd5e9575 0000000000000097 ffffffffbd9321e2
 ffff88081fa03cf8 ffffffffbd19f243 fffffffffffffff8 0000000000000000
Call Trace:
 <IRQ>  [<ffffffffbd5e9575>] dump_stack+0x45/0x5d
 [<ffffffffbd19f243>] report_size_overflow+0x33/0x60
 [<ffffffffbd5c4999>] ipv6_gro_receive+0x469/0x910
 [<ffffffffbd4b274c>] dev_gro_receive+0x29c/0x670
 [<ffffffffbd2f567c>] ? swiotlb_sync_single+0x4c/0x70
 [<ffffffffbd4b2e40>] napi_gro_receive+0x20/0x90
 [<ffffffffc02c525f>] rtl8169_poll+0x2bf/0x650 [r8169]
 [<ffffffffbd4b3fd3>] net_rx_action+0x1f3/0x300
 [<ffffffffbd0689f7>] __do_softirq+0xf7/0x210
 [<ffffffffbd068c4a>] irq_exit+0x6a/0x70
 [<ffffffffbd005635>] do_IRQ+0x55/0xf0
 [<ffffffffbd5efdda>] common_interrupt+0x9a/0x9a
 <EOI>  [<ffffffffbd463ab6>] ? cpuidle_enter_state+0x156/0x210
 [<ffffffffbd463bd4>] cpuidle_enter+0x24/0x40
 [<ffffffffbd0a902b>] call_cpuidle+0x3b/0x70
 [<ffffffffbd0a9201>] cpu_startup_entry+0x1a1/0x260
 [<ffffffffbd5dd8b7>] rest_init+0x77/0x80
 [<ffffffffbdc121f8>] 0xffffffffbdc121f8
 [<ffffffffbdc11120>] ? 0xffffffffbdc11120
 [<ffffffffbdc11328>] 0xffffffffbdc11328
 [<ffffffffbdc1141e>] 0xffffffffbdc1141e

[xxterry1xx]

Oct 20 11:48:24 none kernel: PAX: size overflow detected in function acpi_ex_do_math_op drivers/acpi/acpica/exmisc.c:414 cicus.45_57 min, count: 30, decl: acpi_ex_do_math_op; num: 0; context: fndecl;
PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer

Thanks for the report, they will be fixed in the next grsec patch.

Thanks for the fix .

[PaX Team]

I have now a lot of lines like these :

Code: Select all

[  541.343455] PAX overflow: head: ffff8807d65d0ac0, header: 76, data: ffff8807d65d0b36
[  542.412005] PAX overflow: head: ffff8807d65d7e00, header: 76, data: ffff8807d65d7e76
[  543.497534] PAX overflow: head: ffff8807d65d7680, header: 76, data: ffff8807d65d76f6

which of those lines is the last that appears just before the overflow report?

[rfnx]

The last error line "pax overflow: head: ..." that appears before the first overflow "pax: size overflow detected..." is :

Code: Select all

PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e

EDIT : here is the part of the log where the first overflow happens (shortly after boot) :

Code: Select all

[...]

PAX overflow: head: ffff8807e2aa9a00, header: 76, data: ffff8807e2aa9a76
PAX overflow: head: ffff8807e2aa9380, header: 76, data: ffff8807e2aa93f6
PAX overflow: head: ffff8807e2aaebc0, header: 76, data: ffff8807e2aaec3e
report_size_overflow: 5 callbacks suppressed
PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.145_218 min, count: 36, decl: len; num: 0; context: sk_buff;
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.3.201510200858-2-grsec-custom #1
Hardware name: System manufacturer System Product Name/P8Z77-M
 ffffffffbda0a86b 5637e362e5084bb0 0000000000000000 ffffffffbd90188c
 ffff88081fa03cc8 ffffffffbd5e9575 0000000000000097 ffffffffbd9321e2
 ffff88081fa03cf8 ffffffffbd19f243 fffffffffffffff8 0000000000000000
Call Trace:
 <IRQ>  [<ffffffffbd5e9575>] dump_stack+0x45/0x5d
 [<ffffffffbd19f243>] report_size_overflow+0x33/0x60
 [<ffffffffbd5c4999>] ipv6_gro_receive+0x469/0x910
 [<ffffffffbd4b274c>] dev_gro_receive+0x29c/0x670
 [<ffffffffbd2f567c>] ? swiotlb_sync_single+0x4c/0x70
 [<ffffffffbd4b2e40>] napi_gro_receive+0x20/0x90
 [<ffffffffc02c525f>] rtl8169_poll+0x2bf/0x650 [r8169]
 [<ffffffffbd4b3fd3>] net_rx_action+0x1f3/0x300
 [<ffffffffbd0689f7>] __do_softirq+0xf7/0x210
 [<ffffffffbd068c4a>] irq_exit+0x6a/0x70
 [<ffffffffbd005635>] do_IRQ+0x55/0xf0
 [<ffffffffbd5efdda>] common_interrupt+0x9a/0x9a
 <EOI>  [<ffffffffbd463ab6>] ? cpuidle_enter_state+0x156/0x210
 [<ffffffffbd463bd4>] cpuidle_enter+0x24/0x40
 [<ffffffffbd0a902b>] call_cpuidle+0x3b/0x70
 [<ffffffffbd0a9201>] cpu_startup_entry+0x1a1/0x260
 [<ffffffffbd5dd8b7>] rest_init+0x77/0x80
 [<ffffffffbdc121f8>] 0xffffffffbdc121f8
 [<ffffffffbdc11120>] ? 0xffffffffbdc11120
 [<ffffffffbdc11328>] 0xffffffffbdc11328
 [<ffffffffbdc1141e>] 0xffffffffbdc1141e

[...]

[Fuxino]

Hello, with the latest patch (grsecurity-3.1-4.2.3-201510200858.patch) I get error messages about size overflow too. More specifically:

Code: Select all

Oct 21 00:35:58 fux-laptop kernel: PAX: size overflow detected in function proc_do_submiturb drivers/usb/core/devio.c:1502 cicus.726_1394 max, count: 109, decl: pipe; num: 0; context: urb;
Oct 21 00:35:58 fux-laptop kernel: CPU: 1 PID: 373 Comm: mtp-probe Not tainted 4.2.3-grsec-20151020 #1
Oct 21 00:35:58 fux-laptop kernel: Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011
Oct 21 00:35:58 fux-laptop kernel:  ffffc9000099bb58 589b371f1a9d627b 0000000000000000 0000000000000000
Oct 21 00:35:58 fux-laptop kernel:  ffffc9000099bb78 ffffffffb94fbfb1 0000000000000007 ffffffffc02158fb
Oct 21 00:35:58 fux-laptop kernel:  ffffc9000099bbb8 ffffffffb9169323 ffffc9000099bbb8 ffffffffc0215c13
Oct 21 00:35:58 fux-laptop kernel: Call Trace:
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb94fbfb1>] dump_stack+0x4c/0x7f
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffc02158fb>] ? usb_exit+0x5d10/0xe695 [usbcore]
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb9169323>] report_size_overflow+0x4f/0x60
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffc0215c13>] ? usb_exit+0x6028/0xe695 [usbcore]
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffc020aeca>] proc_do_submiturb+0x985/0x1253 [usbcore]
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffc020c6b0>] usbdev_do_ioctl+0x9d9/0x1363 [usbcore]
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffc020d08d>] usbdev_ioctl+0x23/0x2d [usbcore]
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb9175d96>] vfs_ioctl+0x41/0x55
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb9176a47>] do_vfs_ioctl+0x487/0x7d1
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb91819c0>] ? __fget+0x80/0x92
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb9176de9>] SyS_ioctl+0x58/0x83
Oct 21 00:35:58 fux-laptop kernel:  [<ffffffffb95017e9>] entry_SYSCALL_64_fastpath+0x12/0x83


and:

Code: Select all

Oct 21 00:36:20 fux-laptop kernel: PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1056 cicus.232_207 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate;
Oct 21 00:36:21 fux-laptop kernel: CPU: 1 PID: 697 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1
Oct 21 00:36:21 fux-laptop kernel: Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011
Oct 21 00:36:21 fux-laptop kernel:  ffffc900009b35f8 a0490a9f6f5dce67 0000000000000000 0000000000000000
Oct 21 00:36:21 fux-laptop kernel:  ffffc900009b3618 ffffffffb94fbfb1 0000000000000007 ffffffffc05acc04
Oct 21 00:36:21 fux-laptop kernel:  ffffc900009b3658 ffffffffb9169323 ffffffffffff4111 ffffffffc05acc7e
Oct 21 00:36:21 fux-laptop kernel: Call Trace:
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb94fbfb1>] dump_stack+0x4c/0x7f
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc05acc04>] ? ieee80211_exit+0x10122/0x1c566 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb9169323>] report_size_overflow+0x4f/0x60
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc05acc7e>] ? ieee80211_exit+0x1019c/0x1c566 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc059ae2e>] minstrel_ht_get_rate+0x3f2/0x497 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc0567cc5>] rate_control_get_rate+0xd5/0x142 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc0576b4c>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc057774f>] invoke_tx_handlers+0x4df/0xfb4 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc0575e46>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc0578411>] ieee80211_tx+0xad/0xf5 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc057a7a0>] ieee80211_xmit+0x18e/0x1a3 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc057bb0b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93e498d>] ? __alloc_skb+0x84/0x273
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb9149e4e>] ? __kmalloc_node_track_caller+0x47/0x19f
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93e498d>] ? __alloc_skb+0x84/0x273
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffc057bc12>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211]
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93fba66>] dev_hard_start_xmit+0x380/0x417
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb942286a>] sch_direct_xmit+0xa7/0x251
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93fbef5>] __dev_queue_xmit+0x2b7/0x4d2
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93fc123>] dev_queue_xmit_sk+0x13/0x1d
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb94dd9a3>] ? ipv6_mc_check_mld+0x615/0x615
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb94dd9b8>] dev_queue_xmit+0x15/0x1f
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb94dd9a3>] ? ipv6_mc_check_mld+0x615/0x615
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb94e4da4>] packet_sendmsg+0x174c/0x18f9
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93d94bb>] sock_sendmsg+0x44/0x5d
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb93dae58>] SyS_sendto+0x138/0x183
Oct 21 00:36:21 fux-laptop kernel:  [<ffffffffb95017e9>] entry_SYSCALL_64_fastpath+0x12/0x83

[PaX Team]

the devio.c one will be fixed in the next patch, however the other one is new and doesn't at first look like an obvious false positive so we'll need some runtime values. can you stick a printk into net/mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate like this and report back the results please:

Code: Select all

--- a/net/mac80211/rc80211_minstrel_ht.c   2015-09-09 11:17:48.835255341 +0200
+++ b/net/mac80211/rc80211_minstrel_ht.c  2015-10-21 01:37:22.825136596 +0200
@@ -1053,6 +1053,7 @@
                ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
                                       sample_group->streams);
        } else {
+               pr_err("PAX: sample_idx:%x streams:%x\n", sample_idx, sample_group->streams);
                rate->idx = sample_idx % MCS_GROUP_RATES +
                            (sample_group->streams - 1) * 8;
        }

[rfnx]

Thanks for your work !

Since the latest patch (grsecurity-3.1-4.2.3-201510202025.patch), my first error that happened only at boot is gone :

Code: Select all

PAX: size overflow detected in function acpi_ex_opcode_1A_1T_1R drivers/acpi/acpica/exoparg1.c:319 cicus.62_197 max, count: 15, decl: value; num: 0; context: acpi_object_integer;

But the second one is still here :

Code: Select all

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

And a new one appeared, at boot only :

Code: Select all

PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

[Fuxino]

the devio.c one will be fixed in the next patch, however the other one is new and doesn't at first look like an obvious false positive so we'll need some runtime values. can you stick a printk into net/mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate like this and report back the results please:

Code: Select all

--- a/net/mac80211/rc80211_minstrel_ht.c   2015-09-09 11:17:48.835255341 +0200
+++ b/net/mac80211/rc80211_minstrel_ht.c  2015-10-21 01:37:22.825136596 +0200
@@ -1053,6 +1053,7 @@
                ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
                                       sample_group->streams);
        } else {
+               pr_err("PAX: sample_idx:%x streams:%x\n", sample_idx, sample_group->streams);
                rate->idx = sample_idx % MCS_GROUP_RATES +
                            (sample_group->streams - 1) * 8;
        }

This is what I get:

Code: Select all

[   50.759495] PAX: sample_idx:1b streams:1
[   50.759517] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate;
[   50.759915] CPU: 1 PID: 779 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1
[   50.759923] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011
[   50.759931]  ffffc90000f936e8 b7b33e976656336a 0000000000000000 0000000000000000
[   50.759946]  ffffc90000f93708 ffffffff8d4fadf6 0000000000000007 ffffffffc05acca4
[   50.759959]  ffffc90000f93748 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f
[   50.759971] Call Trace:
[   50.759996]  [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f
[   50.760032]  [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211]
[   50.760044]  [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88
[   50.760069]  [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211]
[   50.760099]  [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211]
[   50.760134]  [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211]
[   50.760172]  [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211]
[   50.760208]  [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211]
[   50.760244]  [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211]
[   50.760279]  [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211]
[   50.760317]  [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211]
[   50.760352]  [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211]
[   50.760365]  [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273
[   50.760377]  [<ffffffff8d149f39>] ? __kmalloc_node_track_caller+0x47/0x19c
[   50.760387]  [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273
[   50.760422]  [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211]
[   50.760436]  [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417
[   50.760451]  [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251
[   50.760462]  [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2
[   50.760473]  [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d
[   50.760484]  [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615
[   50.760493]  [<ffffffff8d4dc7ef>] dev_queue_xmit+0x15/0x1f
[   50.760503]  [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615
[   50.760513]  [<ffffffff8d4e3be2>] packet_sendmsg+0x174c/0x18f9
[   50.760528]  [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d
[   50.760538]  [<ffffffff8d3d9e6e>] SyS_sendto+0x138/0x183
[   50.760555]  [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83
[   50.761955] PAX: sample_idx:3 streams:1
[   50.761973] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate;
[   50.762312] CPU: 1 PID: 713 Comm: dhcpcd Not tainted 4.2.3-grsec-20151020 #1
[   50.762318] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011
[   50.762325]  ffffc90000b735f8 4657560f66159747 0000000000000000 0000000000000000
[   50.762339]  ffffc90000b73618 ffffffff8d4fadf6 00000000ffffffff ffffffffc05acca4
[   50.762351]  ffffc90000b73658 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f
[   50.762363] Call Trace:
[   50.762386]  [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f
[   50.762419]  [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211]
[   50.762430]  [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88
[   50.762455]  [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211]
[   50.762483]  [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211]
[   50.762516]  [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211]
[   50.762552]  [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211]
[   50.762588]  [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211]
[   50.762622]  [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211]
[   50.762657]  [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211]
[   50.762694]  [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211]
[   50.762730]  [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211]
[   50.762743]  [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273
[   50.762755]  [<ffffffff8d149f39>] ? __kmalloc_node_track_caller+0x47/0x19c
[   50.762764]  [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273
[   50.762800]  [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211]
[   50.762812]  [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417
[   50.762826]  [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251
[   50.762837]  [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2
[   50.762848]  [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d
[   50.762858]  [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615
[   50.762867]  [<ffffffff8d4dc7ef>] dev_queue_xmit+0x15/0x1f
[   50.762876]  [<ffffffff8d4dc7da>] ? ipv6_mc_check_mld+0x615/0x615
[   50.762887]  [<ffffffff8d4e3be2>] packet_sendmsg+0x174c/0x18f9
[   50.762901]  [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d
[   50.762911]  [<ffffffff8d3d9e6e>] SyS_sendto+0x138/0x183
[   50.762927]  [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83
[   50.762941]  [<ffffffff8d500659>] ? entry_SYSCALL_64_fastpath+0x42/0x83
[   51.387360] PAX: sample_idx:19 streams:1
[   51.387382] PAX: size overflow detected in function minstrel_ht_get_rate net/mac80211/rc80211_minstrel_ht.c:1057 cicus.232_208 max, count: 21, decl: idx; num: 0; context: ieee80211_tx_rate;
[   51.387716] CPU: 0 PID: 675 Comm: ntpd Not tainted 4.2.3-grsec-20151020 #1
[   51.387723] Hardware name: Acer AO722/JE10-BZ, BIOS V1.08 12/06/2011
[   51.387731]  ffffc90000de3178 05fd07c48e976f68 0000000000000000 0000000000000000
[   51.387744]  ffffc90000de3198 ffffffff8d4fadf6 00000000ffffffff ffffffffc05acca4
[   51.387757]  ffffc90000de31d8 ffffffff8d16a7bc ffffffffffff4111 ffffffffc05acd3f
[   51.387769] Call Trace:
[   51.387791]  [<ffffffff8d4fadf6>] dump_stack+0x4c/0x7f
[   51.387825]  [<ffffffffc05acca4>] ? ieee80211_exit+0x10128/0x1c58c [mac80211]
[   51.387837]  [<ffffffff8d16a7bc>] report_size_overflow+0x4f/0x88
[   51.387862]  [<ffffffffc05acd3f>] ? ieee80211_exit+0x101c3/0x1c58c [mac80211]
[   51.387890]  [<ffffffffc059aecf>] minstrel_ht_get_rate+0x41e/0x4bc [mac80211]
[   51.387924]  [<ffffffffc0567ce4>] rate_control_get_rate+0xd5/0x142 [mac80211]
[   51.387960]  [<ffffffffc0576ba6>] ieee80211_tx_h_rate_ctrl+0x210/0x35c [mac80211]
[   51.387997]  [<ffffffffc05777a9>] invoke_tx_handlers+0x4df/0xfb7 [mac80211]
[   51.388008]  [<ffffffff8d28347b>] ? list_del+0x11/0x2c
[   51.388041]  [<ffffffffc0575ea3>] ? ieee80211_tx_prepare+0x37/0x3d0 [mac80211]
[   51.388076]  [<ffffffffc057846e>] ieee80211_tx+0xad/0xf5 [mac80211]
[   51.388113]  [<ffffffffc057a7fd>] ieee80211_xmit+0x18e/0x1a3 [mac80211]
[   51.388149]  [<ffffffffc057bb6b>] __ieee80211_subif_start_xmit+0x8ac/0x994 [mac80211]
[   51.388161]  [<ffffffff8d0fd1f9>] ? __alloc_pages_nodemask+0x189/0x81c
[   51.388174]  [<ffffffff8d3e398e>] ? __alloc_skb+0x84/0x273
[   51.388210]  [<ffffffffc057bc72>] ieee80211_subif_start_xmit+0x1f/0x29 [mac80211]
[   51.388222]  [<ffffffff8d3fa94a>] dev_hard_start_xmit+0x380/0x417
[   51.388235]  [<ffffffff8d4216f4>] sch_direct_xmit+0xa7/0x251
[   51.388246]  [<ffffffff8d3fadd9>] __dev_queue_xmit+0x2b7/0x4d2
[   51.388257]  [<ffffffff8d3fb007>] dev_queue_xmit_sk+0x13/0x1d
[   51.388266]  [<ffffffff8d3faff4>] ? __dev_queue_xmit+0x4d2/0x4d2
[   51.388277]  [<ffffffff8d46c823>] arp_xmit.part.0+0x20/0x2a
[   51.388286]  [<ffffffff8d46c855>] arp_xmit+0x28/0x95
[   51.388297]  [<ffffffff8d46cb28>] arp_send+0x55/0x5d
[   51.388307]  [<ffffffff8d46d2e5>] arp_solicit+0x1a7/0x1d2
[   51.388317]  [<ffffffff8d3e241c>] ? copy_skb_header+0x18/0x97
[   51.388328]  [<ffffffff8d43b801>] ? ip_forward_options+0xa9/0x165
[   51.388338]  [<ffffffff8d406ab1>] neigh_probe+0x54/0x79
[   51.388347]  [<ffffffff8d409b90>] __neigh_event_send+0x1a6/0x239
[   51.388357]  [<ffffffff8d43b8bd>] ? ip_forward_options+0x165/0x165
[   51.388367]  [<ffffffff8d409c81>] neigh_resolve_output+0x5e/0x227
[   51.388377]  [<ffffffff8d43b8bd>] ? ip_forward_options+0x165/0x165
[   51.388387]  [<ffffffff8d43bc87>] ip_finish_output2+0x310/0x375
[   51.388398]  [<ffffffff8d4319b8>] ? nf_iterate+0x69/0xb6
[   51.388408]  [<ffffffff8d43db97>] ip_finish_output+0x190/0x1a2
[   51.388418]  [<ffffffff8d43e5c8>] ip_output+0x7a/0xe2
[   51.388429]  [<ffffffff8d43da07>] ? ip_fragment.constprop.5+0xa9/0xa9
[   51.388439]  [<ffffffff8d43dd10>] ip_local_out_sk+0x38/0x43
[   51.388448]  [<ffffffff8d43f225>] ip_send_skb+0x1d/0x4b
[   51.388458]  [<ffffffff8d467e0e>] udp_send_skb+0x1ae/0x218
[   51.388468]  [<ffffffff8d469607>] udp_sendmsg+0x57b/0x7c1
[   51.388478]  [<ffffffff8d43cab2>] ? ip_reply_glue_bits+0x7e/0x7e
[   51.388490]  [<ffffffff8d278257>] ? import_iovec+0x87/0xc5
[   51.388502]  [<ffffffff8d474206>] inet_sendmsg+0x80/0xaf
[   51.388513]  [<ffffffff8d3d84c8>] sock_sendmsg+0x44/0x5d
[   51.388522]  [<ffffffff8d3d8fb9>] ___sys_sendmsg+0x2a6/0x390
[   51.388537]  [<ffffffff8d181728>] ? __fget+0x83/0x95
[   51.388547]  [<ffffffff8d1817c9>] ? __fget_light+0x52/0x63
[   51.388557]  [<ffffffff8d1817f2>] ? __fdget+0x18/0x20
[   51.388568]  [<ffffffff8d3da563>] __sys_sendmmsg+0x10e/0x18b
[   51.388582]  [<ffffffff8d3da618>] SyS_sendmmsg+0x38/0x42
[   51.388593]  [<ffffffff8d500629>] entry_SYSCALL_64_fastpath+0x12/0x83
[   51.391318] PAX: sample_idx:1c streams:1
[   57.601872] PAX: sample_idx:4 streams:1
[   58.087313] PAX: sample_idx:1d streams:1
[   58.429779] PAX: sample_idx:5 streams:1
[   58.486991] PAX: sample_idx:1e streams:1
[   58.571189] PAX: sample_idx:6 streams:1
[   58.599311] PAX: sample_idx:1f streams:1
[   58.656704] PAX: sample_idx:7 streams:1
[   58.680897] PAX: sample_idx:1a streams:1
[   58.720357] PAX: sample_idx:2 streams:1
[   58.815981] PAX: sample_idx:1 streams:1
[   58.857333] PAX: sample_idx:18 streams:1


Hope it helps

[rfnx]

Hello,

Since the latest patch (grsecurity-3.1-4.2.4-201510222059.patch), the 2 errors I have are still here :

1) At boot only (I have a LSI megaraid card) :

Code: Select all

PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

2) Constantly : every 2 minutes and 5 seconds (it's accurate) 3 new lines like the one below are logged :

Code: Select all

PAX: size overflow detected in function ipv6_gro_receive include/linux/skbuff.h:1969 cicus.147_213 min, count: 36, decl: len; num: 0; context: sk_buff;

[rfnx]

Still broken with grsecurity-3.1-4.2.4-201510240907.patch . Situation is becoming really annoying... Tell us what we can do to help.

[ephox]

Hello,

Since the latest patch (grsecurity-3.1-4.2.4-201510222059.patch), the 2 errors I have are still here :

1) At boot only (I have a LSI megaraid card) :

Code: Select all

PAX: size overflow detected in function megasas_init_adapter_mfi drivers/scsi/megaraid/megaraid_sas_base.c:4297 cicus.1087_105 max, count: 21, decl: max_mfi_cmds; num: 0; context: megasas_instance;

Could you please send me the results (drivers/scsi/megaraid/megaraid_sas_base.c.*) of make drivers/scsi/megaraid/megaraid_sas_base.o EXTRA_CFLAGS="-fdump-tree-all -fdump-ipa-all" ? Which gcc version did you use?