CODEWITHSUNDEEP
linux-kernel
Nikhil Utane
Nikhil Utane

Reputation: 1221

Catching and avoiding memory corruption at fixed offset in physical memory

We have a 4-byte memory corruption that always occurs at a fixed offset in the physical memory. The physical frame number is 0x00a4d and the offset is ending with dc0.

Question 1) Based on this information, can we say the physical address of corruption is 0x00a4d * PAGE_SIZE (4096) + dc0 = 0x00A4DDC0. Programmatically, what is best way to confirm the physical address? Ours is ppc64 based system.

Question 2) What would be the best way to find out this memory corruption? The more I read the more I get lost with the plethora of options. Should I use KASAN, or CONFIG_DEBUG_PAGEALLOC (debug_guardpage_minorder) option or a HW breakpoint?

Question 3) Since we know the corruption is at a fixed option, if we were to reserve/block that page, what again is the best option? The two I came across are memmap and Reserved memory regions

Thanks

Upvotes: 0

Views: 543

Answers (1)

Alex Hoppus
Alex Hoppus

Reputation: 3935

1.) You are right about physical address.

2.) HW breakpoint is the best if you have such possibility. Do you have the appropriate device (t32 or whatever) / debug port/ could it place HW break at physical address?

Here is the more generic and dumb case which needs no HW support:

If I remember right from your previous post, you suspect the kernel code as a corruption causer. If you have read anything about KASAN, you probably mentioned that gcc part places hooks instead of kernel code loads and stores. The kernel part provides kasan_store_bla_bla_bla hook, which handles correctness of this store. Very likely, that default functionality wouldn't help you, but you can integrate your code in this kasan store hook, which would:

2.1)Take the virtual address passed to the store kasan hook

2.2)Finds appropriate physical address by page tables walking like this (the more convenient API exists but i don't remember the function name):

 pgd_t *pgd = pgd_offset(mm, addr);
 pud_t *pud = pud_offset(pgd, addr);
 pmd_t *pmd = pmd_offset(pud, addr);
 ...

As i remember from your previous post you get crash in userspace app, so you will be need to check all processes mms from task list.

2.3) Compare found physical address to the given, and check that written value is zero (as i remember from your previous post)

2.4) If match print backtraces for all cores and stop execution.

Upvotes: 1

Related Questions