Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#61255 - [nvidia-390xx-dkms] Kernel memory exposure attempt detected from SLUB object nvidia_stack_cache

Attached to Project: Arch Linux
Opened by stargazer (bernie) - Wednesday, 02 January 2019, 20:45 GMT
Last edited by Sven-Hendrik Haase (Svenstaro) - Saturday, 26 January 2019, 15:46 GMT
Task Type Bug Report
Category Upstream Bugs
Status Closed
Assigned To Sven-Hendrik Haase (Svenstaro)
Jan Alexander Steffens (heftig)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Affected: extra/nvidia-390xx-dkms 390.87-25 and other nvidia-390xx-* packages

Dear ArchLinux-Team,

after the upgrade of linux-lts kernel from 4.14.90-1-lts to 4.19.13-1-lts (also linux-kernel) and nvidia-390xx-dkms-390.87-25 there is a problem with "Kernel memory exposure attempt detected from SLUB object 'nvidia_stack_cache' ". See the attached log.
This leads to the problem that suspend is not working anymore (machine freezes) and other issues (see devtalk-link).

Nvidia Dev-Talk with patch
https://devtalk.nvidia.com/default/topic/1031067/linux/-linux416-nvidia-390-48-nvidia_stack_cache-rip-0010-usercopy_warn-0x7e-0xa0/

"...
This patch: https://bugzilla.redhat.com/attachment.cgi?id=1425704
from here: https://bugzilla.redhat.com/show_bug.cgi?id=1570493
should fix the issue.
..."
This fix is not yet mainlined in the nvidia 390-series. Nvidia is working on it.

Maybe the patch helps, I don't know how to apply it. Can you please provide the fix in the testing-repo?


Or is there another way to disable the protection only for the nvidia-module?

Furthermore I have tested grub parameter slab_common.usercopy_fallback=y , but without success.

Thank you.
Best regards, bernie

[ 8.843265] resource sanity check: requesting [mem 0x000c0000-0x000fffff], which spans more than PCI Bus 0000:00 [mem 0x000d0000-0x000dffff window]
[ 8.843428] caller _nv001169rm+0xe3/0x1d0 [nvidia] mapping multiple BARs
[ 9.280667] input: HDA NVidia HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:03.0/0000:01:00.1/sound/card1/input20
[ 9.280717] input: HDA NVidia HDMI/DP,pcm=7 as /devices/pci0000:00/0000:00:03.0/0000:01:00.1/sound/card1/input21
[ 9.280765] input: HDA NVidia HDMI/DP,pcm=8 as /devices/pci0000:00/0000:00:03.0/0000:01:00.1/sound/card1/input22
[ 9.280811] input: HDA NVidia HDMI/DP,pcm=9 as /devices/pci0000:00/0000:00:03.0/0000:01:00.1/sound/card1/input23
[ 9.429227] ------------[ cut here ]------------
[ 9.429230] Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLUB object 'nvidia_stack_cache' (offset 11440, size 3)!
[ 9.429239] WARNING: CPU: 2 PID: 749 at mm/usercopy.c:83 usercopy_warn+0x7d/0xa0
[ 9.429240] Modules linked in: snd_hda_codec_hdmi ip6table_filter ip6_tables xt_state xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter pktcdvd intel_powerclamp coretemp kvm_intel kvm nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) irqbypass snd_usb_audio snd_usbmidi_lib joydev mousedev snd_rawmidi snd_seq_device snd_hda_codec_via snd_hda_codec_generic drm_kms_helper input_leds iTCO_wdt snd_hda_intel gpio_ich iTCO_vendor_support mxm_wmi drm intel_cstate snd_hda_codec intel_uncore agpgart snd_hda_core ipmi_devintf i2c_i801 snd_hwdep i7core_edac realtek snd_pcm r8169 ipmi_msghandler snd_timer lpc_ich libphy snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore evdev wmi mac_hid pcc_cpufreq acpi_cpufreq ecryptfs cbc encrypted_keys trusted tpm rng_core sg crypto_user
[ 9.429267] ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto ata_generic pata_acpi sd_mod hid_logitech_hidpp hid_logitech_dj hid_generic sr_mod cdrom usbhid hid ahci libahci pata_jmicron firewire_ohci libata firewire_core xhci_pci crc32c_intel crc_itu_t xhci_hcd scsi_mod ehci_pci ehci_hcd
[ 9.429281] CPU: 2 PID: 749 Comm: Xorg Tainted: P OE 4.19.13-1-lts #1
[ 9.429281] Hardware name: System manufacturer System Product Name/P7P55D-E PRO, BIOS 1703 06/26/2012
[ 9.429283] RIP: 0010:usercopy_warn+0x7d/0xa0
[ 9.429284] Code: 0a a1 41 51 4d 89 d8 48 c7 c0 cc ed 09 a1 49 89 f1 48 89 f9 48 0f 45 c2 48 c7 c7 58 00 0b a1 4c 89 d2 48 89 c6 e8 ed 46 e2 ff <0f> 0b 48 83 c4 18 c3 48 c7 c6 66 d5 09 a1 49 89 f1 49 89 f3 eb 96
[ 9.429284] RSP: 0018:ffffb5f60244fb60 EFLAGS: 00010286
[ 9.429286] RAX: 0000000000000000 RBX: ffff8f8aad5c5cb0 RCX: 0000000000000006
[ 9.429286] RDX: 0000000000000007 RSI: 0000000000000092 RDI: ffff8f8acf896580
[ 9.429287] RBP: 0000000000000003 R08: 00000000000003f8 R09: 0000000000000004
[ 9.429288] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[ 9.429288] R13: ffff8f8aad5c5cb3 R14: 0000000000000000 R15: ffff8f8aad5c5cf8
[ 9.429289] FS: 00007f50fa91ddc0(0000) GS:ffff8f8acf880000(0000) knlGS:0000000000000000
[ 9.429290] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.429291] CR2: 00007f50f6fc6d20 CR3: 00000003f16f4000 CR4: 00000000000006e0
[ 9.429292] Call Trace:
[ 9.429295] __check_object_size+0xf7/0x189
[ 9.429436] os_memcpy_to_user+0x21/0x40 [nvidia]
[ 9.429572] _nv009384rm+0xbf/0xe0 [nvidia]
[ 9.429693] ? _nv028097rm+0x79/0x90 [nvidia]
[ 9.429814] ? _nv028097rm+0x55/0x90 [nvidia]
[ 9.429928] ? _nv013699rm+0xee/0x100 [nvidia]
[ 9.430042] ? _nv015347rm+0x154/0x270 [nvidia]
[ 9.430176] ? _nv008317rm+0x134/0x1a0 [nvidia]
[ 9.430309] ? _nv008296rm+0x29c/0x2b0 [nvidia]
[ 9.430443] ? _nv001072rm+0xe/0x20 [nvidia]
[ 9.430579] ? _nv007324rm+0xd8/0x100 [nvidia]
[ 9.430698] ? _nv001171rm+0x627/0x830 [nvidia]
[ 9.430815] ? rm_ioctl+0x73/0x100 [nvidia]
[ 9.430901] ? nvidia_ioctl+0x561/0x710 [nvidia]
[ 9.430985] ? nvidia_frontend_unlocked_ioctl+0x3a/0x50 [nvidia]
[ 9.430987] ? do_vfs_ioctl+0xa4/0x630
[ 9.430989] ? syscall_slow_exit_work+0x18b/0x1a0
[ 9.430990] ? syscall_trace_enter+0x1d3/0x2c0
[ 9.430992] ? ksys_ioctl+0x60/0x90
[ 9.430993] ? __x64_sys_ioctl+0x16/0x20
[ 9.430994] ? do_syscall_64+0x4e/0x100
[ 9.430997] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 9.430998] ---[ end trace 478ea56ded186678 ]---
This task depends upon

Closed by  Sven-Hendrik Haase (Svenstaro)
Saturday, 26 January 2019, 15:46 GMT
Reason for closing:  Fixed
Comment by loqs (loqs) - Wednesday, 02 January 2019, 22:58 GMT
linux-lts 4.19.13 has CONFIG_HARDENED_USERCOPY_FALLBACK=y so the dmesg output is informational only.
Comment by loqs (loqs) - Wednesday, 02 January 2019, 23:57 GMT
source archive from makepkg -S for patched PKGBUILD. Build and install as normal.
Comment by stargazer (bernie) - Monday, 07 January 2019, 20:15 GMT
Thank you very much for the file.

Unfortunately, as you mentioned, there is no difference .
Suspend to disk (Hibernate) is broken. Suspend to RAM works. => Also the same with 340-driver with another nvidia card.
Testing the latest nvidia driver is not possible, because the gfx cards are not supported.

Is the nvidia-390-driver broken or the lts-kernel 4.19 and kernel 4.20?
Comment by loqs (loqs) - Monday, 07 January 2019, 20:27 GMT
Try blacklisting the nvidia modules reboot to remove any changes the modules may have made.
Boot to the console try suspending to disk if that fails the cause can not be the nvidia modules.
Comment by stargazer (bernie) - Monday, 07 January 2019, 21:55 GMT
Hibernate works without nvidia-module.

I have tested the nvidia-module without PCI-MSI , and it works now.

cat /etc/modprobe.d/blacklist-nvidia-nomsi.conf
options nvidia NVreg_EnableMSI=0
Comment by Gerardo Exequiel Pozzi (djgera) - Friday, 18 January 2019, 16:22 GMT
This patch does the same as #1 but with Linux version check.

#1 https://bugzilla.redhat.com/attachment.cgi?id=1425704
Comment by stargazer (bernie) - Saturday, 26 January 2019, 14:47 GMT
Since kernel linux-lts 4.19.18-1 hibernate-suspend+resume + nvidia module with MSI-enabled is working again.
You can close this bug.

Best regards, Bernhard

Loading...