[Unionfs] Unionfs and AMD NX bit

[Chris Hoy Poy]

Hi all

Not sure if these has been reported before - but lodging it anyway. This is with a Suse 2.6.18-0.5 (recompiled for diskless nodes)  and UnionFS 1.4. I'll have to do a fair amount of work to switch across to UnionFS2

Not lodging a bugreport at this point until I've narrowed down, but maybe someone else has seen it, and maybe someone else in a similiar setup might like to be aware of this. 


cheers;
Chris Hoy Poy
Senior Infrastructure Engineer
Central Data
http://www.central-data.net

(currently working on GoPC - http://www.gopc.net)


Aug 31 08:58:32 nx08 nx08 kernel: f4e29d50
Aug 31 08:58:32 nx08 nx08 kernel: f4e29d50
Aug 31 08:58:32 nx08 nx08 kernel: Modules linked in: nls_utf8 cifs eeprom ipv6 i2c_piix4 button battery ac apparmor aamatch_pcre loop pata_amd generic ohci_h
cd usbcore i2c_amd756 amd_rng i2c_amd8111 i2c_core amd74xx parport_pc lp parport unionfs ext3 mbcache jbd edd fan ata_piix libata piix thermal processor sd_m
od scsi_mod ide_disk ide_core
Aug 31 08:58:32 nx08 nx08 kernel: Modules linked in: nls_utf8 cifs eeprom ipv6 i2c_piix4 button battery ac apparmor aamatch_pcre loop pata_amd generic ohci_h
cd usbcore i2c_amd756 amd_rng i2c_amd8111 i2c_core amd74xx parport_pc lp parport unionfs ext3 mbcache jbd edd fan ata_piix libata piix thermal processor sd_m
od scsi_mod ide_disk ide_core
Aug 31 08:58:32 nx08 nx08 kernel: EIP:    0060:[<f4e29d50>]    Tainted: G     U VLI
Aug 31 08:58:32 nx08 nx08 kernel: EIP:    0060:[<f4e29d50>]    Tainted: G     U VLI
Aug 31 08:58:32 nx08 nx08 kernel: EFLAGS: 00010286   (2.6.18.8-0.5-diskless #2)
Aug 31 08:58:32 nx08 nx08 kernel: EFLAGS: 00010286   (2.6.18.8-0.5-diskless #2)
Aug 31 08:58:32 nx08 nx08 kernel:  [<f88f2093>] unionfs_permission+0x143/0x2a0 [unionfs]
Aug 31 08:58:32 nx08 nx08 kernel:  [<f88f2093>] unionfs_permission+0x143/0x2a0 [unionfs]
Aug 31 08:58:32 nx08 nx08 kernel:  [<f88f1f50>] unionfs_permission+0x0/0x2a0 [unionfs]
Aug 31 08:58:32 nx08 nx08 kernel:  [<f88f1f50>] unionfs_permission+0x0/0x2a0 [unionfs]
Aug 31 08:58:32 nx08 nx08 kernel:  [<c016cc6e>] permission+0x7f/0xbc
Aug 31 08:58:32 nx08 nx08 kernel:  [<c016cc6e>] permission+0x7f/0xbc
Aug 31 08:58:32 nx08 nx08 kernel:  [<c016015f>] sys_faccessat+0xa3/0x131
Aug 31 08:58:32 nx08 nx08 kernel:  [<c016015f>] sys_faccessat+0xa3/0x131
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01e2496>] _atomic_dec_and_lock+0x2a/0x48
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01e2496>] _atomic_dec_and_lock+0x2a/0x48
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01756ce>] dput+0x82/0x11b
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01756ce>] dput+0x82/0x11b
Aug 31 08:58:32 nx08 nx08 kernel:  [<c0161fb2>] __fput+0x13b/0x15e
Aug 31 08:58:32 nx08 nx08 kernel:  [<c0161fb2>] __fput+0x13b/0x15e
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01601fc>] sys_access+0xf/0x13
Aug 31 08:58:32 nx08 nx08 kernel:  [<c01601fc>] sys_access+0xf/0x13
Aug 31 08:58:32 nx08 nx08 kernel:  [<c010347d>] sysenter_past_esp+0x56/0x79
Aug 31 08:58:32 nx08 nx08 kernel:  [<c010347d>] sysenter_past_esp+0x56/0x79
Aug 31 08:58:33 nx08 nx08 kernel:  <2>kernel tried to execute NX-protected page - exploit attempt? (uid: 3668)
Aug 31 08:58:33 nx08 nx08 kernel:  <2>kernel tried to execute NX-protected page - exploit attempt? (uid: 3668)