| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 23 Apr 2008 19:28:34 +0200
From: "Zdenek Kabelac" <zdenek.kabelac@...il.com>
To: "Pekka Enberg" <penberg@...helsinki.fi>
Cc: "Linus Torvalds" <torvalds@...ux-foundation.org>,
"Ingo Molnar" <mingo@...e.hu>, "Jiri Slaby" <jirislaby@...il.com>,
"Rafael J. Wysocki" <rjw@...k.pl>, paulmck@...ux.vnet.ibm.com,
"David Miller" <davem@...emloft.net>,
"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>,
"Andrew Morton" <akpm@...ux-foundation.org>,
linux-ext4@...r.kernel.org, herbert@...dor.apana.org.au,
"Christoph Lameter" <clameter@....com>
Subject: Re: 2.6.25-git2: BUG: unable to handle kernel paging request at ffffffffffffffff
2008/4/23, Pekka Enberg <penberg@...helsinki.fi>:
> On Wed, Apr 23, 2008 at 6:53 PM, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
> > Padding 0xffff8100201a0000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> > ....
> > Padding 0xffff8100201a71a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkkҐ
> > Padding 0xffff8100201a71b0: cc cc cc cc cc cc cc cc 00 00 1a 20 00 81 ff ff ММММММММ......яя
> > Padding 0xffff8100201a71c0: cd 70 17 a0 ff ff ff ff 00 00 00 00 73 05 00 00 Нp..яяяя....s...
> > Padding 0xffff8100201a71d0: b6 54 58 00 01 00 00 00 d5 71 26 81 ff ff ff ff ¶TX.....Хq&.яяяя
> >
> > Padding 0xffff8100201a71e0: 00 00 00 00 7c 05 00 00 97 54 58 00 01 00 00 00 ....|....TX.....
> >
> > which in turn is interesting because it very much looks like SLUB
> > re-used a page for something else (the values that things got
> > overwritten by are largely SLUB's own poison bytes: 6b is POISON_FREE,
> > the a5 at the end of the list of 6b's is POISON_END, while cc is
> > SLUB_RED_ACTIVE).
> >
> > To me, that pattern looks like an order-3 allocation (correct: that's what
> > kmalloc-4096 is supposed to be using!) got released, and the stuff at the
> > end (with slub debugging, there's only room for 7 4096-byte allocations
> > there, so 71b0 is past the end) in that SLUB debug info.
> >
> > The first word of that busy allocation is ffff8100201a0000, which is also
> > the base pointer to the whole order-3 page ("Free pointer"), followed by
> > the SLAB tracking data.
>
>
> Is the POISON_FREE ("6b") region really contiguous Zdenek? The problem
> here is that the object looks to be 29104 bytes that is subject to
> kmalloc_large() which by-passes SLUB poisoning completely.
>
No - it was simply cutted - here is carefully selected same log with
all different areas.
Zdenek
Padding 0xffff8100201a0000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
6b 6b kkkkkkkkkkkkkkkk
201a0010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0ba0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0bb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0bc0: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a0bd0: 00 00 00 00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
201a0be0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0bf0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0fe0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a0ff0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk¥
201a1000: cc cc cc cc cc cc cc cc d8 30 1a 20 00 81 ff ff ÌÌÌÌÌÌÌÌØ0....ÿÿ
201a1010: cd 70 17 a0 ff ff ff ff 00 00 00 00 73 05 00 00 Íp..ÿÿÿÿ....s...
201a1020: b6 54 58 00 01 00 00 00 d5 71 26 81 ff ff ff ff ¶TX.....Õq&.ÿÿÿÿ
201a1030: 00 00 00 00 00 00 00 00 8c 54 58 00 01 00 00 00 .........TX.....
201a1040: 5a 5a 5a 5a 5a 5a 5a 5a 6b 6b 6b 6b 6b 6b 6b 6b ZZZZZZZZkkkkkkkk
201a1050: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a1be0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a1bf0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a1c00: 6b 6b 6b 6b 6b 6b 6b 6b 01 00 00 00 00 00 00 00 kkkkkkkk........
201a1c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a1c20: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a1c30: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a2020: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a2030: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a2040: 6b 6b 6b 6b 6b 6b 6b a5 cc cc cc cc cc cc cc cc kkkkkkk¥ÌÌÌÌÌÌÌÌ
201a2050: 68 51 1a 20 00 81 ff ff cd 70 17 a0 ff ff ff ff hQ....ÿÿÍp..ÿÿÿÿ
201a2060: 00 00 00 00 73 05 00 00 b6 54 58 00 01 00 00 00 ....s...¶TX.....
201a2070: d5 71 26 81 ff ff ff ff 00 00 00 00 00 00 00 00 Õq&.ÿÿÿÿ........
201a2080: 97 54 58 00 01 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a .TX.....ZZZZZZZZ
201a2090: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a2c40: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a2c50: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a2c60: 00 00 00 00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
201a2c70: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a3070: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a3080: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk¥
201a3090: cc cc cc cc cc cc cc cc 00 00 00 00 00 00 00 00 ÌÌÌÌÌÌÌÌ........
201a30a0: cd 70 17 a0 ff ff ff ff 00 00 00 00 73 05 00 00 Íp..ÿÿÿÿ....s...
201a30b0: 5b 4c 58 00 01 00 00 00 d5 71 26 81 ff ff ff ff [LX.....Õq&.ÿÿÿÿ
201a30c0: 00 00 00 00 7c 05 00 00 f3 4b 58 00 01 00 00 00 ....|...óKX.....
201a30d0: 5a 5a 5a 5a 5a 5a 5a 5a 6b 6b 6b 6b 6b 6b 6b 6b ZZZZZZZZkkkkkkkk
201a30e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a3c80: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a3c90: 6b 6b 6b 6b 6b 6b 6b 6b 01 00 00 00 00 00 00 00 kkkkkkkk........
201a3ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a3cb0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a40c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a40d0: 6b 6b 6b 6b 6b 6b 6b a5 cc cc cc cc cc cc cc cc kkkkkkk¥ÌÌÌÌÌÌÌÌ
201a40e0: 20 41 1a 20 00 81 ff ff cd 70 17 a0 ff ff ff ff .A....ÿÿÍp..ÿÿÿÿ
201a40f0: 00 00 00 00 73 05 00 00 b6 54 58 00 01 00 00 00 ....s...¶TX.....
201a4100: d5 71 26 81 ff ff ff ff 00 00 00 00 7c 05 00 00 Õq&.ÿÿÿÿ....|...
201a4110: 87 54 58 00 01 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a .TX.....ZZZZZZZZ
201a4120: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a4cd0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a4ce0: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a4cf0: 00 00 00 00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
201a4d00: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a5100: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a5110: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk¥
201a5120: cc cc cc cc cc cc cc cc 00 00 00 00 00 00 00 00 ÌÌÌÌÌÌÌÌ........
201a5130: cd 70 17 a0 ff ff ff ff 00 00 00 00 73 05 00 00 Íp..ÿÿÿÿ....s...
201a5140: b6 54 58 00 01 00 00 00 d5 71 26 81 ff ff ff ff ¶TX.....Õq&.ÿÿÿÿ
201a5150: 00 00 00 00 00 00 00 00 86 54 58 00 01 00 00 00 .........TX.....
201a5160: 5a 5a 5a 5a 5a 5a 5a 5a 6b 6b 6b 6b 6b 6b 6b 6b ZZZZZZZZkkkkkkkk
201a5170: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a5d10: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a5d20: 6b 6b 6b 6b 6b 6b 6b 6b 01 00 00 00 00 00 00 00 kkkkkkkk........
201a5d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a5d40: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a6150: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a6160: 6b 6b 6b 6b 6b 6b 6b a5 cc cc cc cc cc cc cc cc kkkkkkk¥ÌÌÌÌÌÌÌÌ
201a6170: b0 61 1a 20 00 81 ff ff cd 70 17 a0 ff ff ff ff °a....ÿÿÍp..ÿÿÿÿ
201a6180: 00 00 00 00 73 05 00 00 b6 54 58 00 01 00 00 00 ....s...¶TX.....
201a6190: d5 71 26 81 ff ff ff ff 00 00 00 00 00 00 00 00 Õq&.ÿÿÿÿ........
201a61a0: 97 54 58 00 01 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a .TX.....ZZZZZZZZ
201a61b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a6d60: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a6d70: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
201a6d80: 00 00 00 00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
201a6d90: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a7190: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
201a71a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk¥
201a71b0: cc cc cc cc cc cc cc cc 00 00 1a 20 00 81 ff ff ÌÌÌÌÌÌÌÌ......ÿÿ
201a71c0: cd 70 17 a0 ff ff ff ff 00 00 00 00 73 05 00 00 Íp..ÿÿÿÿ....s...
201a71d0: b6 54 58 00 01 00 00 00 d5 71 26 81 ff ff ff ff ¶TX.....Õq&.ÿÿÿÿ
201a71e0: 00 00 00 00 7c 05 00 00 97 54 58 00 01 00 00 00 ....|....TX.....
Padding 0xffff8100201a71f0: 5a 5a 5a 5a 5a 5a 5a 5a
ZZZZZZZZ
FIX kmalloc-4096: Restoring 0xffff8100201a0000-0xffff8100201a7e16=0x5a
Powered by blists - more mailing lists