linux-kernel - Re: tty-related oops in latest kernel(s)?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 May 2007 06:43:41 +0300 (EEST)
From:	Tero Roponen <teanropo@....fi>
To:	Pekka Enberg <penberg@...helsinki.fi>
cc:	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Andy Whitcroft <apw@...dowen.org>
Subject: Re: tty-related oops in latest kernel(s)?

On Tue, 29 May 2007, Pekka Enberg wrote:

> Hi Tero,
> 
> On 5/29/07, Tero Roponen <teanropo@....fi> wrote:
> > FYI, I just tested 2.6.21.3. I couldn't reproduce the problem with
> > that kernel.
> 

[snip] 

> > Warning: dev (tty4) tty->count(3) != #fd's(2) in release_dev
> > release_dev: driver.table[3] not tty for (tty4)
> 
> Presumably someone tries to close the file again which is why we get a
> new complaint that reference counting has gone bad.
> 
> Unfortunately, I have no idea why drivers->tty does not match. It
> could be a race with release_tty() or real use-after-free but I am
> unable to find anything obvious in 2.6.21 -> 2.6.22-rc3 that would
> break it. Doing the git bisect dance here would really help...

Hmmm, I just found something interesting. In 2.6.21.3 the /sbin/init
gets corrupted when I watch the video!

$ cp /sbin/init init.before
$ mplayer kiwi.flv
$ cp /sbin/init init.after

The sha1sums are here:

52c8d643057619cbe137b8e69d4709ce3bdd832d  init.after
8efc7864a5b535a9e336fa82e9d7f112f3d956c1  init.before

It seems that something corrupts memory somewhere...

I attached those files in case someone can figure out
what is happening.
_
Tero Roponen


Download attachment "init.before" of type "APPLICATION/octet-stream" (35380 bytes)

Download attachment "init.after" of type "APPLICATION/octet-stream" (35380 bytes)