linux-kernel - Re: 2.6.26-git: NULL pointer deref in __switch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 Jun 2008 12:15:39 +0200
From:	Simon Holm Thøgersen <odie@...aau.dk>
To:	Suresh Siddha <suresh.b.siddha@...el.com>
Cc:	Vegard Nossum <vegard.nossum@...il.com>,
	Patrick McHardy <kaber@...sh.net>,
	Linux Kernel Mailinglist <linux-kernel@...r.kernel.org>,
	Chuck Ebbert <cebbert@...hat.com>, x86@...nel.org
Subject: Re: 2.6.26-git: NULL pointer deref in __switch_to

fre, 13 06 2008 kl. 15:47 -0700, skrev Suresh Siddha: 
> On Fri, Jun 13, 2008 at 11:24:01AM -0700, Vegard Nossum wrote:
> > On Fri, Jun 13, 2008 at 7:42 PM, Patrick McHardy <kaber@...sh.net> wrote:
> > > I get this oops once a day, its apparently triggered by something
> > > run by cron, but the process is a different one each time.
> > >
> > > Kernel is -git from yesterday shortly before the -rc6 release
> > > (last commit is the usb-2.6 merge, the x86 patches are missing),
> > > .config is attached.
> > >
> > > I'll retry with current -git, but the patches that have gone in
> > > since I last updated don't look related.
> > >
> > 
> > Thanks for the report.
> > 
> > >
> > > [62060.043009] BUG: unable to handle kernel NULL pointer dereference at
> > > 000001ff
> > > [62060.043009] IP: [<c0102a9b>] __switch_to+0x2f/0x118
> > > [62060.043009] *pde = 00000000
> > > [62060.043009] Oops: 0002 [#1] PREEMPT
> 
> Patrick, Do you see any other error messages before this BUG stmt? Can you
> please provide the complete kernel log till the point of failure?
> 
Suresh, I'm pretty sure this is the same problem that I reported two
weeks ago [1]. I suggested that you tried running lguest and reproduced
the problem locally, but I did not hear back from you. Now Patrick is
reporting the same problem and is also indicating that the problem is
correlated with his use of lguest, so I'd really like you to follow up
on this.

> I have a theory for your problem and have appended a patch to test it. Can
> you please check if the appended patch fixes your problem.
> 
At least for me, with this patch applied on top of -rc4 or -rc6+ the
problem still triggered after running an lguest guest for less than 30
seconds (the guest didn't even finish the boot of an image of Ubuntu
with no X-server).

I think there is a bit of timing involved, and sometimes where I wanted
to provoke the problem the guest did complete booting, but I've always
been able to provoke the problem within five minutes by adding a compile
load on the host and the guest.

If you or anybody else would like to use the same guest image I use
please just ask and I'll make it available somehow.

Attached is latest config I've reproduced the problem with.

[1] http://lkml.org/lkml/2008/6/3/148


Simon Holm Thøgersen

View attachment ".config" of type "text/plain" (48313 bytes)