| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 6 Jan 2009 08:47:07 +0100 From: Eric Sesterhenn <snakebyte@....de> To: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com> Cc: Kamalesh Babulal <kamalesh@...ux.vnet.ibm.com>, linux-kernel@...r.kernel.org, josh@...edesktop.org, dipankar@...ibm.com Subject: Re: [BUG] NULL pointer deref with rcutorture * Paul E. McKenney (paulmck@...ux.vnet.ibm.com) wrote: > On Mon, Jan 05, 2009 at 04:29:12PM -0800, Paul E. McKenney wrote: > > On Mon, Jan 05, 2009 at 02:18:36PM -0800, Paul E. McKenney wrote: > > > > e98: a1 98 00 00 00 mov 0x98,%eax > > > > e99: R_386_32 .bss > > > > e9d: 85 c0 test %eax,%eax > > > > e9f: 75 09 jne eaa <rcu_stutter_wait+0x1a> > > > > ea1: a1 00 00 00 00 mov 0x0,%eax > > > > ea2: R_386_32 rcutorture_runnable > > > > ea6: 85 c0 test %eax,%eax > > > > ea8: 75 36 jne ee0 <rcu_stutter_wait+0x50> > > > > eaa: a1 88 1a 00 00 mov 0x1a88,%eax > > > > eab: R_386_32 .bss > > > > eaf: 85 c0 test %eax,%eax > > > > eb1: 75 2d jne ee0 <rcu_stutter_wait+0x50> > > > > eb3: 8b 15 00 00 00 00 mov 0x0,%edx > > > > eb5: R_386_32 rcutorture_runnable > > > > eb9: 85 d2 test %edx,%edx > > > > ebb: 74 2b je ee8 <rcu_stutter_wait+0x58> > > > > ebd: b8 01 00 00 00 mov $0x1,%eax > > > > ec2: e8 fc ff ff ff call ec3 <rcu_stutter_wait+0x33> > > > > ec3: R_386_PC32 schedule_timeout_interruptible > > > > ec7: a1 98 00 00 00 mov 0x98,%eax > > > > ec8: R_386_32 .bss > > > > ecc: 85 c0 test %eax,%eax > > > > ece: 74 d1 je ea1 <rcu_stutter_wait+0x11> > > > > ed0: a1 88 1a 00 00 mov 0x1a88,%eax > > > > ed1: R_386_32 .bss > > > > ed5: 85 c0 test %eax,%eax > > > > ed7: 74 da je eb3 <rcu_stutter_wait+0x23> > > > > ed9: 8d b4 26 00 00 00 00 lea 0x0(%esi,%eiz,1),%esi > > > > ee0: 5d pop %ebp > > > > ee1: c3 ret > > > > ee2: 8d b6 00 00 00 00 lea 0x0(%esi),%esi > > > > ee8: b8 fa 00 00 00 mov $0xfa,%eax > > > > eed: e8 fc ff ff ff call eee <rcu_stutter_wait+0x5e> > > > > eee: R_386_PC32 round_jiffies_relative > > > > ef2: 8d b6 00 00 00 00 lea 0x0(%esi),%esi > > > > ef8: e8 fc ff ff ff call ef9 <rcu_stutter_wait+0x69> > > > > ef9: R_386_PC32 schedule_timeout_interruptible > > > > efd: 8d 76 00 lea 0x0(%esi),%esi > > > > > > > > here is the deref ------------------------^ > > > > > > Ah!!! We are getting a page fault while cleaning up the stack frame? > > > > > > Ouch! > > > > > > > f00: eb 96 jmp e98 <rcu_stutter_wait+0x8> > > > > f02: 8d b4 26 00 00 00 00 lea 0x0(%esi,%eiz,1),%esi > > > > f09: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi > > > > And now I can run this. gcc v3.4.4 gives yet a different error: > > > > divide error: 0000 [#1] PREEMPT SMP > > last sysfs file: /sys/devices/pci0000:00/0000:00:0a.0/0000:02:04.0/host0/target0:0:6/0:0:6:0/type > > CPU 1 > > Modules linked in: [last unloaded: rcutorture] > > Pid: 3369, comm: rcu_torture_rea Not tainted 2.6.28-autokern1 #1 > > RIP: 0010:[<ffffffffa0000142>] [<ffffffffa0000142>] 0xffffffffa0000142 > > RSP: 0000:ffff88007f0afeb0 EFLAGS: 00010246 > > RAX: 00000000def36d6a RBX: ffffffffa0006850 RCX: 0000000000000000 > > RDX: 0000000000000000 RSI: ffff88007ecf1600 RDI: ffff88007f0afef0 > > RBP: 0000000000000dd4 R08: ffff88007f0ae000 R09: ffffffff8037c7d9 > > R10: 0000000000000000 R11: ffffffff8037c7d9 R12: 0000000000000000 > > R13: 000000000000000a R14: 0000000000000000 R15: 0000000000000000 > > FS: 0000000000000000(0000) GS:ffff8800e3801c00(0000) knlGS:00000000f7f3ab80 > > CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b > > CR2: 00000000080dc87c CR3: 0000000000201000 CR4: 00000000000006e0 > > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > > Process rcu_torture_rea (pid: 3369, threadinfo ffff88007f0ae000, task ffff88007ecf5d80) > > Stack: > > ffffffff8037c7d9 ffffffffa000090d ffff88007ecfdec0 ffff88007ec17eb0 > > 0000000000000001 ffffffffa00006e6 0000000000000000 ffff8800e3488000 > > c744ca136d6adef3 0000000000000256 0000000000000000 ffffffffa0000807 > > Call Trace: > > [<ffffffff8037c7d9>] ? delay_tsc+0x0/0x99 > > [<ffffffff80245b94>] ? kthread+0x3d/0x63 > > [<ffffffff8020c3ea>] ? child_rip+0xa/0x20 > > [<ffffffff80245b57>] ? kthread+0x0/0x63 > > [<ffffffff8020c3e0>] ? child_rip+0x0/0x20 > > Code: 58 c3 56 bf 01 00 00 00 e8 88 bd 22 e0 59 31 c0 c3 41 51 e8 69 ff ff ff 48 63 15 0a 58 00 00 48 69 d2 90 01 00 00 48 89 d1 31 d2 <48> f7 f1 48 85 d2 75 0c 41 58 bf 78 1b 0d 00 e9 32 c7 37 e0 5f > > RIP [<ffffffffa0000142>] 0xffffffffa0000142 > > RSP <ffff88007f0afeb0> > > > > I will see what I can find from this. > > Hello, Eric, > > Just for grins, I built the 2.6.28 kernel/rcutorture.c on b58602a. It > insmoded and rmmoded without errors. > > Could you please try this on your setup? I have attached this file in > case that helps. works like a charm Greetings, Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists