linux-kernel - Re: tty_ldisc_try_get(): BUG kmalloc-8: Poison overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 15 Jun 2009 01:03:01 +0200
From:	Vegard Nossum <vegard.nossum@...il.com>
To:	Pekka Enberg <penberg@...helsinki.fi>
Cc:	Ingo Molnar <mingo@...e.hu>, Alan Cox <alan@...rguk.ukuu.org.uk>,
	linux-kernel@...r.kernel.org, "Rafael J. Wysocki" <rjw@...k.pl>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: tty_ldisc_try_get(): BUG kmalloc-8: Poison overwritten

2009/6/14 Pekka Enberg <penberg@...helsinki.fi>:
> On Sun, Jun 14, 2009 at 11:20 AM, Pekka Enberg<penberg@...helsinki.fi> wrote:
>>> You could add something like
>>>
>>>  WARN_ON(ld->refcount == 0x6b)
>>>
>>> to tty_ldisc_deref() to see if that triggers.
>
> On Sun, Jun 14, 2009 at 11:30 AM, Pekka Enberg<penberg@...helsinki.fi> wrote:
>> Make that
>>
>>    WARN_ON(ld->refcount == (int)0xa56b6b6b)
>>
>> instead.
>
> And oh, kmemcheck should be able to catch this too. :-)
>

I was able to get this trace:

(none) login: [  867.947401] WARNING: kmemcheck: Caught 32-bit read
from freed memory (469e2f44)
[  867.962162] 00000000020000000038bf41020000000038bf41020000000038bf4102000000
[  868.012078]  i i i i f f f f i i i i i i i i i i i i i i i i i i i i i i i i
[  868.061629]          ^
[  868.067686]
[  868.071709] Pid: 1857, comm: getty Not tainted (2.6.30 #416)
[  868.082651] EIP: 0060:[<414772ea>] EFLAGS: 00000002 CPU: 0
[  868.095379] EIP is at tty_ldisc_deref+0x1a/0x70
[  868.103757] EAX: 00000216 EBX: 469e2f40 ECX: 414772e8 EDX: 41bf3870
[  868.115752] ESI: 00000216 EDI: 4766483c EBP: 46f37f3c ESP: 41e22450
[  868.131343]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  868.141609] CR0: 8005003b CR2: 47806e04 CR3: 06b6b000 CR4: 00000690
[  868.155263] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[  868.167168] DR6: 00004000 DR7: 00000000
[  868.175228]  [<4146f26d>] tty_read+0x8d/0xc0
[  868.184598]  [<410ca219>] vfs_read+0x99/0x180
[  868.196380]  [<410ca3bd>] sys_read+0x3d/0x70
[  868.206936]  [<41003a6f>] sysenter_do_call+0x12/0x3c
[  868.219746]  [<ffffffff>] 0xffffffff

Thats:

drivers/char/tty_ldisc.c:366
drivers/char/tty_io.c:896

I also saw this a couple of times (it's not my printk):

[ 1266.934668] tty_ldisc_deref: no references.
[ 1267.531655] tty_ldisc_deref: no references.
[ 1267.790096] tty_ldisc_deref: no references.


Vegard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/