linux-kernel - Re: BUG kmalloc-4096: Poison overwritten (2.6.35-rc2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 7 Jun 2010 13:25:01 +1000
From:	Dave Airlie <airlied@...il.com>
To:	Jiri Slaby <jslaby@...e.cz>
Cc:	"Justin P. Mattock" <justinmattock@...il.com>, frankpzh@...il.com,
	Greg KH <gregkh@...e.de>,
	Ortwin Glück <odi@....ch>,
	linux-kernel@...r.kernel.org, jirislaby@...il.com
Subject: Re: BUG kmalloc-4096: Poison overwritten (2.6.35-rc2)

On Mon, Jun 7, 2010 at 7:33 AM, Jiri Slaby <jslaby@...e.cz> wrote:
> On 06/06/2010 11:06 PM, Justin P. Mattock wrote:
>> On 06/05/2010 11:27 PM, Jiri Slaby wrote:
>>> On 06/06/2010 08:12 AM, Justin P. Mattock wrote:
>>>> =============================================================================
>>>>
>>>>
>>>> [    0.002046] BUG kmalloc-4096: Poison overwritten
>>>> [    0.002051]
>>>> -----------------------------------------------------------------------------
>>>>
>>>>
>>>> [    0.002052]
>>>> [    0.002063] INFO: 0xffff88003ec09e00-0xffff88003ec09e9f. First byte
>>>> 0x20 instead of 0x6b
>>>> [    0.002073] INFO: Slab 0xffffea0000dba1c0 objects=7 used=1
>>>> fp=0xffff88003ec09048 flags=0x40000000000040c3
>>>> [    0.002082] INFO: Object 0xffff88003ec09048 @offset=4168
>>>> fp=0xffff88003ec0a090
>>>> [    0.002083]
>>>> [    0.002093] Bytes b4 0xffff88003ec09038:  00 00 00 00 00 00 00 00 5a
>>>> 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
>>>> [    0.002114]   Object 0xffff88003ec09048:  6b 6b 6b 6b 6b 6b 6b 6b 6b
>>>> 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>> ...
>>>> 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
>>>> [    0.002999]   Object 0xffff88003ec09df8:  6b 6b 6b 6b 6b 6b 6b 6b 20
>>>> 07 20 07 20 07 20 07 kkkkkkkk........
>>>> [    0.002999]   Object 0xffff88003ec09e08:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e18:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e28:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e38:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e48:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e58:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e68:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e78:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e88:  20 07 20 07 20 07 20 07 20
>>>> 07 20 07 20 07 20 07 ................
>>>> [    0.002999]   Object 0xffff88003ec09e98:  20 07 20 07 20 07 20 07 6b
>>>> 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
>>>> [    0.002999]   Object 0xffff88003ec09ea8:  6b 6b 6b 6b 6b 6b 6b 6b 6b
>>>
>>> Just guessing, grey spaces which should go to video ram?
>>>
>>
>>
>> o.k. I bisected this down to this commit:
>> 962400e8fd29
>> reverting gets dmesg to not
>> have a Poison overwritten..
>
> This definitely makes sense.
>
>> as for the screen blankness I think this
>> did cause it..keep in mind the blankness(black)
>> is not everytime(every so often)
>> here's some images of it:
>> http://www.flickr.com/photos/44066293@N08/4676350524/
>> http://www.flickr.com/photos/44066293@N08/4676350016/
>
> Yes, as I guessed, the "grey spaces" were written to some random space
> instead of video ram where they should overwrite (clear) the characters
> which you see on the pictures.
>
> Does the patch below help?
>

This helps a lot of issues on KMS systems,. can you get it to Linus?

Acked-by: Dave Airlie <airlied@...hat.com>

Dave.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/