linux-kernel - Re: 3.0rc2 oops in mem_cgroup_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 10 Jun 2011 12:55:51 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
Cc:	Hugh Dickins <hughd@...gle.com>, Ying Han <yinghan@...gle.com>,
	Dave Jones <davej@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: 3.0rc2 oops in mem_cgroup_from_task

On Fri, 10 Jun 2011 12:19:49 +0900
KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> wrote:

> On Fri, 10 Jun 2011 11:33:11 +0900
> KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> wrote:
> 
> > On Thu, 9 Jun 2011 18:30:49 -0700 (PDT)
> > Hugh Dickins <hughd@...gle.com> wrote:
>  
> > > 781cc621 <mem_cgroup_from_task>:
> > > 781cc621:	55                   	push   %ebp
> > > 781cc622:	31 c0                	xor    %eax,%eax
> > > 781cc624:	89 e5                	mov    %esp,%ebp
> > > 781cc626:	8b 55 08             	mov    0x8(%ebp),%edx
> > > 781cc629:	85 d2                	test   %edx,%edx
> > > 781cc62b:	74 09                	je     781cc636 <mem_cgroup_from_task+0x15>
> > > 781cc62d:	8b 82 fc 08 00 00    	mov    0x8fc(%edx),%eax
> > > 781cc633:	8b 40 1c             	mov    0x1c(%eax),%eax   <==========
> > > 781cc636:	c9                   	leave  
> > > 781cc637:	c3                   	ret    
> > > 
> > 
> > then, access to task->cgroups->subsys[?] causes access to 6b6b6b87...
> > 
> > Then, task->cgroups or task->cgroups->subsys contains bad pointer.
> > Considering khugepaged, it grabs mm_struct and memcg make an access to
> > (mm->owner)->cgroups->subsys.
> > 
> > Then, from memcg's point of view, we need to doubt mm->owner is valid or not
> > for this kind of tasks.
> > 
> 
> Dave's log shows 6b6b6b6b6b..., too.
> 
> I guess it as "POISON_FREE" of slab object. Then, task->cgroups may used after free.
> 
Ah, sorry.

0x1c(%eax) == 6b6b6b87 means %eax was 0x6b6b6b6b.
The %eax was the contents of [task->cgroups]....hmm, then, task itself is freed
pointer (and poisoned). So, it seems a problem of accessing mm->owner..

Thanks,
-Kame












--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/