linux-kernel - Re: [perf] more perf_fuzzer memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 2 May 2014 12:43:17 -0400 (EDT)
From:	Vince Weaver <vincent.weaver@...ne.edu>
To:	Peter Zijlstra <peterz@...radead.org>
cc:	Vince Weaver <vincent.weaver@...ne.edu>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [perf] more perf_fuzzer memory corruption

On Fri, 2 May 2014, Peter Zijlstra wrote:

> In principle the vfs file refcounting should be responsible for that.
> But I'll go over it in a bit.

The poll code is ancient and the C-parser in my head really can't handle 
it very well.

Anyway for completeness this is the kind of thing I'm seeing.
The poll() manpage isn't very clear about what is supposed to happen if 
you poll() on a closed file descriptor.


FD#3 closed
	perf_fuzzer-2293  [003]   286.500137: sys_enter:            NR 3 (3, 7fff841b9eac, 0, 22, 7ff17078110c, 7ff170781120)

Child killed:
	perf_fuzzer-2293  [003]   286.505587: sys_exit:             NR 62 = 0

Poll started, seems to have freed fd #3 as an argument:
	perf_fuzzer-2293  [003]   286.505703: sys_enter:            NR 7 (7fff841b9b00, 55, 3, 40e3e3, 7ff1707810dc, 7ff170781120)

(child is still closing out at this point)


Event freed:
	<...>-2701  [004]   286.505904: bprint:               _free_event: freeing with 0 refs; ptr=0x0xffff8800ce88e000

fd#3 is still being polled despite the event being completely gone now:
	perf_fuzzer-2293  [003]   286.508846: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508847: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508848: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508849: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508850: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508846: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508847: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508848: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508849: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508850: bprint:               do_sys_poll: VMW: poll 3
	perf_fuzzer-2293  [003]   286.508850: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508851: bprint:               do_sys_poll: VMW: poll 12
	perf_fuzzer-2293  [003]   286.508850: function:             perf_poll
	perf_fuzzer-2293  [003]   286.508851: bprint:               do_sys_poll: VMW: poll 12

Finally done polling:
	perf_fuzzer-2293  [003]   286.509002: sys_exit:             NR 7 = 0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/