| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 2 May 2014 23:02:25 -0400 (EDT) From: Vince Weaver <vincent.weaver@...ne.edu> To: Vince Weaver <vincent.weaver@...ne.edu> cc: Thomas Gleixner <tglx@...utronix.de>, Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org> Subject: Re: [perf] more perf_fuzzer memory corruption On Fri, 2 May 2014, Vince Weaver wrote: > I've been fuzzing without your additional patch for 6 hours and all looks > (almost) good. I can add in your patch and let it fuzz overnight. and I applied the additional patch, installed the kernel, hit reboot, and the following happened (this was caused by rebooting while fuzzing was ongoing) :( I'm remote from the system too so the poor machine is going to be sitting there oopsing away until Monday. The system is going down for reboot NOW! INIT: Switching to runlevel: 6 INIT: Sending p [24444.795403] ------------[ cut here ]------------ [24444.802143] WARNING: CPU: 1 PID: 23062 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0() [24444.812613] list_del corruption. prev->next should be ffff8800c9028010, but was 6b6b6b6b6b6b6b6b [24444.908976] CPU: 1 PID: 23062 Comm: perf_fuzzer Tainted: G W 3.15.0-rc1+ #102 [24444.919934] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014 [24444.930206] 0000000000000009 ffff8800c8991ad8 ffffffff81649c80 ffff8800c8991b20 [24444.940667] ffff8800c8991b10 ffffffff810646ad ffff8800c9028000 ffff8801181bf000 [24444.951155] ffff8800c9028010 ffff8800c9028000 0000000000000001 ffff8800c8991b70 [24444.961677] Call Trace: [24444.967131] [<ffffffff81649c80>] dump_stack+0x45/0x56 [24444.975333] [<ffffffff810646ad>] warn_slowpath_common+0x7d/0xa0 [24444.984433] [<ffffffff8106471c>] warn_slowpath_fmt+0x4c/0x50 [24444.993286] [<ffffffff813c9fc1>] __list_del_entry+0xa1/0xd0 [24445.002082] [<ffffffff81131ec4>] list_del_event+0xe4/0xf0 [24445.010729] [<ffffffff811326c0>] perf_remove_from_context+0xb0/0x120 [24445.020315] [<ffffffff81133d8f>] perf_event_release_kernel+0x3f/0x80 [24445.029918] [<ffffffff81133ea3>] put_event+0xd3/0x100 [24445.038205] [<ffffffff81133e00>] ? put_event+0x30/0x100 [24445.046638] [<ffffffff81133ee5>] perf_release+0x15/0x20 [24445.055082] [<ffffffff811b69dc>] __fput+0xdc/0x1e0 [24445.063108] [<ffffffff811b6b2e>] ____fput+0xe/0x10 [24445.071114] [<ffffffff81085154>] task_work_run+0xc4/0xe0 [24445.079679] [<ffffffff81066d5c>] do_exit+0x2cc/0xa50 [24445.087922] [<ffffffff81076949>] ? get_signal_to_deliver+0x249/0x650 [24445.097582] [<ffffffff8106756c>] do_group_exit+0x4c/0xc0 [24445.106200] [<ffffffff81076991>] get_signal_to_deliver+0x291/0x650 [24445.115733] [<ffffffff81012438>] do_signal+0x48/0x990 [24445.124132] [<ffffffff81090c4d>] ? finish_task_switch+0x7d/0x120 [24445.133520] [<ffffffff81651417>] ? _raw_spin_unlock_irq+0x27/0x40 [24445.143007] [<ffffffff81090c4d>] ? finish_task_switch+0x7d/0x120 [24445.152398] [<ffffffff81090c0f>] ? finish_task_switch+0x3f/0x120 [24445.161807] [<ffffffff81012df0>] do_notify_resume+0x70/0xa0 [24445.170791] [<ffffffff81651fbc>] retint_signal+0x48/0x8c [24445.179516] ---[ end trace d44f7960e96a18db ]--- [24445.627788] ------------[ cut here ]------------ [24445.635804] WARNING: CPU: 2 PID: 23062 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0() [24445.646825] list_del corruption. prev->next should be ffff8800ce89a810, but was 6b6b6b6b6b6b6b6b [info] Will now restart. [24454.007929] general protection fault: 0000 [#1] SMP [24454.016867] Dumping ftrace buffer: [24454.023308] (ftrace buffer empty) [24454.117735] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 3.15.0-rc1+ #102 [24454.127563] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014 [24454.137169] task: ffffffff81c184c0 ti: ffffffff81c00000 task.ti: ffffffff81c00000 [24454.146980] RIP: 0010:[<ffffffff811356d2>] [<ffffffff811356d2>] __perf_remove_from_context+0x22/0xd0 [24454.158482] RSP: 0018:ffff88011ea03f18 EFLAGS: 00010087 [24454.165746] RAX: 01b8550000441f0f RBX: ffffffff81019590 RCX: 000000000000000a [24454.174917] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880118f0b800 [24454.184018] RBP: ffff88011ea03f40 R08: 0000000000000000 R09: 0000000000000001 [24454.193001] R10: 0000000000000000 R11: 0000000225c17d03 R12: ffff88011ea18310 [24454.202013] R13: ffff88011ea18310 R14: 0000000000000005 R15: ffff880118f0b800 [24454.211207] FS: 0000000000000000(0000) GS:ffff88011ea00000(0000) knlGS:0000000000000000 [24454.221242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [24454.228734] CR2: 00007f449fcb0d20 CR3: 0000000001c11000 CR4: 00000000001407f0 [24454.237680] DR0: 0000000000000000 DR1: 0000000002106000 DR2: 0000000000000000 [24454.246599] DR3: 0000000002106000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [24454.255588] Stack: [24454.258976] ffff880118f0b800 ffff88011ea18310 ffff88011ea18408 0000000000000005 [24454.268286] ffffffff81c99ab0 ffff88011ea03f78 ffffffff81135818 ffffffff811357b5 [24454.277423] ffff880118f0b800 ffff880036de1c98 0000000000000000 0000163b0f931a27 [24454.286642] Call Trace: [24454.290378] <IRQ> [24454.292457] [<ffffffff81135818>] __perf_event_exit_context+0x98/0xf0 [24454.301858] [<ffffffff811357b5>] ? __perf_event_exit_context+0x35/0xf0 [24454.310098] [<ffffffff810de20d>] generic_smp_call_function_single_interrupt+0x5d/0x100 [24454.319785] [<ffffffff81042197>] smp_call_function_single_interrupt+0x27/0x40 [24454.328627] [<ffffffff8165bb9d>] call_function_single_interrupt+0x6d/0x80 [24454.337078] <EOI> [24454.339156] [<ffffffff814e1b52>] ? cpuidle_enter_state+0x52/0xc0 [24454.347970] [<ffffffff814e1b48>] ? cpuidle_enter_state+0x48/0xc0 [24454.355492] [<ffffffff814e1bf7>] cpuidle_enter+0x17/0x20 [24454.362218] [<ffffffff810aa270>] cpu_startup_entry+0x2c0/0x3d0 [24454.369450] [<ffffffff81639ba6>] rest_init+0xb6/0xc0 [24454.375753] [<ffffffff81639af5>] ? rest_init+0x5/0xc0 [24454.382110] [<ffffffff81d05f75>] start_kernel+0x43d/0x448 [24454.388873] [<ffffffff81d05941>] ? repair_env_string+0x5c/0x5c [24454.396094] [<ffffffff81d05120>] ? early_idt_handlers+0x120/0x120 [24454.403605] [<ffffffff81d055ee>] x86_64_start_reservations+0x2a/0x2c [24454.411393] [<ffffffff81d05733>] x86_64_start_kernel+0x143/0x152 [24454.418825] Code: 70 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 ff 41 56 41 55 41 54 53 4c 8b 2f 49 8b 9d d8 01 00 00 48 8b 03 <4c> 8b 60 38 65 4c 03 24 25 e8 de 00 00 4c 8d 73 10 4c 89 f7 e8 [24454.441219] RIP [<ffffffff811356d2>] __perf_remove_from_context+0x22/0xd0 [24454.449564] RSP <ffff88011ea03f18> [24454.454447] bad: scheduling from the idle thread! ... etc, forever -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists