linux-kernel - Re: BUG: Sporadic crashes with current Linus tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Sep 2017 09:44:43 -0700
From:   Andy Lutomirski <luto@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Andy Lutomirski <luto@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        X86 ML <x86@...nel.org>
Subject: Re: BUG: Sporadic crashes with current Linus tree

On Thu, Sep 14, 2017 at 9:00 AM, Thomas Gleixner <tglx@...utronix.de> wrote:
> On Thu, 14 Sep 2017, Andy Lutomirski wrote:
>> On Thu, Sep 14, 2017 at 12:38 AM, Thomas Gleixner <tglx@...utronix.de> wrote:
>> > Hi!
>> >
>> > I've seen the following crash sporadically with commit 46c1e79fee:
>> >
>> > Have not seen that with 3882a734c19b, though I saw the PCID warnings on
>> > that machine.
>> >
>> > I have no idea how to reproduce so bisecting is pretty much pointless. Any
>> > idea what to do?
>>
>> Does tools/testing/selftests/x86/sigreturn_64 reproduce it?
>
> Will try tomorrow once I figured out how to compile that stuff. Invoking a
> simple make in that directory fails.

What's the error?  It works for me.

>
> Built it manually and when I run it tells: stack16 is too high
>
>> Ugh, weird.  It kind of looks like current->thread.sp0 == NULL.  I
>> have a patch series that changes a bunch of that code in my git tree,
>> but that's definitely not in Linus' tree.
>
> Right. The stupid thing is that the machine did not throw up all day
> neither idle nor loaded. Still the same kernel which barfed tonight several
> times.

This is weird.  The crashing process is rsyslogd, which should have
been running for a long time and shouldn't have any strange state.  I
wonder if this is some kind of memory corruption.  There would have to
be corruption of thread_struct *and* some kind of issue causing IRET
to fail, though.

The attached patch could plausibly give some useful hint.

>
> Thanks,
>
>         tglx
>
>
>
>

View attachment "fixup_bad_iret.patch" of type "text/x-patch" (701 bytes)