linux-kernel - Re: Kernel crash in free_pipe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Oct 2017 18:19:57 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Al Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: Kernel crash in free_pipe_info()

On Mon, Oct 30, 2017 at 3:26 PM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
> On Mon, Oct 30, 2017 at 3:14 PM, Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
>> On Mon, Oct 30, 2017 at 1:58 PM, Cong Wang <xiyou.wangcong@...il.com> wrote:
>>>
>>> We got more than a dozen of kernel crashes at free_pipe_info() on our
>>> 4.1 kernel, they are all very similar to this one (with slightly
>>> different faulty addresses):
>>
>> Were it not for the pointer to the much more recent powerpc version at
>>
>>     https://www.spinics.net/lists/kernel/msg2616441.html
>>
>> that you referenced, I'd be inclined to ignore this as much too old.
>> Al fixed a number of issues with splice() some time ago.
>
> Hmm. So I tried to google for this oops, and the only oops I find is
> hat ppc one you reference.
>
> Was that how you found it too?

Yes.


>
> The fact that google doesn't report any other oopses would seem to
> indicate that this is not a widespread issue. Where are the "more than
> a dozen" ones you refer to being reported? I'd like to see them all if
> at all possible, to see if there's some pattern to them..
>

We have thousands of machines running 4.1, so even with a dozen
crashes it is still a very small percentage. :)

I am attaching these stack traces that I copy-n-paste from the ABRT
email reports.

There are two patterns I can observe:

1. The faulty addresses are all near 0000000100000000, with one exception
of null (which is the most recent one)

2. R12 register, which should map to the local vairable 'i', is always 0x8
at the time of crash.


Hope it helps.

Thanks!

View attachment "free_pipe_info.txt" of type "text/plain" (34816 bytes)