linux-kernel - Re: [SLUB 0/3] SLUB: The unqueued slab allocator V4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0703080937410.27614@schroedinger.engr.sgi.com>
Date:	Thu, 8 Mar 2007 09:46:53 -0800 (PST)
From:	Christoph Lameter <clameter@....com>
To:	Mel Gorman <mel@....ul.ie>
cc:	akpm@...l.org, Marcelo Tosatti <marcelo@...ck.org>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org, mpm@...enic.com,
	Manfred Spraul <manfred@...orfullife.com>
Subject: Re: [SLUB 0/3] SLUB: The unqueued slab allocator V4

On Thu, 8 Mar 2007, Mel Gorman wrote:

> Brought up 4 CPUs
> Node 0 CPUs: 0-3
> mm/memory.c:111: bad pud c0000000050e4480.

Lower bits must be clear right? Looks like the pud was released
and then reused for a 64 byte cache or so. This is likely a freelist 
pointer that slub put there after allocating the page for the 64 byte 
cache. Then we tried to use the pud.

> migration_cost=0,1000
> *** SLUB: Redzone Inactive check fails in kmalloc-64@...00000050de0f0 Slab
> c000000000756090
>     offset=240 flags=5000000000c7 inuse=3 freelist=c0000000050de0f0
>   Bytes b4 c0000000050de0e0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ................
>     Object c0000000050de0f0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ................
>     Object c0000000050de100:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ................
>     Object c0000000050de110:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ................
>     Object c0000000050de120:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ................
>    Redzone c0000000050de130:  00 00 00 00 00 00 00 00
> ........ FreePointer c0000000050de138: 0000000000000000

Data overwritten after free or after slab was allocated. So this may be 
the same issue. pud was zapped after it was freed destroying the poison 
of another object in the 64 byte cache.

Hmmm.. Maybe I should put the pad checks before the object checks. 
That way we detect that the whole slab was corrupted and do not flag just 
a single object.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/