linux-kernel - Re: kref refcounting breakage in mainline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 15 Mar 2007 08:53:07 +0100
From:	Mike Galbraith <efault@....de>
To:	Greg KH <greg@...ah.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Tejun Heo <htejun@...il.com>,
	Kay Sievers <kay.sievers@...y.org>,
	linux-kernel@...r.kernel.org, Adrian Bunk <bunk@...sta.de>
Subject: Re: kref refcounting breakage in mainline

On Wed, 2007-03-14 at 22:27 -0700, Greg KH wrote:

> But can you try this version instead?

It exploded in strcmp().  Unfortunately, the full oops didn't make it to
either console or serial console.

[   30.783048] ipmi message handler version 39.1
[   30.787632] ipmi device interface
[   30.791166] IPMI System Interface driver.
[   30.816961] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000000
[   30.832700]  printing eip:
[   30.842383] c02d4098
[   30.851458] *pde = 00000000
[   30.861089] Oops: 0000 [#1]
[   30.870585] PREEMPT SMP 
[   30.879724] Modules linked in:
[   30.889288] CPU:    1
[   30.889290] EIP:    0060:[<c02d4098>]    Not tainted VLI
[   30.889292] EFLAGS: 00010282   (2.6.21-rc3-smp #81)


I did this...

--- kernel/module.c.org	2007-03-15 07:20:15.000000000 +0100
+++ kernel/module.c	2007-03-15 08:13:36.000000000 +0100
@@ -2419,15 +2419,19 @@ void module_remove_driver(struct device_
 
 	if (drv->owner && drv->owner->mkobj.drivers_dir)
 		mk = &drv->owner->mkobj;
-	else {
+	else if (drv->mod_name) {
 		/* Lookup built-in module entry in /sys/modules */
 		mkobj = kset_find_obj(&module_subsys.kset, drv->mod_name);
 		if (!mkobj)
-			return;
+			goto out_free;
 		mk = container_of(mkobj, struct module_kobject, kobj);
+	} else {
+		WARN_ON(1);
+		goto out_free;
 	}
 	sysfs_remove_link(mk->drivers_dir, driver_name);
 	kobject_put(mkobj);
+out_free:
 	kfree(driver_name);
 }
 EXPORT_SYMBOL(module_remove_driver);

...and it booted.

[   24.670410] ipmi message handler version 39.1
[   24.675000] ipmi device interface
[   24.678542] IPMI System Interface driver.
[   24.703956] BUG: at kernel/module.c:2429 module_remove_driver()
[   24.716837]  [<c0105086>] show_trace_log_lvl+0x1a/0x30
[   24.728909]  [<c01057b2>] show_trace+0x12/0x14
[   24.740239]  [<c0105856>] dump_stack+0x16/0x18
[   24.751469]  [<c01441ce>] module_remove_driver+0xa5/0xa7
[   24.763584]  [<c035a014>] bus_remove_driver+0x6d/0x82
[   24.775390]  [<c035a978>] driver_unregister+0xb/0x18
[   24.787019]  [<c034c8c2>] init_ipmi_si+0x7a9/0x7c1
[   24.798450]  [<c06705bc>] init+0x144/0x26c
[   24.809129]  [<c0104cfb>] kernel_thread_helper+0x7/0x1c
[   24.820916]  =======================
[   24.830926] ipmi_si: Unable to find any System Interface(s)
[   24.842952] IPMI Watchdog: driver initialized
  24.853749] Copyright (C) 2004 MontaVista Software - IPMI Powerdown via sys_reboot.

	-Mike

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/