linux-kernel - Possible Bug in mincore or mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 22 Mar 2007 14:20:29 -0500
From:	Bruce Dubbs <bruce.dubbs@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: Possible Bug in mincore or mmap

When testing an installation with tests from the Linux Test Project, my
kernels fail one instance of the mincore01 tests:

mincoremincore01    1  PASS  :  expected failure: errno = 22 (Invalid
argument)
mincore01    2  PASS  :  expected failure: errno = 14 (Bad address)
mincore01    3  FAIL  :  call succeeded unexpectedly
mincore01    4  PASS  :  expected failure: errno = 12 (Cannot allocate
memory)01    1  PASS  :  expected failure: errno = 22 (Invalid argument)
mincore01    2  PASS  :  expected failure: errno = 14 (Bad address)
mincore01    3  FAIL  :  call succeeded unexpectedly
mincore01    4  PASS  :  expected failure: errno = 12 (Cannot allocate
memory)

I pared down the test to the attached program.  The result is supposed
to fail as it is asking for memory information 5 times what should be
allocated.

Upon experimenting, I found the test works properly if a printf is
executed before the mmap call.  I have tested on locally built, but
unmodified, 2.4.25, 2.6.12.5, and a 2.6.20.3 kernels and get the same
behavior.  The tests fail on IA32 architecture, but not 64-bit kernels.
 The test always works properly on FC6 and RHEL3.

I've checked the archives for this issue and could not find anything
appropriate.

Could this be a potential security issue as memory that is not supposed
to be accessible seems to be available to the user?  Is it expected
behavior?

Thanks.

  -- Bruce

View attachment "min.c" of type "text/plain" (1748 bytes)