linux-kernel - Re: 2.6.21-mm2 -- compat_core_sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4643020C.1010307@shadowen.org>
Date:	Thu, 10 May 2007 12:29:16 +0100
From:	Andy Whitcroft <apw@...dowen.org>
To:	Andrew Morton <akpm@...ux-foundation.org>
CC:	linux-kernel@...r.kernel.org
Subject: Re: 2.6.21-mm2 -- compat_core_sys_select() kmalloc(0)

Seems that compat_core_sys_select() is using kmalloc(0) and SLUB is
picking up on it.  Occuring on an older x86_64 numa system.

BUG: at include/linux/slub_def.h:88 kmalloc_index()

Call Trace:
 [<ffffffff80270392>] get_slab+0x50/0x1f7
 [<ffffffff802706d0>] __kmalloc+0xf/0x6d
 [<ffffffff802a0421>] compat_core_sys_select+0x7e/0x1d8
 [<ffffffff802a061d>] compat_sys_select+0xa2/0x131
 [<ffffffff8021acb2>] ia32_sysret+0x0/0xa

This appears to occur when a 32 bit app uses select(0, ...) as a
timeout.  I think its safe as it is, in that we'll never touch the
pointers if n==0 but more eyes would help.  It might be clearer to
special case the n==0 case to avoid all this.

-apw
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/