linux-kernel - Re: 2.6.22-rc2-mm1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 May 2007 15:01:22 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Michal Piotrowski <michal.k.k.piotrowski@...il.com>
Cc:	Christoph Lameter <clameter@....com>, linux-kernel@...r.kernel.org
Subject: Re: 2.6.22-rc2-mm1

On Wed, 23 May 2007 23:05:24 +0200
Michal Piotrowski <michal.k.k.piotrowski@...il.com> wrote:

> Christoph Lameter napisa__(a):
> > On Wed, 23 May 2007, Michal Piotrowski wrote:
> > 
> >> Christoph, this looks like a bug in SLUB.
> > 
> > Please boot with slub_debug to find the bad code that overwrites a slab 
> > object after it was freed.
> > 
> > 
> 
> [   19.096577] Real Time Clock Driver v1.12ac
> [   21.650315] *** SLUB kmalloc-8: Redzone Active@...90f6d20 slab 0xc528c530
> [   21.657365]     offset=3360 flags=0x400000c3 inuse=61 freelist=0xc90f6d58
> [   21.664349]   Bytes b4 0xc90f6d10:  00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
> [   21.674305]     Object 0xc90f6d20:  31 30 31 39 2e 30 30 35                         1019.005        
> [   21.684259]    Redzone 0xc90f6d28:  00 cc cc cc                                     .______            
> [   21.694265] FreePointer 0xc90f6d2c -> 0xc90f6d58
> [   21.699061] Last alloc: get_modalias+0x61/0xf5 jiffies_ago=53 cpu=1 pid=554
> [   21.706362]     Filler 0xc90f6d50:  5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ        

argh, I never 100% understood the slab gobbledygook, and now we have slub
gobbledygook.  I _hope_ what that's saying is that the 00 at 0xc90f6d28
wasn't supposed to be there.

Obvious bug:

--- a/drivers/firmware/dmi-id.c~a
+++ a/drivers/firmware/dmi-id.c
@@ -94,7 +94,7 @@ static ssize_t get_modalias(char *buffer
 		if (!c)
 			continue;
 
-		t = kmalloc(strlen(c), GFP_KERNEL);
+		t = kmalloc(strlen(c) + 1, GFP_KERNEL);
 		if (!t)
 			break;
 		ascii_filter(t, c);
_


> Here is another one

Same deal.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/