linux-kernel - 2.6.22-rc2-mm1 NTFS & SLUB related fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 25 May 2007 05:01:20 +0000
From:	"young dave" <hidave.darkstar@...il.com>
To:	"Christoph Lameter" <clameter@....com>,
	"Andrew Morton" <akpm@...ux-foundation.org>
Cc:	"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>
Subject: 2.6.22-rc2-mm1 NTFS & SLUB related fix

Hi,
As I umount a ntfs partition, the kernel report some trace infomation,
I can't call it oops, right?

Andrew, could you tell me who is the right person should I send  to?

I navagated the ntfs inode.c, and found a possible bug, replaced
kmalloc with kzalloc,
because the ntfschar size is 2.  then the kernel doesn't warning
again. and the slub debug info also disappeared.

This patch works for me:

diff -udr linux/fs/ntfs/inode.c linux.new/fs/ntfs/inode.c
--- linux/fs/ntfs/inode.c	2007-05-25 12:46:27.000000000 +0000
+++ linux.new/fs/ntfs/inode.c	2007-05-25 12:45:31.000000000 +0000
@@ -136,11 +136,10 @@

 		BUG_ON(!na->name);
 		i = na->name_len * sizeof(ntfschar);
-		ni->name = kmalloc(i + sizeof(ntfschar), GFP_ATOMIC);
+		ni->name = kzalloc(i + sizeof(ntfschar), GFP_ATOMIC);
 		if (!ni->name)
 			return -ENOMEM;
 		memcpy(ni->name, na->name, i);
-		ni->name[i] = 0;
 	}
 	return 0;
 }



And please look the failed kernel message:

*** SLUB kmalloc-8: Redzone Active@...2959e38 slab 0xc1052b20
    offset=3640 flags=0x400000c2 inuse=73 freelist=0x00000000
  Bytes b4 0xc2959e28:  00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a
5a ........ZZZZZZZZ
    Object 0xc2959e38:  24 00 51 00 00 00 6b a5
 $.Q...k¥
   Redzone 0xc2959e40:  00 00 cc cc
 ..ÌÌ
FreePointer 0xc2959e44 -> 0x00000000
Last alloc: ntfs_init_locked_inode+0x9e/0x110 jiffies_ago=5140 cpu=0 pid=1604
Last free : __vunmap+0xb2/0xe0 jiffies_ago=30727 cpu=0 pid=1491
    Filler 0xc2959e68:  5a 5a 5a 5a 5a 5a 5a 5a
 ZZZZZZZZ
 [<c0163141>] check_object+0x71/0x250
 [<c04432e0>] preempt_schedule+0x50/0x70
 [<c01639a1>] free_debug_processing+0xc1/0x1a0
 [<c011e587>] vprintk+0x227/0x250
 [<c0164419>] __slab_free+0x79/0xe0
 [<c02216da>] __ntfs_clear_inode+0x11a/0x1b0
 [<c0164ee3>] kfree+0x63/0x70
 [<c02216da>] __ntfs_clear_inode+0x11a/0x1b0
 [<c02216da>] __ntfs_clear_inode+0x11a/0x1b0
 [<c0221839>] ntfs_clear_big_inode+0x59/0x120
 [<c019f690>] dquot_drop+0x0/0x50
 [<c017d411>] clear_inode+0xc1/0x150
 [<c017e3c7>] generic_forget_inode+0x107/0x180
 [<c017e4b3>] iput+0x53/0x60
 [<c0230b85>] ntfs_put_super+0x6c5/0x8e0
 [<c016a61a>] generic_shutdown_super+0xea/0x100
 [<c016b11c>] kill_block_super+0xc/0x20
 [<c016a35e>] deactivate_super+0x4e/0xa0
 [<c0180de5>] sys_umount+0x35/0x80
 [<c0115274>] do_page_fault+0x434/0x5c0
 [<c0180e45>] sys_oldumount+0x15/0x20
 [<c0104098>] syscall_call+0x7/0xb
 =======================
@@@ SLUB kmalloc-8: Restoring redzone (0xcc) from 0xc2959e40-0xc2959e43
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/