linux-kernel - Re: tty-related oops in latest kernel(s)?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 May 2007 08:54:04 +0300
From:	"Pekka Enberg" <penberg@...helsinki.fi>
To:	"Tero Roponen" <teanropo@....fi>
Cc:	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	"Alan Cox" <alan@...rguk.ukuu.org.uk>,
	"Andy Whitcroft" <apw@...dowen.org>
Subject: Re: tty-related oops in latest kernel(s)?

On 5/30/07, Tero Roponen <teanropo@....fi> wrote:
> Hmmm, I just found something interesting. In 2.6.21.3 the /sbin/init
> gets corrupted when I watch the video!
>
> $ cp /sbin/init init.before
> $ mplayer kiwi.flv
> $ cp /sbin/init init.after
>
> The sha1sums are here:
>
> 52c8d643057619cbe137b8e69d4709ce3bdd832d  init.after
> 8efc7864a5b535a9e336fa82e9d7f112f3d956c1  init.before
>
> It seems that something corrupts memory somewhere...

To debug this a bit further:

$ od -a -t x1 -v init.after > init.after.dump
$ od -a -t x1 -v init.before > init.before.dump
$ diff -u init.before.dump init.after.dump | less

-0011340  nul nul nul  e9  f0  fe  ff  ff  ff   %   < soh enq  bs   h  80
-           00  00  00  e9  f0  fe  ff  ff  ff  25  3c  01  05  08  68  80
+0010000    y ack nul nul   y ack nul nul   y ack nul nul   y ack nul nul
+           79  06  00  00  79  06  00  00  79  06  00  00  79  06  00  00
+0010020    y ack nul nul   y ack nul nul   y ack nul nul   y ack nul nul
+           79  06  00  00  79  06  00  00  79  06  00  00  79  06  00  00
+0011340    y ack nul nul   y ack nul nul  ff   %   < soh enq  bs   h  80
+           79  06  00  00  79  06  00  00  ff  25  3c  01  05  08  68  80

The file at offset 0010000 - 0011348 is overwritten with the byte
pattern 79 06 00 00.

Do you see anything in the logs or is this a silent corruption? Did
you see this corruption with 2.6.19 or 2.6.22-rc3?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/