linux-kernel - Re: [broken-out-2007-07-20-00-22] kernel bug at kernel/params:570

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6bffcb0e0707201728u6deeccd1j453ff89d0767dccc@mail.gmail.com>
Date:	Sat, 21 Jul 2007 02:28:52 +0200
From:	"Michal Piotrowski" <michal.k.k.piotrowski@...il.com>
To:	"Satyam Sharma" <satyam.sharma@...il.com>
Cc:	"Greg KH" <gregkh@...e.de>,
	"Andrew Morton" <akpm@...ux-foundation.org>, rdunlap@...otime.net,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [broken-out-2007-07-20-00-22] kernel bug at kernel/params:570

On 21/07/07, Satyam Sharma <satyam.sharma@...il.com> wrote:
> Oh, which means ...
>
>
> On 7/21/07, Satyam Sharma <satyam.sharma@...il.com> wrote:
> > On 7/21/07, Greg KH <gregkh@...e.de> wrote:
> > > On Fri, Jul 20, 2007 at 03:59:12PM -0700, Andrew Morton wrote:
> > > > On Fri, 20 Jul 2007 15:50:47 -0700
> > > > Greg KH <gregkh@...e.de> wrote:
> > > >
> > > > > On Fri, Jul 20, 2007 at 06:32:21PM +0200, Michal Piotrowski wrote:
> > > > > >  Hi Greg,
> > > > > >
> > > > > >  This looks like a sysfs bug
> > > > > >  http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/
> > > > > >  broken-out-2007-07-20-00-22/00003.jpg
> > > > > >
> > > > > >  l *kernel_param_sysfs_setup+0x75
> > > > > >  0xc13c0894 is in kernel_param_sysfs_setup (kernel/params.c:570).
> > > > > >  565             mk->mod = THIS_MODULE;
> > > > > >  566             kobj_set_kset_s(mk, module_subsys);
>
> > > > > >  567             kobject_set_name(&mk->kobj, name);
>
> Shouldn't the return of kobject_set_name() be checked here?
>
> [ Looking at code, and realizing that kobject_set_name() manages to
> succeed even when given a null string! ]
>
> > > > > >  568             kobject_init(&mk->kobj);
> > > > > >  569             ret = kobject_add(&mk->kobj);
> > > > > >  570             BUG_ON(ret < 0);
> > > > > >  571             param_sysfs_setup(mk, kparam, num_params, name_skip);
> > > > > >  572             kobject_uevent(&mk->kobj, KOBJ_ADD);
> > > > > >  573     }
> > > > > >  574
> > > > > >
> > > > > >  http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/
> > > > > >  broken-out-2007-07-20-00-22/mm-config
> > > > >
> > > > > What kernel version is this happening on?  The -mm tree?  Can you try
> > > > > Linus's tree instead?
> > > > >
> > > > > It looks like there was some needed information right before the first
> > > > > stack dump, showing exactly what kobject was trying to be added that was
> > > > > already present.  Odds are this is a kernel parameter with the same name
> > > > > as a duplicate one within the same module,
> >
> > I don't think that's an -EEXIST.
> >
> > I think what we have here is kobject_add() exiting with -EINVAL.
> > (kobject attempted to be registered with no name!)
> >
> > [ The first trace on that screen shows: kobject_shadow_add+0x5b/0x189.
> > That's the WARN_ON(1) at lib/kobject.c:176. If it was a EEXIST case,
> > we would've seen an offset in kobject_shadow_add closer to 0x189,
> > because the dump_stack() for EEXIST is barely 4 instructions before
> > we return from that function. ]
> >
> > > > > but the trick is going to be
> > > > > trying to figure out what module is causing this.
> >
> > So I'd guess we want to search for a module that's passing a kobject *
> > to kobject_add() such that !kobj->k_name is true.
>
> Oh, that's kernel_param_sysfs_setup itself. So we actually need to
> search for a built-in module in Michal's config that ... has an ... empty
> "" modname !?

I'll try to figure out this

> Shouldn't that turn up pretty quickly in a grep?
>
> How do I do that, btw?
>

Regards,
Michal

-- 
LOG
http://www.stardust.webpages.pl/log/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/