linux-kernel - Re: vm86.c audit_syscall_exit() call trashes registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070814212858.GB23308@one.firstfloor.org>
Date:	Tue, 14 Aug 2007 23:28:58 +0200
From:	Andi Kleen <andi@...stfloor.org>
To:	William Cattey <wdc@....EDU>
Cc:	Andi Kleen <andi@...stfloor.org>, cra@....EDU,
	linux-kernel@...r.kernel.org
Subject: Re: vm86.c audit_syscall_exit() call trashes registers

On Tue, Aug 14, 2007 at 04:52:54PM -0400, William Cattey wrote:
> The corruption originally looked like a race condition.
> 
> Sometimes the EDID buffer would be all zeros.
> Sometimes it would contain partial data, and then the rest of the  
> buffer filled with zeros.
> The amount of data transferred into the buffer before going to all  
> zeros is non-deterministic.
> 
> When we put a known value in each byte of the buffer before making  
> the vm86 call, the known data would always be overwritten either with  
> EDID data or zeros.

Hmm, that might be consistent with something going wrong with sleeping.
Was the system under high load? Perhaps something else can thrash
some real mode state when you sleep. On the other hand vm86 in user
mode can schedule anyways, so it might have already happened.

But I think the mutex was actually added post 2.6.16 so if you saw
it in 2.6.16 already it might have been something else.

Also when audit is not enabled (did you have it enabled?) the audit
function doesn't do very much?

If you can reliably reproduce it one way might be to comment
out more and more of the audit code until you find who causes
the corruption (that might cause some corrupted audit data,
but that should be fine for testing) 

-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/