| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 21 Feb 2008 20:37:08 +0100 (CET)
From: Thomas Gleixner <tglx@...utronix.de>
To: Quel Qun <kelk1@...cast.net>
cc: Dave Young <hidave.darkstar@...il.com>,
Marcel Holtmann <marcel@...tmann.org>,
LKML <linux-kernel@...r.kernel.org>,
Jiri Kosina <jkosina@...e.cz>, Ingo Molnar <mingo@...e.hu>
Subject: Re: Kernel oops with bluetooth usb dongle
On Thu, 21 Feb 2008, Quel Qun wrote:
> > > > Not that I'm aware off, but this might as well be some old use after
> > > > free bug which got exposed by some unrelated change. The good news is
> > > > that it is reproducible. I'll hack up some nasty debug patch which
> > > > lets us - hopefully - decode where the timer was armed.
> > >
> > > Quel, before I do that, is there any chance that you retest with the
> > > latest mainline git version ?
> > >
> > >
> > http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.25-rc2-git4.bz2
> >
> > And please test with this patch as well:
> >
> > http://lkml.org/lkml/2008/2/20/121
> >
> Same kind of result unfortunately with this last patch on top of git4:
At least it is fully reproducible. Please apply the patch below to
your git4 tree and do not change your .config. The output should show,
which code armed the timer.
Thanks,
tglx
Index: linux-2.6/kernel/timer.c
===================================================================
--- linux-2.6.orig/kernel/timer.c
+++ linux-2.6/kernel/timer.c
@@ -58,6 +58,40 @@ EXPORT_SYMBOL(jiffies_64);
#define TVN_MASK (TVN_SIZE - 1)
#define TVR_MASK (TVR_SIZE - 1)
+struct timer_trace {
+ struct timer_list *timer;
+ void *fn;
+ void *addr;
+};
+
+#define TTRACE_SIZE 4096
+static struct timer_trace ttrace[TTRACE_SIZE];
+static int ttrace_idx;
+static DEFINE_SPINLOCK(ttrace_lock);
+
+void ttrace_find_timer(struct timer_list *timer)
+{
+ char symname[KSYM_NAME_LEN];
+
+ unsigned long flags;
+ int i;
+
+ spin_lock_irqsave(&ttrace_lock, flags);
+ for (i = 0; i < TTRACE_SIZE; i++) {
+ if (ttrace[i].timer == timer) {
+ printk(KERN_ERR "TTRACE timer %p fn %p addr %p\n",
+ ttrace[i].timer, ttrace[i].fn, ttrace[i].addr);
+ if (lookup_symbol_name((unsigned long) ttrace[i].fn,
+ symname) == 0)
+ printk(KERN_ERR "TTRACE fn %s\n", symname);
+ if (lookup_symbol_name((unsigned long) ttrace[i].addr,
+ symname) == 0)
+ printk(KERN_ERR "TTRACE addr %s\n", symname);
+ }
+ }
+ spin_unlock_irqrestore(&ttrace_lock, flags);
+}
+
struct tvec {
struct list_head vec[TVN_SIZE];
};
@@ -395,6 +429,13 @@ int __mod_timer(struct timer_list *timer
unsigned long flags;
int ret = 0;
+ spin_lock_irqsave(&ttrace_lock, flags);
+ ttrace[ttrace_idx].timer = timer;
+ ttrace[ttrace_idx].fn = timer->function;
+ ttrace[ttrace_idx].addr = __builtin_return_address(0);
+ ttrace_idx = (ttrace_idx + 1) & (TTRACE_SIZE - 1);
+ spin_unlock_irqrestore(&ttrace_lock, flags);
+
timer_stats_timer_set_start_info(timer);
BUG_ON(!timer->function);
@@ -687,6 +728,14 @@ static unsigned long __next_timer_interr
/* Look for timer events in tv1. */
index = slot = timer_jiffies & TVR_MASK;
do {
+ struct list_head *tmp;
+
+ __list_for_each(tmp, base->tv1.vec + slot) {
+ nte = (struct timer_list *) tmp;
+ if (nte->entry.next == (void *)0x6b6b6b6b)
+ ttrace_find_timer(nte);
+ }
+
list_for_each_entry(nte, base->tv1.vec + slot, entry) {
if (tbase_get_deferrable(nte->base))
continue;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists