linux-kernel - Re: [bug, netconsole, SLUB] BUG skbuff_head

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19f34abd0807171705h31595809y944792ce697bede7@mail.gmail.com>
Date:	Fri, 18 Jul 2008 02:05:39 +0200
From:	"Vegard Nossum" <vegard.nossum@...il.com>
To:	"Ingo Molnar" <mingo@...e.hu>
Cc:	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	"Pekka Enberg" <penberg@...helsinki.fi>,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: [bug, netconsole, SLUB] BUG skbuff_head_cache: Poison overwritten

On Fri, Jul 18, 2008 at 1:52 AM, Ingo Molnar <mingo@...e.hu> wrote:
>  If only we had some kernel technology that could track and validate
>  memory accesses, and point out the cases where we access uninitialized
>  memory, just like Valgrind?
>
> ... something like kmemcheck? ;-)

Cool :)

> So i booted that box with tip/master and kmemcheck enabled. (plus a few
> fixlets to make networking allocations be properly tracked by
> kmemcheck.)
>
> It was a slow bootup and long wait, but it gave a few hits here:

Hm, if you think it was that slow, I am suspecting you were also using
SLUB debugging.

This can actually be negative, since now SLUB will access the objects
(+redzone +padding) and possibly trick kmemcheck into thinking they
were initialized in the first place.

But what we are really looking for is "read from freed memory"
messages. So I would actually recommend this: Disable kmemcheck's
reporting of uninitialized memory, simply to make it easier to spot
the "freed" messages more easily.

Maybe something like this (warning: whitespace-munged):

diff --git a/arch/x86/mm/kmemcheck/error.c b/arch/x86/mm/kmemcheck/error.c
index 56410c6..6944cb7 100644
--- a/arch/x86/mm/kmemcheck/error.c
+++ b/arch/x86/mm/kmemcheck/error.c
@@ -98,6 +98,9 @@ void kmemcheck_error_save(enum kmemcheck_shadow state,
                return;
        prev_ip = regs->ip;

+       if (state == KMEMCHECK_SHADOW_UNINITIALIZED)
+               return;
+
        e = error_next_wr();
        if (!e)
                return;


If this only happens during boot, it would also be a good idea to
simply reboot the machine a lot...


Vegard

-- 
"The animistic metaphor of the bug that maliciously sneaked in while
the programmer was not looking is intellectually dishonest as it
disguises that the error is the programmer's own creation."
	-- E. W. Dijkstra, EWD1036
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/