linux-kernel - [slab corruption] BUG key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090115181612.GA27762@elte.hu>
Date:	Thu, 15 Jan 2009 19:16:12 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	linux-kernel@...r.kernel.org
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Pekka Enberg <penberg@...helsinki.fi>,
	David Howells <dhowells@...hat.com>,
	Michael LeMay <mdlemay@...ch.ncsc.mil>,
	James Morris <jmorris@...ei.org>,
	Stephen Smalley <sds@...ho.nsa.gov>,
	Paul Moore <paul.moore@...com>, Eric Paris <eparis@...hat.com>
Subject: [slab corruption] BUG key_jar: Poison overwritten


-tip testing found the rather scary looking slab corruption:

[   35.419875] CPU0 attaching sched-domain:
[   35.420101]  domain 0: span 0-1 level CPU
[   35.425883]   groups: 0 1
[   35.428527] CPU1 attaching sched-domain:
[   35.432010]  domain 0: span 0-1 level CPU
[   35.437729]   groups: 1 0
[   37.380005] eth0: no IPv6 routers present
[   44.478286] =============================================================================
[   44.482064] BUG key_jar: Poison overwritten
[   44.482064] -----------------------------------------------------------------------------
[   44.482064] 
[   44.482064] INFO: 0xf5f320c0-0xf5f320c0. First byte 0x6a instead of 0x6b
[   44.482064] INFO: Allocated in key_alloc+0xe7/0x30e age=291 cpu=1 pid=2815
[   44.482064] INFO: Freed in key_cleanup+0xd8/0xdd age=292 cpu=1 pid=2520
[   44.482064] INFO: Slab 0xc1f9cfb8 objects=21 used=2 fp=0xf5f320c0 flags=0x400000c3
[   44.482064] INFO: Object 0xf5f320c0 @offset=192 fp=0xf5f32240
[   44.482064] 
[   44.482064] Bytes b4 0xf5f320b0:  7c 05 ff ff 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a |.��ZZZZZZZZZZZZ
[   44.482064]   Object 0xf5f320c0:  6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f320d0:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f320e0:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f320f0:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f32100:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f32110:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f32120:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f32130:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[   44.482064]   Object 0xf5f32140:  6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5             kkkkkkkkkkk�    
[   44.482064]  Redzone 0xf5f3214c:  bb bb bb bb                                     ����            
[   44.482064]  Padding 0xf5f32174:  5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a             ZZZZZZZZZZZZ    
[   44.482064] Pid: 2832, comm: sudo Not tainted 2.6.29-rc1-tip-01097-gf5d0b1b-dirty #16445
[   44.482064] Call Trace:
[   44.482064]  [<c018e25c>] print_trailer+0xcd/0xd5
[   44.482064]  [<c018e2dc>] check_bytes_and_report+0x78/0x94
[   44.482064]  [<c018e55c>] check_object+0xa9/0x191
[   44.482064]  [<c018eff3>] __slab_alloc+0x365/0x42c
[   44.482064]  [<c0144dda>] ? trace_hardirqs_off+0xb/0xd
[   44.482064]  [<c018f369>] kmem_cache_alloc+0x64/0xc1
[   44.482064]  [<c02d040e>] ? key_alloc+0xe7/0x30e
[   44.482064]  [<c02d040e>] ? key_alloc+0xe7/0x30e
[   44.482064]  [<c02d040e>] key_alloc+0xe7/0x30e
[   44.482064]  [<c02d1429>] keyring_alloc+0x24/0x58
[   44.482064]  [<c02d2781>] install_session_keyring_to_cred+0x43/0x92
[   44.482064]  [<c02d2d61>] lookup_user_key+0xe0/0x30b
[   44.482064]  [<c02d17ab>] keyctl_get_keyring_ID+0x12/0x2e
[   44.482064]  [<c02d22c2>] sys_keyctl+0x36/0xe3
[   44.482064]  [<c0102d55>] sysenter_do_call+0x12/0x35
[   44.482064] FIX key_jar: Restoring 0xf5f320c0-0xf5f320c0=0x6b
[   44.482064] 
[   44.482064] FIX key_jar: Marking all objects used

Config attached. The system seemed to stay intact after this incident.

	Ingo

View attachment "config" of type "text/plain" (68746 bytes)