linux-kernel - [BUG][kprobes][vunmap?]: kprobes may cause memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <497FC3B1.7050805@redhat.com>
Date:	Tue, 27 Jan 2009 21:32:17 -0500
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Nick Piggin <npiggin@...e.de>,
	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
CC:	LKML <linux-kernel@...r.kernel.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Jim Keniston <jkenisto@...ibm.com>,
	systemtap-ml <systemtap@...rces.redhat.com>,
	"Frank Ch. Eigler" <fche@...hat.com>
Subject: [BUG][kprobes][vunmap?]: kprobes may cause memory corruption

Hi

I found that 2.6.28-rc1+ kernel might cause a random memory corruption
including double fault when repeating load/unload kprobe-using module on
i386 with CONFIG_HIGHMEN4G=y.

I narrowed it down by git-bisect and found that after below commit
caused this bug.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db64fe02258f1507e13fe5212a989922323685ce

I also reported details of this bug on the below bugzilla.
http://sources.redhat.com/bugzilla/show_bug.cgi?id=9740

I'm still investigating the root cause of this bug. I just made a
ad-hoc bugfix patch which just changes text_poke() to work as
before above commit(as far as I tested, it just works for me).

A set of test code which written in plain c is attached,
make genkprobe.ko and run testmod.sh, then the bug will
be occurred.

Thanks,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com

View attachment "genkprobe.c" of type "text/plain" (24865 bytes)

Download attachment "testmod.sh" of type "application/x-shellscript" (119 bytes)