| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1233698330.8029.12.camel@champagne.cantina>
Date: Tue, 03 Feb 2009 22:58:50 +0100
From: Alessandro Bono <alessandro.bono@...il.com>
To: linux-kernel <linux-kernel@...r.kernel.org>,
linux-ext4@...r.kernel.org
Subject: 2.6.28.3 ext4 ooops
Hi
On newly formatted ext4 usb disk I noticed data corruption after copying
lots of files form a remote server
to verify which files are compromised I tried to md5sum all files with
this command
find software/ -type f -exec md5sum '{}' \;
during md5sum calculation this bug occurred
[ 2975.294886] BUG: unable to handle kernel NULL pointer dereference at
000000000000009c
[ 2975.294897] IP: [<ffffffff8030b5bf>] radix_tree_insert
+0x11d/0x1a8
[ 2975.294913] PGD 124006067 PUD 1169e1067 PMD
0
[ 2975.294921] Oops: 0000 [#1]
SMP
[ 2975.294927] last sysfs
file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map
[ 2975.294932] CPU
0
[ 2975.294936] Modules linked in: ext4 jbd2 crc16 usb_storage libusual
af_packet binfmt_misc rfcomm bridge stp llc bnep sco l2cap acpi_cpufreq
cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand
freq_table cpufreq_conservative sbs sbshc pci_slot ipt_LOG xt_limit
ipt_addrtype xt_state xt_tcpudp xt_conntrack ip6table_filter ip6_tables
ipv6 nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_nat nf_conntrack_ipv4
nf_defrag_ipv4 nf_conntrack_ftp nf_conntrack iptable_filter ip_tables
x_tables ext3 jbd mbcache hp_wmi coretemp sbp2 loop snd_hda_intel arc4
ecb pcmcia snd_hwdep snd_pcm_oss snd_pcm snd_page_alloc iwlagn iTCO_wdt
snd_mixer_oss lis3lv02d sdhci_pci sdhci iwlcore snd_seq_midi snd_rawmidi
yenta_socket snd_seq_dummy leds_hp_disk rsrc_nonstatic rfkill btusb
parport_pc parport snd_seq_oss snd_seq_midi_event video output psmouse
snd_seq snd_timer snd_seq_device mac80211 bluetooth tpm_infineon tpm
tpm_bios iTCO_vendor_support mmc_core ricoh_mmc led_class pcmcia_core
snd cfg80211 serio_raw pcspkr container evdev battery wmi button ac
soundcore dm_multipath xfs sr_mod cdrom sg sd_mod crc_t10dif ata_piix
ahci ohci1394 libata ieee1394 scsi_mod ehci_hcd uhci_hcd e1000e usbcore
dm_crypt dm_mirror dm_region_hash dm_log dm_snapshot dm_mod thermal
processor fan thermal_sys hwmon
fuse
[ 2975.295137] Pid: 8314, comm: md5sum Not tainted 2.6.28.3
#1
[ 2975.295142] RIP: 0010:[<ffffffff8030b5bf>] [<ffffffff8030b5bf>]
radix_tree_insert
+0x11d/0x1a8
[ 2975.295153] RSP: 0018:ffff8801001f78d8 EFLAGS:
00010002
[ 2975.295158] RAX: 0000000000000010 RBX: 0000000000000004 RCX:
ffff8800379e780c
[ 2975.295163] RDX: 0000000000000000 RSI: 0000000000000004 RDI:
ffff8800af1708e0
[ 2975.295168] RBP: ffff8800af1708e0 R08: ffff8801388c5870 R09:
ffff88004972a000
[ 2975.295174] R10: ffff8800af1708b8 R11: ffffffff80304565 R12:
0000000000000010
[ 2975.295179] R13: 0000000000000002 R14: 0000000000000006 R15:
ffff8801058d0600
[ 2975.295185] FS: 00007f7d1cb7a6e0(0000) GS:ffffffff80581040(0000)
knlGS:0000000000000000
[ 2975.295191] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2975.295196] CR2: 000000000000009c CR3: 0000000121df5000 CR4:
00000000000006e0
[ 2975.295201] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2975.295206] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400
[ 2975.295212] Process md5sum (pid: 8314, threadinfo ffff8801001f6000,
task ffff8800a485cc50)
[ 2975.295217] Stack:
[ 2975.295220] ffff880124032150 ffff880124032150 0000000000000000
ffff8800af1708b8
[ 2975.295228] 0000000000000000 ffff8801058d0600 ffff8801240321b8
ffffffff8030468e
[ 2975.295237] ffffffff804f5f80 00000010804f5f80 ffff88004972a000
ffff8801388c5870
[ 2975.295247] Call Trace:
[ 2975.295251] [<ffffffff8030468e>] ? cfq_set_request+0x129/0x313
[ 2975.295262] [<ffffffff802fc1af>] ? get_request+0x1d9/0x287
[ 2975.295270] [<ffffffff802fc28c>] ? get_request_wait+0x2f/0x147
[ 2975.295277] [<ffffffff802b8560>] ? bvec_alloc_bs+0x86/0xc3
[ 2975.295285] [<ffffffff802b860b>] ? bio_alloc_bioset+0x6e/0xc6
[ 2975.295293] [<ffffffff802fc72f>] ? __make_request+0x38b/0x48b
[ 2975.295299] [<ffffffff802bb573>] ? mpage_alloc+0x22/0x78
[ 2975.295307] [<ffffffff802fb21a>] ? generic_make_request+0x27c/0x2bf
[ 2975.295317] [<ffffffff8030b60c>] ? radix_tree_insert+0x16a/0x1a8
[ 2975.295325] [<ffffffffa05ad7d3>] ? ext4_get_block+0x0/0xea [ext4]
[ 2975.295355] [<ffffffff802fb307>] ? submit_bio+0xaa/0xb1
[ 2975.295363] [<ffffffff802bb5eb>] ? mpage_bio_submit+0x22/0x26
[ 2975.295371] [<ffffffff802bc157>] ? mpage_readpages+0xe1/0xf5
[ 2975.295379] [<ffffffffa05ad7d3>] ? ext4_get_block+0x0/0xea [ext4]
[ 2975.295405] [<ffffffff80276aec>] ? __do_page_cache_readahead
+0x108/0x194
[ 2975.295416] [<ffffffff80276e59>] ? ondemand_readahead+0x16f/0x17e
[ 2975.295423] [<ffffffff802713f5>] ? generic_file_aio_read+0x1ff/0x536
[ 2975.295434] [<ffffffff802999d8>] ? do_sync_read+0xce/0x113
[ 2975.295442] [<ffffffff80283025>] ? __vma_link+0x58/0x61
[ 2975.295450] [<ffffffff8028471f>] ? mmap_region+0x3f2/0x51f
[ 2975.295458] [<ffffffff802461cd>] ? autoremove_wake_function+0x0/0x2e
[ 2975.295468] [<ffffffff8029a228>] ? vfs_read+0xa2/0xdb
[ 2975.295475] [<ffffffff8029a31d>] ? sys_read+0x45/0x6e
[ 2975.295482] [<ffffffff8020b49b>] ? system_call_fastpath+0x16/0x1b
[ 2975.295491] Code: 89 74 c3 18 eb 08 48 83 c8 01 48 89 45 08 44 88 f1
4c 89 f8 48 89 f3 48 d3 e8 41 83 ee 06 41 89 c4 41 ff cd 41 83 e4 3f 49
63 c4 <48> 8b 74 c6 18 45 85 ed 75 a3 b8 ef ff ff ff 48 85 f6 75 6b 48
[ 2975.295556] RIP [<ffffffff8030b5bf>] radix_tree_insert+0x11d/0x1a8
[ 2975.295565] RSP <ffff8801001f78d8>
[ 2975.295568] CR2: 000000000000009c
[ 2975.295573] ---[ end trace 171bc727efc84367 ]---
disk is mounted with this options: rw,nosuid,nodev,noatime
dmesg and .config attached
distribution is an ubuntu intrepid
tell me if you need other info
--
---
Cordiali Saluti
Alessandro Bono
View attachment "dmesg-2.6.28.3" of type "text/plain" (55175 bytes)
View attachment "config-2.6.28.3" of type "text/plain" (72217 bytes)
Powered by blists - more mailing lists