linux-kernel - Re: I just got got another Oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 Mar 2009 11:55:09 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	Gene Heskett <gene.heskett@...il.com>
Cc:	David Newall <davidn@...idnewall.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: I just got got another Oops

On Thu, 12 Mar 2009 14:31:49 -0400
Gene Heskett <gene.heskett@...il.com> wrote:

> Mar 12 14:15:02 coyote kernel: [ 2656.832669]
> Mar 12 14:15:02 coyote kernel: [ 2656.832672] Pid: 18877, comm: kmail Not tainted (2.6.29-rc7 #5) System Product Name
> Mar 12 14:15:02 coyote kernel: [ 2656.832675] EIP: 0060:[<c046520b>] EFLAGS: 00210202 CPU: 0
> Mar 12 14:15:02 coyote kernel: [ 2656.832678] EIP is at get_page_from_freelist+0x24b/0x4c0
> Mar 12 14:15:02 coyote kernel: [ 2656.832680] EAX: ffffffff EBX: 80004000 ECX: 00000001 EDX: 00000002
> Mar 12 14:15:02 coyote kernel: [ 2656.832682] ESI: c28fc260 EDI: 00000000 EBP: f2168d5c ESP: f2168cfc
> Mar 12 14:15:02 coyote kernel: [ 2656.832684]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Mar 12 14:15:02 coyote kernel: [ 2656.832686] Process kmail (pid: 18877, ti=f2168000 task=f22018b0 task.ti=f2168000)
> Mar 12 14:15:02 coyote kernel: [ 2656.832688] Stack:
> Mar 12 14:15:02 coyote kernel: [ 2656.832689]  00000002 00000044 c28fc060 00000000 f1463ca4 c0744b80 c06d6480 00000002
> Mar 12 14:15:02 coyote kernel: [ 2656.832693]  00000000 00000000 001201d2 00000002 00200246 00000001 c06d6900 00000100
> Mar 12 14:15:02 coyote kernel: [ 2656.832698]  00000000 80000000 c06d7484 c06d6480 c06d6480 c06d6480 f22018b0 00000129

Added linux-mm to CC:

22a9:	8b 1e         mov    (%esi),%ebx                            #ebx=80004000 = page->flags
22ab:	89 f2         mov    %esi,%edx                              #remember "page"
22ad:	8b 46 08      mov    0x8(%esi),%eax                         #esi+8=-1  page->mapcount
22b0:	8b 7e 10      mov    0x10(%esi),%edi                        #esi+16=0  page->mapping
22b3:	f6 c7 40      test   $0x40,%bh
22b6:	74 03         je     22bb <get_page_from_freelist+0x24b>
22b8:	8b 56 0c      mov    0xc(%esi),%edx                         #page = page->first_page
22bb:	8b 4a 04      mov    0x4(%edx),%ecx                         #page->_count
 
Thank you for disassemble list, from above....

In prep_new_page()
 610 static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
 611 {
 612         if (unlikely(page_mapcount(page) |
 613                 (page->mapping != NULL)  |
 614                 (page_count(page) != 0)  |
 615                 (page->flags & PAGE_FLAGS_CHECK_AT_PREP)))
 616                 bad_page(page);

 page->mapping = NULL,  (VALID)
 page->mapcount = -1    (VALID)
 page->count ==> NULL access because PageTail() is set, see below.
 (Note: from .config, CONFIG_PAGEFLAGS_EXTENDED is set.)

==
 288 static inline int page_count(struct page *page)
 289 {
 290         return atomic_read(&compound_head(page)->_count);
 291 }

 281 static inline struct page *compound_head(struct page *page)
 282 {
 283         if (unlikely(PageTail(page)))
 284                 return page->first_page;
 285         return page;
 286 }
==

PageTail() is true (this is invalid) and page->first_page contains obsolete data.
But, here, PG_tail should not be there...

Hmm ?

Regards,
-Kame






--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/