linux-kernel - Re: oops in tracepoint_update_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49C1F1DF.2020105@cn.fujitsu.com>
Date:	Thu, 19 Mar 2009 15:18:55 +0800
From:	Lai Jiangshan <laijs@...fujitsu.com>
To:	Jaswinder Singh Rajput <jaswinder@...nel.org>
CC:	Ingo Molnar <mingo@...e.hu>, Steven Rostedt <rostedt@...dmis.org>,
	Frédéric Weisbecker <fweisbec@...il.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	x86 maintainers <x86@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
Subject: Re: oops in tracepoint_update_probe_range()

Ingo Molnar wrote:
> * Jaswinder Singh Rajput <jaswinder@...nel.org> wrote:
> 
>> Good: f4c3c4cdb1de232
>> Bad : 1e08816af0bc345
>>
>> Config:
>> http://userweb.kernel.org/~jaswinder/oops_20090318/config-hpdv5-tip-bad-20090318
>>
>> oops:
>> http://userweb.kernel.org/~jaswinder/oops_20090318/oops_page1.jpg
>> http://userweb.kernel.org/~jaswinder/oops_20090318/oops_page2.jpg
>> http://userweb.kernel.org/~jaswinder/oops_20090318/oops_page3.jpg
>> http://userweb.kernel.org/~jaswinder/oops_20090318/oops_page4.jpg
>>
>> <freeze>
> 
> Steve, Frederic - the crashes above are in:
> 
> 	tracepoint_update_probe_range()
> 
> in a modular kernel apparently.
> 
>

I look up the jpg files, this oops is occurred when a new module is
being loaded.

tracepoint_module_notify() is added by Mathieu Desnoyers on the
suggestion of me.

tracepoint_update_probe_range() and tracepoint_module_notify()
can not trigger this oops if the arguments are correct.

If @begin is NULL, @end is NULL too, it's ensued by kernel/module.c.

load_module(...):
	mod->tracepoints = section_objs(hdr, sechdrs, secstrings,
					"__tracepoints",
					sizeof(*mod->tracepoints),
					&mod->num_tracepoints);
static void *section_objs(...)
{
	unsigned int sec = find_sec(hdr, sechdrs, secstrings, name);

	/* Section 0 has sh_addr 0 and sh_size 0. */
	*num = sechdrs[sec].sh_size / object_size;
	return (void *)sechdrs[sec].sh_addr;
}

If the module has not "__tracepoints" section, find_sec() returns 0.
So I think, sechdrs[0].sh_size is corrupted.

Is the following fix fixed the oops for you?
---
diff --git a/kernel/module.c b/kernel/module.c
index 7fa134e..2ee47ff 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1950,6 +1950,7 @@ static noinline struct module *load_module(void __user *umod,
 	sechdrs = (void *)hdr + hdr->e_shoff;
 	secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
 	sechdrs[0].sh_addr = 0;
+	sechdrs[0].sh_size = 0;
 
 	for (i = 1; i < hdr->e_shnum; i++) {
 		if (sechdrs[i].sh_type != SHT_NOBITS


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/