linux-kernel - Re: tty_ldisc_try_get(): BUG kmalloc-8: Poison overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090614123251.GA14785@elte.hu>
Date:	Sun, 14 Jun 2009 14:32:51 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Pekka Enberg <penberg@...helsinki.fi>
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>, linux-kernel@...r.kernel.org,
	Vegard Nossum <vegard.nossum@...il.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Subject: Re: tty_ldisc_try_get(): BUG kmalloc-8: Poison overwritten


* Ingo Molnar <mingo@...e.hu> wrote:

> --- a/drivers/char/tty_ldisc.c
> +++ b/drivers/char/tty_ldisc.c
> @@ -361,6 +361,7 @@ void tty_ldisc_deref(struct tty_ldisc *ld)
>  	unsigned long flags;
>  
>  	BUG_ON(ld == NULL);
> +	WARN_ON_ONCE(ld->refcount == (int)0xa56b6b6b);
>  
>  	spin_lock_irqsave(&tty_ldisc_lock, flags);

this does trigger:

[   70.198553] PM: Adding info for No Bus:vcsa2
[   70.223956] ------------[ cut here ]------------
[   70.233266] warning: `sudo' uses deprecated v2 capabilities in a way that may be insecure.
[   70.242894] WARNING: at drivers/char/tty_ldisc.c:364 tty_ldisc_deref+0x30/0x90()
[   70.242894] Modules linked in:
[   70.242894] Pid: 4252, comm: modprobe Not tainted 2.6.30-tip #746
[   70.242894] Call Trace:
[   70.242894]  [<413da1b0>] ? tty_ldisc_deref+0x30/0x90
[   70.242894]  [<41035c79>] warn_slowpath_common+0x49/0x60
[   70.242894]  [<41035c9d>] warn_slowpath_null+0xd/0x10
[   70.242894]  [<413da1b0>] tty_ldisc_deref+0x30/0x90
[   70.242894]  [<413d53ee>] tty_write+0x8e/0xa0
[   70.242894]  [<413d545f>] redirected_tty_write+0x5f/0x70
[   70.242894]  [<410b9002>] vfs_write+0x82/0xe0
[   70.242894]  [<413d5400>] ? redirected_tty_write+0x0/0x70
[   70.242894]  [<410b90fb>] sys_write+0x3b/0x60
[   70.242894]  [<4100388f>] sysenter_do_call+0x12/0x3c
[   70.242894]  [<4104007b>] ? timer_stats_timer_set_start_info+0xb/0x10
[   70.242894]  [<4104007b>] ? timer_stats_timer_set_start_info+0xb/0x10
[   70.242894] ---[ end trace 03c5764c731fa31f ]---
[   71.663044] device: 'vcs7': device_add

i suspect the swarm of mingetty's starting up during bootup is 
triggering some race.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/