linux-kernel - Re: aio: compat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B994EFE.70005@msgid.tls.msk.ru>
Date:	Thu, 11 Mar 2010 23:13:50 +0300
From:	Michael Tokarev <mjt@....msk.ru>
To:	Jeff Moyer <jmoyer@...hat.com>
CC:	linux-aio@...ck.org, Linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: aio: compat_ioctl issue?

Jeff Moyer wrote:
> Michael Tokarev <mjt@....msk.ru> writes:
[]
>> And when running real thing it crashes.   I tested it
>> on 2.6.32 (trivial corrections to the patch required).
> 
> Could you just post your version of the patch so I can have a look?

I think there's no need since in 2.6.33 (where your patch applies
without any offsets) it crashes in exactly the same way:

------
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff810bbf37>] generic_segment_checks+0x17/0xd0
PGD 184f1c067 PUD 184cd1067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/input/mice/uevent
CPU 1
Pid: 5182, comm: kvm Not tainted 2.6.33-amd64 #2.6.33.0 M3A78-EM/System Product Name
RIP: 0010:[<ffffffff810bbf37>]  [<ffffffff810bbf37>] generic_segment_checks+0x17/0xd0
RSP: 0000:ffff880184d71d30  EFLAGS: 00010202
RAX: ffff88018f2eeed8 RBX: ffff880184d71da0 RCX: 0000000000000001
RDX: ffff880184d71dd0 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff880184d71dd0 R08: ffffffffffffffea R09: ffff88018f2eef08
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88018cff3e00 R15: ffff880184c49b00
FS:  0000000000000000(0000) GS:ffff880028280000(0063) knlGS:00000000f6f75b70
CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
CR2: 0000000000000008 CR3: 0000000184e9b000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kvm (pid: 5182, threadinfo ffff880184d70000, task ffff880184d6a080)
Stack:
 ffff88018f2eee80 ffff88018f2eee80 ffffffff810be7a2 ffff880184c90a70
<0> ffff88018f2eeed8 ffff880184c91680 ffff880184c91678 000000000000004f
<0> ffffffff81403680 fffffffe7ffbfeff 0000000000000000 0000000000000000
Call Trace:
 [<ffffffff810be7a2>] ? generic_file_aio_read+0x52/0x620
 [<ffffffff810f3296>] ? cache_alloc_refill+0x96/0x5e0
 [<ffffffff810be750>] ? generic_file_aio_read+0x0/0x620
 [<ffffffff81135634>] ? aio_rw_vect_retry+0x74/0x1f0
 [<ffffffff81136e02>] ? aio_run_iocb+0x82/0x140
 [<ffffffff8113777c>] ? do_io_submit+0x2cc/0x7b0
 [<ffffffff81031412>] ? ia32_sysret+0x0/0x5
Code: 82 40 2c 40 81 c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 45 31 d2 48 89 d5 53 48 89 f3 48 8b 36 48 85 f6 0f 84 84 00 00 00 <4c> 8b 57 08 4d 85 d2 0f 88 8c 00 00 00 48 8b 07 65 4c 8b 04 25
RIP  [<ffffffff810bbf37>] generic_segment_checks+0x17/0xd0
 RSP <ffff880184d71d30>
CR2: 0000000000000008
---[ end trace 78b5aba2446c4209 ]---

For 2.6.32, the differences were all in fs/aio.c, in 2
places: include file (obvious),

 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                          struct iocb *iocb, struct hlist_head *batch_hash)

in 2.6.32 it does not have the last 'batch_hash' parameter,
and the only caller of this routine in io_submit() down in
that file.  So the change is trivial and purely mechanical.

But it is not here yet.  I'm trying to dig further...

/mjt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/