linux-kernel - Re: ath9k: BUG kmalloc-8192: Poison overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4BECEBB9.8030704@gmail.com>
Date:	Thu, 13 May 2010 23:20:41 -0700
From:	"Justin P. Mattock" <justinmattock@...il.com>
To:	"Luis R. Rodriguez" <lrodriguez@...eros.com>
CC:	Luis Rodriguez <Luis.Rodriguez@...eros.com>,
	Bruno Randolf <br1@...fach.org>,
	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: ath9k: BUG kmalloc-8192: Poison overwritten

On 05/13/10 23:16, Luis R. Rodriguez wrote:
> On Thu, May 13, 2010 at 9:44 PM, Justin P. Mattock
> <justinmattock@...il.com>  wrote:
>> On 05/13/10 21:01, Luis R. Rodriguez wrote:
>>>
>>> On Thu, May 13, 2010 at 7:14 PM, Justin P. Mattock
>>> <justinmattock@...il.com>    wrote:
>>>
>>>>
>>>> what I can try, is(not at the convention, on eth0
>>>> at the moment), but when I get back to the convention
>>>> center place I can try your patch as well as the
>>>> modprobe option, to see if I can get any signs of
>>>> a recreation(if so I'll bisect there).
>>>
>>> The debug info I just need upon load of the module, I don't need you
>>> to run the debug stuff to try to reproduce. The debug print upon load
>>> will tell us the rxbuf size and cache line size.
>>>
>>>    Luis
>>>
>>
>> o.k. it's not pretty due
>> to loads of avc's for SELinux:
>> (I run a rootless system).
>>
>> [   84.172649] ath9k: Driver unloaded
>> [  100.675300] audit_printk_skb: 6 callbacks suppressed
>> [  100.675306] type=1400 audit(1273811633.675:20): avc:  denied  { search }
>> for  pid=2168 comm="modprobe" name="modules" dev=sda3 ino=2500
>> scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=system_u:object_r:modules_object_t:s0 tclass=dir
>> [  100.675408] type=1400 audit(1273811633.675:20): avc:  denied  { search }
>> for  pid=2168 comm="modprobe" name="2.6.34-rc7-00057-gcdfda35" dev=sda3
>> ino=524392 scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=name:object_r:modules_object_t:s0 tclass=dir
>> [  100.675552] type=1400 audit(1273811633.675:20): avc:  denied  { read }
>> for  pid=2168 comm="modprobe" name="modules.dep.bin" dev=sda3 ino=525251
>> scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=name:object_r:modules_object_t:s0 tclass=file
>> [  100.675598] type=1400 audit(1273811633.675:20): avc:  denied  { open }
>> for  pid=2168 comm="modprobe" name="modules.dep.bin" dev=sda3 ino=525251
>> scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=name:object_r:modules_object_t:s0 tclass=file
>> [  100.675748] type=1300 audit(1273811633.675:20): arch=c000003e syscall=2
>> success=yes exit=3 a0=60d140 a1=0 a2=1b6 a3=0 items=0 ppid=2080 pid=2168
>> auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0
>> ses=1 comm="modprobe" exe="/sbin/modprobe" subj=name:staff_r:staff_sudo_t:s0
>> key=(null)
>> [  100.675902] type=1400 audit(1273811633.675:21): avc:  denied  { getattr }
>> for  pid=2168 comm="modprobe"
>> path="/lib/modules/2.6.34-rc7-00057-gcdfda35/modules.dep.bin" dev=sda3
>> ino=525251 scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=name:object_r:modules_object_t:s0 tclass=file
>> [  100.676052] type=1300 audit(1273811633.675:21): arch=c000003e syscall=5
>> success=yes exit=0 a0=3 a1=7fffd2d1dd70 a2=7fffd2d1dd70 a3=0 items=0
>> ppid=2080 pid=2168 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
>> fsgid=0 tty=pts0 ses=1 comm="modprobe" exe="/sbin/modprobe"
>> subj=name:staff_r:staff_sudo_t:s0 key=(null)
>> [  100.698392] ath9k 0000:03:00.0: PCI INT A ->  GSI 17 (level, low) ->  IRQ
>> 17
>> [  100.698409] ath9k 0000:03:00.0: setting latency timer to 64
>> [  100.828787] ath: EEPROM regdomain: 0x64
>> [  100.828790] ath: EEPROM indicates we should expect a direct regpair map
>> [  100.828793] ath: Country alpha2 being used: 00
>> [  100.828795] ath: Regpair used: 0x64
>> [  100.848609] type=1400 audit(1273811633.678:22): avc:  denied  { search }
>> for  pid=2168 comm="modprobe" name="ieee80211" dev=debugfs ino=18
>> scontext=name:staff_r:staff_sudo_t:s0
>> tcontext=system_u:object_r:debugfs_t:s0 tclass=dir
>> [  100.848788] phy1: Selected rate control algorithm 'ath9k_rate_control'
>> [  100.850035] Registered led device: ath9k-phy1::radio
>> [  100.850488] Registered led device: ath9k-phy1::assoc
>> [  100.851227] Registered led device: ath9k-phy1::tx
>> [  100.851633] Registered led device: ath9k-phy1::rx
>> [  100.851640] phy1: Atheros AR5418 MAC/BB Rev:2 AR5133 RF Rev:81
>> mem=0xffffc900005a0000, irq=17
>> [  100.852240] type=1300 audit(1273811633.678:22): arch=c000003e syscall=175
>> success=yes exit=0 a0=7f1e9d6ab010 a1=19580 a2=60d920 a3=0 items=0 ppid=2080
>> pid=2168 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
>> tty=pts0 ses=1 comm="modprobe" exe="/sbin/modprobe"
>> subj=name:staff_r:staff_sudo_t:s0 key=(null)
>>
>> but there you go dmesg of the debug info for you
>
> Justin, did you forget to use the debug parameter on modprobe ath9k?
>
> modprobe ath9k debug=0x0000020
>
> I do not see the output I expected.
>
>    Luis
>

no.. I used your code
literally i.g. just copied and
pasted as is.

I can give that a try again
and see.Before though what
kernel parameters/kconfig might I be missing
just to be sure?

Justin P. Mattock
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/