linux-kernel - Re: ath9k: BUG kmalloc-8192: Poison overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4BECB1F2.5050900@gmail.com>
Date:	Thu, 13 May 2010 19:14:10 -0700
From:	"Justin P. Mattock" <justinmattock@...il.com>
To:	"Luis R. Rodriguez" <lrodriguez@...eros.com>
CC:	Luis Rodriguez <Luis.Rodriguez@...eros.com>,
	Bruno Randolf <br1@...fach.org>,
	"linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: ath9k: BUG kmalloc-8192: Poison overwritten

On 05/13/10 18:45, Luis R. Rodriguez wrote:
> On Thu, May 13, 2010 at 06:43:11PM -0700, Luis Rodriguez wrote:
>> On Thu, May 13, 2010 at 06:26:04PM -0700, Justin P. Mattock wrote:
>>> On 05/13/10 18:23, Luis R. Rodriguez wrote:
>>>> On Thu, May 13, 2010 at 06:13:18PM -0700, Justin P. Mattock wrote:
>>>>> On 05/13/10 18:08, Bruno Randolf wrote:
>>>>>> On Friday 14 May 2010 09:50:51 Justin P. Mattock wrote:
>>>>>>> On 05/13/10 17:28, Luis R. Rodriguez wrote:
>>>>>>>> On Thu, May 13, 2010 at 5:21 PM, Justin P. Mattock
>>>>>>>>
>>>>>>>> <justinmattock@...il.com>     wrote:
>>>>>>>>> On 05/13/10 16:01, Luis R. Rodriguez wrote:
>>>>>>>>>> On Thu, May 13, 2010 at 3:17 PM, Justin P. Mattock
>>>>>>>>>>
>>>>>>>>>> <justinmattock@...il.com>       wrote:
>>>>>>>>>>> not sure what this is, but while at a convention
>>>>>>>>>>> I was trying to access the internet and(below is
>>>>>>>>>>> full dmesg) this showed up.
>>>>>>>>>>>
>>>>>>>>>>> After receiving this, I sat and tried to re-create
>>>>>>>>>>> my steps to reproduce but had no luck(was even going
>>>>>>>>>>> todo a bisect n the spot if I could re-create).
>>>>>>>>>>
>>>>>>>>>> OK this stuff is hard to reproduce it seems.. you have an Atheros
>>>>>>>>>> AR5418 MAC/BB Rev:2 AR5133 RF Rev:81, what kconfig option do you use
>>>>>>>>>> to get the poison stuff? I am just surprised we haven't seen it
>>>>>>>>>> ourselves yet. Let me make sure all of us get this kconfig option
>>>>>>>>>> enabled.
>>>>>>>>>>
>>>>>>>>>>       Luis
>>>>>>>>>
>>>>>>>>> CONFIG_ATH_COMMON=m
>>>>>>>>> # CONFIG_ATH_DEBUG is not set
>>>>>>>>> CONFIG_ATH5K=m
>>>>>>>>> # CONFIG_ATH5K_DEBUG is not set
>>>>>>>>> CONFIG_ATH9K_HW=m
>>>>>>>>> CONFIG_ATH9K_COMMON=m
>>>>>>>>> CONFIG_ATH9K=m
>>>>>>>>> # CONFIG_ATH9K_DEBUGFS is not set
>>>>>>>>>
>>>>>>>>> if you need my .config let me know.
>>>>>>>>> (I can try again reproducing, but man
>>>>>>>>> just doesn't easily fire off).
>>>>>>>>
>>>>>>>> Oh I mean the config options to enable the poison rant.
>>>>>>>>
>>>>>>>>       Luis
>>>>>>>
>>>>>>> shoot.. not sure how to grep for the right info
>>>>>>> in the .config for you, heres what grepping for COFIG_DEBUG
>>>>>>> looks like:
>>>>>>> CONFIG_DEBUG_FS=y
>>>>>>> CONFIG_DEBUG_KERNEL=y
>>>>>>> CONFIG_DEBUG_RT_MUTEXES=y
>>>>>>> CONFIG_DEBUG_PI_LIST=y
>>>>>>> CONFIG_DEBUG_SPINLOCK=y
>>>>>>> CONFIG_DEBUG_MUTEXES=y
>>>>>>> CONFIG_DEBUG_BUGVERBOSE=y
>>>>>>> CONFIG_DEBUG_MEMORY_INIT=y
>>>>>>> CONFIG_DEBUG_STACKOVERFLOW=y
>>>>>>
>>>>>> oh, this reminds me of a similar report we had for ath5k:
>>>>>>
>>>>>> https://bugzilla.kernel.org/show_bug.cgi?id=15861
>>>>>>
>>>>>> the subject on this mailing list was "ath5k misbehaving affecting other kernel
>>>>>> parts unrelated?"
>>>>>>
>>>>>> bruno
>>>>>>
>>>>>
>>>>> Could be.. From what I remember
>>>>> all I was doing was switching from
>>>>> one wireless network to another
>>>>> (then opening firefox to sign my life away).
>>>>
>>>> Were you using network-manager? Or the supplicant manually?
>>>>
>>>>     Luis
>>>>
>>>
>>> I've got wicd(1.5.9) manager
>>> running over here.
>>
>> Can you try this:
>>
>> diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
>> index 8c79548..a372f2c 100644
>> --- a/drivers/net/wireless/ath/ath9k/init.c
>> +++ b/drivers/net/wireless/ath/ath9k/init.c
>> @@ -599,6 +599,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
>>   	 */
>>   	ath_read_cachesize(common,&csz);
>>   	common->cachelsz = csz<<  2; /* convert to bytes */
>> +	printk("ATH9K: cachelsz: %d\n", common->cachelsz);
>>
>>   	/* Initializes the hardware for all supported chipsets */
>>   	ret = ath9k_hw_init(ah);
>>
>>
>> Would like to see what you get there on dmesg upon load.
>
> Actually don't bother I just realized you can get this with
> ATH_DBG_CONFIG enabled.
>
>                  ath_print(common, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
>                                  common->cachelsz, common->rx_bufsize);
>
>
> This is already in the code so just
>
> modprobe ath9k debug=0x00000200
>
>    Luis
>


what I can try, is(not at the convention, on eth0
at the moment), but when I get back to the convention
center place I can try your patch as well as the
modprobe option, to see if I can get any signs of
a recreation(if so I'll bisect there).

Justin P. Mattock
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/