linux-kernel - Re: boot crash in arp_error_report() (Re: [GIT] Networking)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 May 2010 21:47:17 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Ingo Molnar <mingo@...e.hu>, David Miller <davem@...emloft.net>,
	Thomas Gleixner <tglx@...utronix.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	netdev@...r.kernel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: boot crash in arp_error_report() (Re: [GIT] Networking)

Le jeudi 27 mai 2010 à 12:27 -0700, Linus Torvalds a écrit :
> 
> On Thu, 27 May 2010, Ingo Molnar wrote:
> > 
> > FYI, this boot crash in arp_error_report() started triggering in -tip testing:
> > 
> > [  113.285384] BUG: unable to handle kernel paging request at 6b6b6b87
> 
> That's the POISON_FREE signature, with an offset of 28 (0x1c).
> 
> And it looks like the whole function got captured in the Code: sequence. 
> It looks like this:
> 
>    0:	55                   	push   %ebp
>    1:	89 e5                	mov    %esp,%ebp
>    3:	53                   	push   %ebx
>    4:	0f 1f 44 00 00       	nopl   0x0(%eax,%eax,1)
>    9:	89 d3                	mov    %edx,%ebx
>    b:	89 d0                	mov    %edx,%eax
>    d:	e8 fa fb ff ff       	call   0xfffffc0c		# skb_dst()
>   12:	85 c0                	test   %eax,%eax		# dst
>   14:	74 12                	je     0x28
>   16:	8b 40 40             	mov    0x40(%eax),%eax		# dst->ops
>   19:	85 c0                	test   %eax,%eax
>   1b:	74 0b                	je     0x28
>   1d:*	8b 50 1c             	mov    0x1c(%eax),%edx     <-- trapping instruction
>   20:	85 d2                	test   %edx,%edx
>   22:	74 04                	je     0x28
>   24:	89 d8                	mov    %ebx,%eax
>   26:	ff d2                	call   *%edx			# dst->ops->link_failure()
>   28:	89 d8                	mov    %ebx,%eax
>   2a:	e8 9b 50 fa ff       	call   0xfffa50ca		# skb_free()
>   2f:	5b                   	pop    %ebx
>   30:	5d                   	pop    %ebp
>   31:	c3                   	ret    
> 
> Where most of it is "dst_link_failure()" being inlined (that last "callq" 
> is the call to kfree_skb().
> 
> Looks like 'dst' points to free'd memory, so when we load a pointer from 
> it (the dst->ops) field, we get 0x6b6b6b6b, and then when we try to load
> dst->ops->link_failure it oopses.
> 
> tl;dr: that
> 
> 	struct dst_entry *dst = skb_dst(skb);
> 
> in dst_link_failure seems to result in a stale skb.
> 
> 		Linus
> --

I am looking at this bug report, as I am probably at fault, please give
me one or two hour ;)

Thanks


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/