linux-kernel - Re: linux-next: Tree for June 3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.00.1006041255210.8175@i5.linux-foundation.org>
Date:	Fri, 4 Jun 2010 13:04:00 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Tony Luck <tony.luck@...el.com>
cc:	Rusty Russell <rusty@...tcorp.com.au>,
	Dave Young <hidave.darkstar@...il.com>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	linux-next@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: linux-next: Tree for June 3

On Fri, 4 Jun 2010, Tony Luck wrote:
> 
> At the point of dereference it looks like we were trying
> to load a 4-byte data object from offset 552 into the
> "struct module *" that wa returned by load_module().

Sounds like 'mod->num_ctors' loaded by do_mod_ctors(). It's a 4-byte field 
in roughly that area.

What does a NaT consumption fault mean, and does it give the invalid 
address it was loaded off? In the successful path of "load_module()", we 
will have dereferenced the "mod" pointer we return just before, so I 
wonder if there's some error case that incorrectly returns a positive 
errno instead of a negative one, and causes us to miss the "IS_ERR()" 
check or something.

There's a couple of checking routines in module.c that do not return a 
negative error, but instead return 0/1. The one I looked at was converted 
into a negative error, but there are several cases of

	if (err)
		return ERR_PTR(err)

and if something does that on a 0/1 value, it will return a bogus pointer.

		Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/