linux-kernel - Re: [BUG 2.6.36-rc6] list corruption in module_bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101005110830.GA30583@localhost.pp.htv.fi>
Date:	Tue, 5 Oct 2010 14:08:30 +0300
From:	Adrian Bunk <bunk@...nel.org>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	LKML <linux-kernel@...r.kernel.org>,
	Arnd Bergmann <arnd@...db.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Jeremy Fitzhardinge <jeremy@...p.org>,
	Andrew Morton <akpm@...l.org>
Subject: Re: [BUG 2.6.36-rc6] list corruption in module_bug_finalize

On Tue, Oct 05, 2010 at 02:48:34PM +1030, Rusty Russell wrote:
> On Mon, 4 Oct 2010 06:21:08 am Thomas Gleixner wrote:
> > Current mainline triggers a list corruption bug in
> > module_bug_finalize(). dmesg excerpt below.
> > 
> > The corresponding code says:
> > 
> >         /*
> >          * Strictly speaking this should have a spinlock to protect against
> >          * traversals, but since we only traverse on BUG()s, a spinlock
> >          * could potentially lead to deadlock and thus be counter-productive.
> >          */
> >         list_add(&mod->bug_list, &module_bug_list);
> > 
> > I can see the traversal problem vs. BUG(), but what's protecting the
> > list_add() ? BKL probably did, but is that true anymore ?
> 
> I've never even *seen* this code before :(
> 
> Looks like it went through Adrian Bunk to Andrew,
>...

    [bunk@...sta.de: include/linux/bug.h must always #include <linux/module.h]
    Signed-off-by: Adrian Bunk <bunk@...sta.de>

The commit did not went through me, and I did never review or forward it.

My Signed-off-by: was for the change I sent against the original patch, 
and it was added to the commit when Andrew included my change into the
original patch.

> but despite the fact that
> it (foolishly) doesn't touch kernel/module.c, it's generic code and I should
> have seen it.  It did change the linux/module.h header.
>...

The commit says
    Cc: Rusty Russell <rusty@...tcorp.com.au>

When Andrew submitted it to Linus that should have resulted in an email
to you by the script Andrew uses for submitting patches.

And according to my mail archives that did happen:

Message-Id: <200612081036.kB8AaJDK016473@...ll0.pdx.osdl.net>
Subject: [patch 027/368] Generic BUG implementation
To: torvalds@...l.org
Cc: akpm@...l.org,
    jeremy@...p.org,
    ak@....de,
    benh@...nel.crashing.org,
    bunk@...sta.de,
    hugh@...itas.com,
    michael@...erman.id.au,
    paulus@...ba.org,
    rusty@...tcorp.com.au
From: akpm@...l.org
Date: Fri, 08 Dec 2006 02:36:19 -0800


> Nice catch!
> Rusty.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/