linux-kernel - Re: 2.6.37-rc7: Regression: b43: crashes in hwrng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D1CD161.4040107@lwfinger.net>
Date:	Thu, 30 Dec 2010 12:37:21 -0600
From:	Larry Finger <Larry.Finger@...inger.net>
To:	Mario 'BitKoenig' Holbe <Mario.Holbe@...Ilmenau.DE>,
	LKML <linux-kernel@...r.kernel.org>,
	wireless <linux-wireless@...r.kernel.org>,
	b43-dev <b43-dev@...ts.infradead.org>
Subject: Re: 2.6.37-rc7: Regression: b43: crashes in hwrng_register()

On 12/30/2010 08:34 AM, Mario 'BitKoenig' Holbe wrote:
> On Wed, Dec 29, 2010 at 08:37:10PM -0600, Larry Finger wrote:
>> No, don't bother. I do have a different request. The byte counts for my 32-bit
>> system do not match yours. Could you please use the following command to find
>> the instructions that are failing?
>>
>> objdump -l -d drivers/char/hw_random/core.o | less
>>
>> Use the search to find the start of hwrng_register, then add 0x4c to the
>> starting address. Once I see hte instruction that is failing, I should be able
>> to find where the failure occurs.
> 
> Alright, here we go...
> 
> [   30.012695] BUG: unable to handle kernel paging request at 4b28f458
> [   30.012708] IP: [<f90703cc>] hwrng_register+0x4c/0x139 [rng_core]
> 
> 00000380 <hwrng_register>:
> hwrng_register():
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:299
>  380:   56                      push   %esi
>  381:   53                      push   %ebx
> ...
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:312
>  3c6:   8b 76 1c                mov    0x1c(%esi),%esi
>  3c9:   83 ee 1c                sub    $0x1c,%esi
> prefetch():
> /tmp/1/linux-source-2.6.37-rc7/arch/x86/include/asm/processor.h:837
>  3cc:   8b 46 1c                mov    0x1c(%esi),%eax
>  3cf:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
> hwrng_register():
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:312
>  3d3:   81 fe f8 ff ff ff       cmp    $0xfffffff8,%esi
>  3d9:   75 d4                   jne    3af <hwrng_register+0x2f>
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:319
> 
>    312		list_for_each_entry(tmp, &rng_list, list) {
>    313			if (strcmp(tmp->name, rng->name) == 0)
>    314				goto out_unlock;
>    315		}
> 
> This is btw. the same data that is accessed in the cat rng_available
> crash via hwrng_attr_available_show():
> 
> [  389.303538] BUG: unable to handle kernel paging request at 288dcb5b                              
> [  389.303553] IP: [<f8dda34c>] hwrng_attr_available_show+0x5c/0x90 [rng_core]                      
> 
> 000002f0 <hwrng_attr_available_show>:
> hwrng_attr_available_show():
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:236
>  2f0:   55                      push   %ebp
> ...
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:245
>  346:   8b 5b 1c                mov    0x1c(%ebx),%ebx
>  349:   83 eb 1c                sub    $0x1c,%ebx
> prefetch():
> /tmp/1/linux-source-2.6.37-rc7/arch/x86/include/asm/processor.h:837
>  34c:   8b 43 1c                mov    0x1c(%ebx),%eax
>  34f:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
> hwrng_attr_available_show():
> /tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:245
> 
>    245		list_for_each_entry(rng, &rng_list, list) {
>    246			strncat(buf, rng->name, PAGE_SIZE - ret - 1);
>    247			ret += strlen(rng->name);
>    248			strncat(buf, " ", PAGE_SIZE - ret - 1);
>    249			ret++;
>    250		}

The head of the rng_list is damaged. It is initialized at compile time and
should be OK. To help discover the order in which hwrng_register() is called,
apply the attached patch. Run it once with commit 84c164a34ffe67908a installed,
and once with it reverted.

Thanks,

Larry




View attachment "hwrng_debug" of type "text/plain" (823 bytes)