linux-kernel - Re: 2.6.37-rc7: Regression: b43: crashes in hwrng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101230231754.GA28335@darkside.kls.lan>
Date:	Fri, 31 Dec 2010 00:17:55 +0100
From:	"Mario 'BitKoenig' Holbe" <Mario.Holbe@...Ilmenau.DE>
To:	Larry Finger <Larry.Finger@...inger.net>
Cc:	Matt Mackall <mpm@...enic.com>,
	Herbert Xu <herbert@...dor.hengli.com.au>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: 2.6.37-rc7: Regression: b43: crashes in hwrng_register()

On Thu, Dec 30, 2010 at 04:49:05PM -0600, Larry Finger wrote:
> Added the two listed maintainers for hardware randon-number generators and
> dropped the wireless and b43 lists.
> 
> Matt and Herbert:
> 
> There is a regression in 2.6.37-rcX relative to 2.6.36. The problem shows as the
> following kernel BUG:
> [   30.313362] BUG: unable to handle kernel paging request at 60870667
> [   30.313372] IP: [<f8f4e3df>] hwrng_register+0x5f/0x14d [rng_core]
> 
> Mario's box with this fault has two RNG devices - b43 and the one provided by
> via-rng. Experimentation has shown that if b43 is registered first, then there
> is no problem; however if via-rng is first, then the above BUG is triggered when
> b43 registers its hardware rng. This problem is a regression in that one of the
> changes in 2.6.37 has b43 registering its rng later in the startup sequence.
...
> Do you see any problems in the code in drivers/net/wireless/b43/main.c or
> drivers/char/hw_random/via-rng.c. As the latter seems to make b43 fail, I am
> suspecting via-rng, but I have no proof.

I believe I can confirm the bug does not directly belong to b43:
I created a second via-rng driver (just copied via-rng.c to via-rng2.c
and changed the via_rng.name) and modprobed it. I blacklisted b43 to
keep it out of the game.

Virtually the same crash dump as with b43 shows up when I modprobe
via-rng2 after via-rng is loaded already.

Attached is a dmesg excerpt from a 2.6.37-rc7 kernel built with Larrys
hwrng_debug patch applied (which basically calls dump_stack() in
hwrng_register()).

objdump of hw_random/core.o:

00000380 <hwrng_register>:
hwrng_register():
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:299
 380:   56                      push   %esi
...
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:315
 3d9:   8b 76 1c                mov    0x1c(%esi),%esi
 3dc:   83 ee 1c                sub    $0x1c,%esi
prefetch():
/tmp/1/linux-source-2.6.37-rc7/arch/x86/include/asm/processor.h:837
 3df:   8b 46 1c                mov    0x1c(%esi),%eax
 3e2:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
hwrng_register():
/tmp/1/linux-source-2.6.37-rc7/drivers/char/hw_random/core.c:315
 3e6:   81 fe f8 ff ff ff       cmp    $0xfffffff8,%esi

hw_random/core.c:
   313          /* Must not register two RNGs with the same name. */
   314          err = -EEXIST;
   315          list_for_each_entry(tmp, &rng_list, list) {
   316                  if (strcmp(tmp->name, rng->name) == 0)
   317                          goto out_unlock;
   318          }


Larry: Thanks for your help!


regards
   Mario
-- 
Goethe war nicht gerne Minister. Er beschaeftigte sich lieber geistig.
                                            -- Lukasburger Stilblueten

View attachment "2.6.37-rc7+via-rng2.dmesg" of type "text/plain" (3963 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (483 bytes)