linux-kernel - Re: 2.6.37-rc7: Regression: b43: crashes in hwrng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D1D3F01.9000502@lwfinger.net>
Date:	Thu, 30 Dec 2010 20:25:05 -0600
From:	Larry Finger <Larry.Finger@...inger.net>
To:	Michael Büsch <mb@...sch.de>
CC:	Mario 'BitKoenig' Holbe <Mario.Holbe@...Ilmenau.DE>,
	LKML <linux-kernel@...r.kernel.org>,
	wireless <linux-wireless@...r.kernel.org>,
	b43-dev <b43-dev@...ts.infradead.org>
Subject: Re: 2.6.37-rc7: Regression: b43: crashes in hwrng_register()

On 12/30/2010 07:57 PM, Michael Büsch wrote:
> On Thu, 2010-12-30 at 21:45 +0100, Mario 'BitKoenig' Holbe wrote: 
>> On Thu, Dec 30, 2010 at 12:37:21PM -0600, Larry Finger wrote:
>>> The head of the rng_list is damaged. It is initialized at compile time and
>>> should be OK. To help discover the order in which hwrng_register() is called,
>>> apply the attached patch. Run it once with commit 84c164a34ffe67908a installed,
>>> and once with it reverted.
>>
>> All right, 3 dmesg excerpts attached...
>> 2.6.37-rc7-vanilla.dmesg:
>> 	2.6.37-rc7 vanilla (i.e. with 84c164a34ffe67908a), crashing
>> 	via-rng is registered first, b43-rng second
>> 2.6.37-rc7-without.dmesg:
>> 	2.6.37-rc7 with 84c164a34ffe67908a reverted, not crashing
>> 	b43-rng is registered first, via-rng second
>> 2.6.37-rc7-without+modprobe.dmesg:
>> 	2.6.37-rc7 with 84c164a34ffe67908a reverted, b43 blacklisted and
>> 	manually modprobed after via-rng, crashing
>> 	via-rng is registered first, b43-rng second
>>
>> Seems like the crash shows up when b43-rng is registered second, but not
>> when via-rng is registered second.
>> Btw.: `cat rng_available' does also not crash when via-rng is registered
>> second.
> 
> 
> I suspect that there is some "hw_random.h" header version mixup is going
> on here. The layout of struct hwrng was changed recently.
> 
> Your crash seems to happen on the list head embedded in struct hwrng.
> 
> Please make sure that your build environment is clean and you're not
> using any external stuff such as compat-wireless. All of hwrng-core,
> rng-via and b43 must be compiled against the same hw_random.h.

AFAIK, he is building with the mainline 2.6.37-rc7/8 tree from Linus, thus the
build should be clean, but thanks for the heads-up.

In an Email from Herbert Xu that did not go to the wireless or b43 lists, it is
suspected that the xstore command on a VIA CPU might generate more than 4 bytes
of output and clobber the list header. We now also know that a second copy of
via-rng will also fail, thus b43 is cleared.

Larry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/