linux-kernel - Re: kernel 2.6.39 (user mode linux) crashes (2.6.38 works fine)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BANLkTikfaKJfnDwQoFi9WLX6q+2HHe90HQ@mail.gmail.com>
Date:	Fri, 20 May 2011 18:24:56 +0200
From:	richard -rw- weinberger <richard.weinberger@...il.com>
To:	Toralf Förster <toralf.foerster@....de>
Cc:	Steven Rostedt <rostedt@...dmis.org>,
	LKML <linux-kernel@...r.kernel.org>,
	user-mode-linux-devel@...ts.sourceforge.net
Subject: Re: kernel 2.6.39 (user mode linux) crashes (2.6.38 works fine)

2011/5/20 Toralf Förster <toralf.foerster@....de>:
>
> richard -rw- weinberger wrote at 09:56:02
>> 2011/5/20 Toralf Förster <toralf.foerster@....de>:
>> > ...
>> > Kernel panic - not syncing: Kernel mode fault at addr 0x0, ip 0x80a9f6b
>>
>> Looks like a NULL-pointer bug.
>> What code is at address 80a9f6b?
>> Use "objdump -d -S | less" to find it.
>        if (unlikely(ret != 0))
>  80a9f3a:       85 c0                   test   %eax,%eax
>  80a9f3c:       75 ca                   jne    80a9f08 <futex_wake+0x18>
>                goto out;
>
>        hb = hash_futex(&key);
>  80a9f3e:       8d 45 e8                lea    -0x18(%ebp),%eax
>  80a9f41:       e8 aa f6 ff ff          call   80a95f0 <hash_futex>
>  80a9f46:       89 c2                   mov    %eax,%edx
>        spin_lock(&hb->lock);
>        head = &hb->chain;
>
>        plist_for_each_entry_safe(this, next, head, list) {
>  80a9f48:       8b 48 08                mov    0x8(%eax),%ecx
>  80a9f4b:       83 c2 08                add    $0x8,%edx
>  80a9f4e:       8d 41 f4                lea    -0xc(%ecx),%eax
>  80a9f51:       39 ca                   cmp    %ecx,%edx
>  80a9f53:       8b 70 0c                mov    0xc(%eax),%esi
>  80a9f56:       74 6a                   je     80a9fc2 <futex_wake+0xd2>
>  80a9f58:       89 d9                   mov    %ebx,%ecx
>  80a9f5a:       83 ee 0c                sub    $0xc,%esi
>  80a9f5d:       89 d3                   mov    %edx,%ebx
>  80a9f5f:       89 fa                   mov    %edi,%edx
>  80a9f61:       89 cf                   mov    %ecx,%edi
>  80a9f63:       eb 12                   jmp    80a9f77 <futex_wake+0x87>
>  80a9f65:       8d 76 00                lea    0x0(%esi),%esi
>  80a9f68:       8d 46 0c                lea    0xc(%esi),%eax
>  80a9f6b:       8b 4e 0c                mov    0xc(%esi),%ecx


Here in futex_wake() happens a NULL pointer dereference.
Steve, any ideas?

-- 
Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/