linux-kernel - [BUG] Invalid return address of mmap() followed by mbind() in multithreaded context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DFB710D.7000902@cslab.ece.ntua.gr>
Date:	Fri, 17 Jun 2011 18:21:49 +0300
From:	Vasileios Karakasis <bkk@...ab.ece.ntua.gr>
To:	linux-kernel@...r.kernel.org
CC:	linux-mm@...ck.org, linux-numa@...r.kernel.org
Subject: [BUG] Invalid return address of mmap() followed by mbind() in multithreaded
 context

Hi,

I am implementing a multithreaded numa aware code where each thread
mmap()'s an anonymous private region and then mbind()'s it to its local
node. The threads are performing a series of such mmap() + mbind()
operations. My program crashed with SIGSEGV and I noticed that mmap()
returned an invalid address.

I am sending you a simple program that reproduces the error. The program
creates two threads and each thread starts allocating pages and then
binds them to the local node 0. After a number of iterations the program
crashes as it tries to dereference the address returned by mmap(). The
bug doesn't come up when using a single thread, neither when using only
mmap().

I am running a 2.6.39.1 kernel on a 64-bit dual-core machine, but I
tracked this bug back down to the 2.6.34.9 version.

This bug also affects libnuma.

Regards,
-- 
V.K.

#include <assert.h>
#include <sys/mman.h>
#include <pthread.h>
#include <numaif.h>

#define NR_ITER 10240
#define PAGE_SIZE 4096

void *thread_func(void *args)
{
    unsigned char *addr;
    int err, i;
    unsigned long node = 0x1;

    for (i = 0; i < NR_ITER; i++) {
        addr = mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE,
                    MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
        if (addr == (void *) -1) {
            assert(0 && "mmap failed");
        }
        *addr = 0;

        err = mbind(addr, PAGE_SIZE, MPOL_BIND, &node, sizeof(node), 0);
        if (err < 0) {
            assert(0 && "mbind failed");
        }
    }
    return (void *) 0;
}

int main(void)
{
    pthread_t thread;
    pthread_create(&thread, NULL, thread_func, NULL);
    thread_func(NULL);
    pthread_join(thread, NULL);
    return 0;
}

Download attachment "0x17A67A9C.asc" of type "application/pgp-keys" (2813 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)