linux-kernel - Re: [3.1-rc6] kmalloc(64) leak from IDE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110927170755.GA31384@gere.osrc.amd.com>
Date:	Tue, 27 Sep 2011 19:07:55 +0200
From:	Borislav Petkov <bp@...en8.de>
To:	Simon Kirby <sim@...tway.ca>
Cc:	linux-kernel@...r.kernel.org, linux-ide@...r.kernel.org
Subject: Re: [3.1-rc6] kmalloc(64) leak from IDE

(forgot to Cc linux-ide earlier, sorry)

On Mon, Sep 26, 2011 at 01:05:50AM -0700, Simon Kirby wrote:
> Ok, good. It's still running without any problem, and no new leaks
> reported.

Ok.

[..]

> > backporting it to -stable is a good point. I'll add the proper tagging
> > to the patch.
> 
> Do you know in which version the issue started, then?
> 
> If not, all I have to start with is that it was fine on 2.6.36, and I can
> bisect it, if that would help.

This is exactly the question: AFAICT, it could be that changes in the
block layer at some point have caused the ide bust and since almost no
one tests ide...

The patch adding the dynamic ide_cmd struct allocation is
395d8ef5bebe547a80737692f9789d2e36da16f2 from 2008 and I don't think it
caused the issue then but I could also be remembering it wrong.

So I wouldn't bisect it but test stable trees after 2.6.36 to see
whether they have the issue, and if so, only then the patch should be
backported.

And this is not that easy now with k.org down but looking at

http://web.archive.org/web/20110725015737/http://kernel.org/

the only stable trees which need to be tested are 2.6.39 and 3.0.

How does that sound?

-- 
Regards/Gruss,
Boris.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/