linux-kernel - Re: iwlagn: memory corruption with WPA enterprise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111121134056.GB4010@redhat.com>
Date:	Mon, 21 Nov 2011 14:40:57 +0100
From:	Stanislaw Gruszka <sgruszka@...hat.com>
To:	Tomáš Janoušek <tomi@...i.cz>
Cc:	linux-kernel@...r.kernel.org, Wey-Yi Guy <wey-yi.w.guy@...el.com>,
	linux-wireless@...r.kernel.org
Subject: Re: iwlagn: memory corruption with WPA enterprise

On Mon, Nov 21, 2011 at 02:09:16PM +0100, Tomáš Janoušek wrote:
> On Mon, Nov 21, 2011 at 02:05:28PM +0100, Stanislaw Gruszka wrote:
> > The farther we get the problem is more and more strange.
> > 
> > Device that write to wrong address, would generate:
> > 
> > DMAR:[DMA Write] Request device [00:02.0] fault addr 6df084000
> > DMAR:[fault reason 05] PTE Write access is not set
> 
> And that's exactly what happens if I don't disable firewire-ohci, because of
> that stupid Ricoh multifunction blah blah issue.

So maybe problem is caused by Ricoh, not by iwlagn. But if so 
why blacklisting iwlagn help? Wired. Did you disable firewire in
BIOS, or just blacklist module?

> > Try "dmesg | grep DMAR" to see if DMA remapping is really is
> > in use. 
> 
> Well, this message is not printed, but as I said, loading firewire-ohci
> triggers DMAR faults, so it should be in use anyway.

So IOMMU is in use and it does not prevent corruption, crap.

Ok maybe let's try to find some better reproducer first.
I wrote simple program that fill memory with some pattern, and
then check every one second if pattern is still there.
It can be used like:
./checkmem 100M 30M
where first argument is size of memory it will alloc and check,
second specify number of internal loops to make cpu busy (bigger
value will cause more cpu power consumption). Many instances of
the program can be running at once.

Tomáš, please try to reproduce with that program, I'm attaching
it. When corruption will be detected, checkmem will print invalid
values, maybe would be possible to find out what contents is
written to memory.

Stanislaw

View attachment "checkmem.c" of type "text/plain" (2338 bytes)