| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <giobtsxldu.fsf@mx10.gouders.net> Date: Wed, 25 Jan 2012 08:59:57 +0100 From: Dirk Gouders <gouders@...bocholt.fh-gelsenkirchen.de> To: Vivek Goyal <vgoyal@...hat.com> Cc: Suresh Jayaraman <sjayaraman@...e.com>, LKML <linux-kernel@...r.kernel.org>, Tejun Heo <tj@...nel.org>, Jens Axboe <axboe@...nel.dk> Subject: Re: Slab corruption in floppy driver module Vivek Goyal <vgoyal@...hat.com> writes: > On Tue, Jan 24, 2012 at 06:49:37PM +0530, Suresh Jayaraman wrote: > > [..] > >> [ 33.372026] ffff88041dd9be08 ffffffff8134f517 ffff88041dd9be28 >> ffff88041da9bc68 >> [ 33.372026] Call Trace: >> [ 33.372026] [<ffffffff81243a15>] blk_put_queue+0x15/0x20 >> [ 33.372026] [<ffffffff8124d4ff>] disk_release+0x8f/0xd0 >> [ 33.372026] [<ffffffff8134f517>] device_release+0x27/0xa0 >> [ 33.372026] [<ffffffff812754fd>] kobject_cleanup+0x6d/0x1b0 >> [ 33.372026] [<ffffffff8127564d>] kobject_release+0xd/0x10 >> [ 33.372026] [<ffffffff81276b17>] kref_put+0x37/0x70 >> [ 33.372026] [<ffffffff81275387>] kobject_put+0x27/0x60 >> [ 33.372026] [<ffffffff8124dbf7>] put_disk+0x17/0x20 >> [ 33.372026] [<ffffffffa00fa92c>] floppy_init+0x1c1/0x675 [floppy] >> [ 33.372026] [<ffffffffa00fae37>] floppy_module_init+0x57/0x220 [floppy] >> [ 33.372026] [<ffffffff810001d3>] do_one_initcall+0x43/0x180 >> [ 33.372026] [<ffffffff810a526d>] sys_init_module+0xcd/0x240 >> [ 33.372026] [<ffffffff8148d4c2>] system_call_fastpath+0x16/0x1b >> [ 33.372026] [<00007f86dce3406a>] 0x7f86dce34069 >> [ 33.372026] Code: eb cc 48 89 fe 31 c0 48 c7 c7 60 aa 7a 81 e8 26 c4 20 00 >> e8 92 c1 20 00 eb 8e 55 48 89 e5 53 48 89 fb 48 83 ec 08 48 85 ff 74 16 <f6> 47 >> 3c 01 74 19 48 8d 7b 38 48 c7 c6 40 56 27 81 e8 59 17 00 >> [ 33.372026] RIP [<ffffffff81275371>] kobject_put+0x11/0x60 >> [ 33.372026] RSP <ffff88041dd9bda8> >> [ 33.372026] CR2: ffff88041d986c9c >> [ 33.372026] ---[ end trace f624c17dc6e4672a ]--- >> --- cut-here --- >> >> What seems to be happening is after commit f992ae80, add_disk takes a >> extra reference to the queue which is supposed to be put in disk_release(). >> In floppy_init() when there were "no floppy controllers found" the control >> goes to out_flush_work. Note that add_disk() is not being called at all and >> so extra reference not taken. We try to put_disk() and the call sequence is >> put_disk() >> kobject_put() >> kref_put() >> kobject_release() >> kobject_cleanup() >> device_release() >> disk_release() >> blk_put_queue() <-- put without a get >> kobject_put() >> >> >> Reverting f992ae80 makes the oops and the slab corruption messages disappear. >> The "no floppy controllers found" message was found in the dmesg. > > I am wondering if extra queue reference for gendisk should be taken by driver > and not by add_disk(). Why? Because disk->queue association is setup by > driver and not by add_disk(). That way even if we don't call, add_disk(), > we should be fine. I also noticed this problem about two weeks ago (https://lkml.org/lkml/2012/1/10/177) -- the mentioned commit 523e1d399c seems to be identical to f992ae80. Perhaps, it is helpful to notice that I also played with this on a machine that _has_ a floppy controler and if the floppy driver is loaded as a module on boot, then unloaded and reloaded it also outputs error messages, i.e. re-loading the module also causes problems. Thanks, Dirk -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists