linux-kernel - Kernel oops in sym_int

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4FA143BC.2010702@canonical.com>
Date:	Wed, 02 May 2012 16:25:00 +0200
From:	Stefan Bader <stefan.bader@...onical.com>
To:	linux-scsi@...r.kernel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
CC:	Matthew Wilcox <matthew@....cx>,
	Stefan Bader <stefan.bader@...onical.com>
Subject: Kernel oops in sym_int_sir

While looking at a bug report [1] I found that the immediate cause of the crash
was in that specific case the reference cp->cmd for a printk:

/*
  * The device didn't switch to MSG IN phase after
  * having reselected the initiator.
  */
 case SIR_RESEL_NO_MSG_IN:
         scmd_printk(KERN_WARNING, cp->cmd,
                         "No MSG IN phase after reselection\n");
         goto out_stuck;

Unfortunately cp (that is returned by sym_ccb_from_dsa()) is NULL. This probably
is as old as 2.6.24 when this patch added the scmd_printk:

commit 3fb364e089e05c35ead55a08d56d3004193681f6
Author: Matthew Wilcox <matthew@....cx>
Date: Fri Oct 5 15:55:10 2007 -0400

    [SCSI] sym53c8xx: Use scmd_printk where appropriate

A quick research looks like it might be other cases where this happened[2].
Maybe more often (or solely?) when running in a VM (KVM). I even found some post
that looks like it tries to fix just this problem[3].

However without more knowledge about that driver it could also be a problem in
the hardware emulation so that normally cp == NULL should never happen. Or it
might be that the emulation is just running sufficiently "different" to cause
races to happen which never would be observed on real hardware.

Would [3] still make sense?

Thanks,
Stefan

[1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/992328
[2] http://www.mail-archive.com/kvm@vger.kernel.org/msg08927.html
[3] https://lkml.org/lkml/2010/11/18/495

Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)