linux-kernel - Re: Linux 3.4 released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120522155345.GC14339@google.com>
Date:	Tue, 22 May 2012 08:53:45 -0700
From:	Tejun Heo <tj@...nel.org>
To:	Jörg-Volker Peetz <jvpeetz@....de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Linux 3.4 released

Hello,

On Tue, May 22, 2012 at 05:30:37PM +0200, Jörg-Volker Peetz wrote:
> Switching from self-compiled kernel 3.2 17 to a self compiled kernel 3.4.0,
> a notebook HP Pavilion dv7 gets hard locked with a kernel panic, when trying to
> start a web-cam video viewer (guvcview) for the built-in USB web-cam.
> 
> Please find attached a (hand-typed) screen-shot of the text-console and the
> kernel config.
> 
> By the way, thank you for all the great work on Linux.
> -- 
> Best regards,
> Jörg-Volker.

> BUG: Unable to handle kernel NULL pointer dereference at 0000000000000008
...
> Code: 8b 7c 24 50 48 83 c4 58 c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 8b 0f 31 c0 48 89 fa 48 89 ce 40 80 e6 00 83 e1 04 48 0f 45 c6 <48> 8b 70 08 65 8b 3c 25 60 cc 00 00 e9 b9 fc ff ff 66 0f 1f 84
> RIP  [<ffffffff8103ed46>] delayed_work_timer_fn+0x16/0x30

So, that looks like get_work_cwq() returning NULL and then
delayed_work_timer_fn() trying to dereference it.  Either work item is
being corrupted (e.g. freed early) or somebody is mucking with the
work item embedded in a delayed work item.

Something like the following may reveal the offending work function.

Thanks.

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 5abf42f..adc1057 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1101,6 +1101,10 @@ static void delayed_work_timer_fn(unsigned long __data)
 	struct delayed_work *dwork = (struct delayed_work *)__data;
 	struct cpu_workqueue_struct *cwq = get_work_cwq(&dwork->work);
 
+	if (!cwq)
+		printk("XXX delayed_work_timer_fn: NULL cwq, fn=%pf\n",
+		       dwork->work.func);
+
 	__queue_work(smp_processor_id(), cwq->wq, &dwork->work);
 }
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/