linux-kernel - Re: show_uevent() and general protection fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 13 Jul 2012 16:31:40 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Alan Stern <stern@...land.harvard.edu>,
	Cornelia Huck <cornelia.huck@...ibm.com>,
	Kay Sievers <kay.sievers@...y.org>, devel@...verdev.osuosl.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: show_uevent() and general protection fault

On Fri, Jul 13, 2012 at 03:59:07PM +0800, Fengguang Wu wrote:
> Hi all,
> 
> I can reproduce this all the way back to 3.0 kernel.
> 
> show_uevent():
>         /* copy keys to file */
>         for (i = 0; i < env->envp_idx; i++)
>                 count += sprintf(&buf[count], "%s\n", env->envp[i]);
> 
> [   26.602710] warning: process `trinity-child0' used the deprecated sysctl system call with 
> [   32.747503] general protection fault: 0000 [#1] DEBUG_PAGEALLOC
> [   32.748700] CPU 0 
> [   32.748700] Pid: 84, comm: trinity-child0 Not tainted 3.5.0-rc5+ #51 Bochs Bochs
> [   32.748700] RIP: 0010:[<ffffffff8115a5bd>]  [<ffffffff8115a5bd>] strnlen+0xd/0x40
> [   32.748700] RSP: 0018:ffff880005f87d08  EFLAGS: 00010286
> [   32.748700] RAX: ffffffff81404ed8 RBX: ffff880005fa70e0 RCX: fffffffffffffffe
> [   32.748700] RDX: 3a69706361000000 RSI: ffffffffffffffff RDI: 3a69706361000000
> [   32.748700] RBP: ffff880005f87d08 R08: 000000000000ffff R09: 000000000000ffff
> [   32.748700] R10: ffff880006e8b000 R11: ffff88000005ebc0 R12: 3a69706361000000
> [   32.748700] R13: ffff880085fa70df R14: 000000000000ffff R15: 0000000000000000
> [   32.748700] FS:  00007f177a9d2700(0000) GS:ffffffff81457000(0000) knlGS:0000000000000000
> [   32.748700] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   32.748700] CR2: 0000000002f1b000 CR3: 0000000005f84000 CR4: 00000000000006b0
> [   32.748700] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   32.748700] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [   32.748700] Process trinity-child0 (pid: 84, threadinfo ffff880005f86000, task ffff880006f6c440)
> [   32.748700] Stack:
> [   32.748700]  ffff880005f87d48 ffffffff8115ba8e ffff880006e8b103 ffff880005fa70e0
> [   32.748700]  ffff880085fa70df ffff880005f87de0 ffffffff813eb7c4 ffffffff813eb7c4
> [   32.748700]  ffff880005f87dc8 ffffffff8115c569 ffff880005f87e08 ffffffff810730eb
> [   32.748700] Call Trace:
> [   32.748700]  [<ffffffff8115ba8e>] string.isra.4+0x3e/0xd0
> [   32.748700]  [<ffffffff8115c569>] vsnprintf+0x219/0x600
> [   32.748700]  [<ffffffff810730eb>] ? __lock_acquire.isra.31+0x3eb/0xb30
> [   32.748700]  [<ffffffff8115cd30>] sprintf+0x40/0x50
> [   32.748700]  [<ffffffff811f0dbe>] show_uevent+0xee/0x120
> [   32.748700]  [<ffffffff811118fe>] ? sysfs_read_file+0x3e/0x1a0
> [   32.748700]  [<ffffffff811f0c8b>] dev_attr_show+0x1b/0x60
> [   32.748700]  [<ffffffff81111946>] ? sysfs_read_file+0x86/0x1a0
> [   32.748700]  [<ffffffff8109d7e8>] ? __get_free_pages+0x18/0x80
> [   32.748700]  [<ffffffff81111972>] sysfs_read_file+0xb2/0x1a0
> [   32.748700]  [<ffffffff810cd14f>] vfs_read+0x9f/0x160
> [   32.748700]  [<ffffffff810cd4c8>] sys_read+0x48/0x90
> [   32.748700]  [<ffffffff812b6637>] system_call_fastpath+0x16/0x1b
> [   32.748700] Code: c0 01 80 38 00 75 f7 48 29 f8 5d c3 31 c0 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 f6 48 8d 4e ff 48 89 e5 74 2a <80> 3f 00 74 25 48 89 f8 31 d2 eb 10 0f 1f 80 00 00 00 00 48 83 
> [   32.748700] RIP  [<ffffffff8115a5bd>] strnlen+0xd/0x40
> [   32.748700]  RSP <ffff880005f87d08>

The same config triggered another (related) bug in another run:

[   21.174694] BUG: unable to handle kernel paging request at ffffffff816d6790
[   21.176021] IP: [<ffffffff8115a220>] strlcpy+0x10/0x70
[   21.176021] PGD 1448067 PUD 144c063 PMD 958c063 PTE 16d6162
[   21.176021] Oops: 0000 [#1] DEBUG_PAGEALLOC
[   21.176021] CPU 0
[   21.176021] Pid: 81, comm: trinity-child0 Not tainted 3.5.0-rc5+ #49 Bochs Bochs
[   21.176021] RIP: 0010:[<ffffffff8115a220>]  [<ffffffff8115a220>] strlcpy+0x10/0x70
[   21.176021] RSP: 0018:ffff880005f29e38  EFLAGS: 00010292
[   21.176021] RAX: ffffffff813601a0 RBX: ffff880000070470 RCX: 2222222222222222
[   21.176021] RDX: 0000000000000008 RSI: ffffffff816d6790 RDI: ffff880005f39000
[   21.176021] RBP: ffff880005f29e58 R08: 2222222222222222 R09: 0000000000000000
[   21.176021] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880005f39000
[   21.176021] R13: ffff880005f30b00 R14: 0000000000001ce5 R15: ffff880000072140
[   21.176021] FS:  00007fbb01ca6700(0000) GS:ffffffff81457000(0000) knlGS:0000000000000000
[   21.176021] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   21.176021] CR2: ffffffff816d6790 CR3: 0000000005e9e000 CR4: 00000000000006b0
[   21.176021] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   21.176021] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   21.176021] Process trinity-child0 (pid: 81, threadinfo ffff880005f28000, task ffff880006fa1110)
[   21.176021] Stack:
[   21.176021]  ffffffff811118fe ffff880000070470 ffff880005f39000 ffff880005f30b00
[   21.176021]  ffff880005f29e68 ffffffff81058213 ffff880005f29e88 ffffffff810582d8
[   21.176021]  ffff880005f30b20 ffff880005f29f50 ffff880005f29e98 ffffffff810580d8
[   21.176021] Call Trace:
[   21.176021]  [<ffffffff811118fe>] ? sysfs_read_file+0x3e/0x1a0
[   21.176021]  [<ffffffff81058213>] param_get_string+0x13/0x20
[   21.176021]  [<ffffffff810582d8>] param_attr_show+0x38/0x80
[   21.176021]  [<ffffffff810580d8>] module_attr_show+0x18/0x30
[   21.176021]  [<ffffffff81111972>] sysfs_read_file+0xb2/0x1a0
[   21.176021]  [<ffffffff810cd14f>] vfs_read+0x9f/0x160
[   21.176021]  [<ffffffff810cd4c8>] sys_read+0x48/0x90
[   21.176021]  [<ffffffff812b6637>] system_call_fastpath+0x16/0x1b

Thanks,
Fengguang

View attachment "dmesg-kvm-xbm-3563-2012-07-11-19-52-46" of type "text/plain" (66443 bytes)

View attachment "config-3.5.0-rc5+" of type "text/plain" (38399 bytes)