linux-kernel - Bisected regression in Linux 3.7.0-rc1, hang on login caused by replace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121015171437.32e9a4ac@mj>
Date:	Mon, 15 Oct 2012 17:14:37 -0400
From:	Pavel Roskin <proski@....org>
To:	Al Viro <viro@...iv.linux.org.uk>, linux-kernel@...r.kernel.org
Subject: Bisected regression in Linux 3.7.0-rc1, hang on login caused by
 replace_fd()

Hello!

I tried the current mainline Linux on Fedora 16 x64_64 and found that I
cannot login in gdm.  I'm using gdm with LXDE.  After a few minutes,
kernel messages appear indicating a hung process gnome-settings-daemon.

Bisection found that the commit to blame is

commit 8280d16172243702ed43432f826ca6130edb4086
Author: Al Viro <viro@...iv.linux.org.uk>
Date:   Tue Aug 21 12:11:46 2012 -0400

    new helper: replace_fd()

    analog of dup2(), except that it takes struct file * as source.

    Signed-off-by: Al Viro <viro@...iv.linux.org.uk>

Reverting the part of the patch that changes fs/exec.c is sufficient to
fix the login behavior.

I was able to forward port the change to the current mainline Linux.
The call to replace_fd() was moved to fs/coredump.c, so the patch
changes it.  Also, it copies __clear_close_on_exec() and
__set_open_fd() from fs/file.c

The .config file, the kernel log and the forward ported patch are
attached.

I'll try to figure out why replace_fd() is not good in
umh_pipe_setup(), but I'd like to report the problem as soon as
possible, as it's very visible to the users and I don't want others to
spend hours bisecting it.

-- 
Regards,
Pavel Roskin

Download attachment "dotconfig" of type "application/octet-stream" (78210 bytes)

View attachment "kernel.log" of type "text/x-log" (194528 bytes)

View attachment "revert-replace_fd.patch" of type "text/x-patch" (2659 bytes)