linux-kernel - Re: [PATCH] vmcore: prevent PT_NOTE p_memsz overflow during header update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140203170526.GB10795@redhat.com>
Date:	Mon, 3 Feb 2014 12:05:26 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	"Pearson, Greg" <greg.pearson@...com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"d.hatayama@...fujitsu.com" <d.hatayama@...fujitsu.com>,
	"holzheu@...ux.vnet.ibm.com" <holzheu@...ux.vnet.ibm.com>,
	"dhowells@...hat.com" <dhowells@...hat.com>,
	"paul.gortmaker@...driver.com" <paul.gortmaker@...driver.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] vmcore: prevent PT_NOTE p_memsz overflow during header
 update

On Mon, Feb 03, 2014 at 04:57:56PM +0000, Pearson, Greg wrote:

[..]
> > So I will not be too worried about skipping seemingly corrupted ELf
> > notes. I think giving a warning makes sense though. Is somebody
> > overwriting the memory area in kenrel reserved for per cpu PT_NOTE.
> 
> I haven't figured out the cause of the strange second PT_NOTE entries 
> yet, but I suspect some type of memory corruption.

Hi Greg,

May be put some printk() in crash_save_cpu() and make sure that at
creation time notes are being created properly. That will atleast
make clear whether elf notes were not created properly or they got
corrupted later.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/