linux-kernel - Re: rb tree hrtimer lockup bug (found by perf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1403221118060.18573@ionos.tec.linutronix.de>
Date:	Sat, 22 Mar 2014 11:24:13 +0100 (CET)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	Vince Weaver <vincent.weaver@...ne.edu>
cc:	linux-kernel@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>
Subject: Re: rb tree hrtimer lockup bug (found by perf_fuzzer)

On Fri, 21 Mar 2014, Vince Weaver wrote:

> On Fri, 21 Mar 2014, Thomas Gleixner wrote:
> > 
> > I'm a complete idiot. I was staring at oaddr and did not notice that
> > descr->name is the real culprit. Sorry. Delta patch below.
> 
> OK.  The log was much longer this time, attached.

Hmmm.

[    2.739858] NULL pointer dereference at           (null)
[    2.747390] IP: [<          (null)>]           (null)
[    2.752970] PGD 0
[    2.755287] Oops: 0010 [#1] SMP

So this time the CPU branched to NULL. So let me recap.

First you had the explosion in the hrtimer code. After enabling debug
stuff it went to the timer_list and now it looks different again.

So that looks more like a random memory corruption.

Nasty to debug. And of course it does not reproduce here. I'll throw
your config at more machines in the hope that something will trigger
it.

Thanks,

	tglx


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/