linux-kernel - Re: fs: memory corruption in names

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1406041238380.12633@gentwo.org>
Date:	Wed, 4 Jun 2014 12:41:29 -0500 (CDT)
From:	Christoph Lameter <cl@...two.org>
To:	Jan Kara <jack@...e.cz>
cc:	Sasha Levin <sasha.levin@...cle.com>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	Al Viro <viro@...IV.linux.org.uk>,
	Dave Jones <davej@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Pekka Enberg <penberg@...nel.org>,
	Matt Mackall <mpm@...enic.com>
Subject: Re: fs: memory corruption in names_cache

On Wed, 4 Jun 2014, Jan Kara wrote:

> On Wed 04-06-14 10:33:00, Sasha Levin wrote:
> > Hi all,
> >
> > While fuzzing with trinity inside a KVM tools guest running the latest -next
> > kernel I've stumbled on the following spew:
>   Hum, I'd really suspect more a SLUB bug - the area has poisoning 0x6b
> (POISON_FREE) instead of expected poisoning 0x5a (POISON_INUSE). Or maybe
> I'm just mistaken - could some SLUB guy comment?

Well yes that is really weird. The last byte is 0xa5 (end of object) which
indicates that the padding space has been treated as an object. Could be
metadata corruption. The slab is empty but there is an object allocated in
there???

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/