linux-kernel - Re: 3.15: kernel BUG at kernel/auditsc.c:1525!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Jun 2014 17:38:31 +0200
From:	Toralf Förster <toralf.foerster@....de>
To:	Andy Lutomirski <luto@...capital.net>,
	Richard Weinberger <richard@....at>,
	"H. Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>
CC:	Eric Paris <eparis@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: 3.15: kernel BUG at kernel/auditsc.c:1525!

On 06/16/2014 11:35 PM, Andy Lutomirski wrote:
> [cc: hpa, x86 list]
> 
> On Mon, Jun 16, 2014 at 1:43 PM, Richard Weinberger <richard@....at> wrote:
>> Am 16.06.2014 22:41, schrieb Toralf Förster:
>>> Well, might be the mail:subject should be adapted, b/c the issue can be triggered in a 3.13.11 kernel too.
>>> Unfortunately it does not appear within an UML guest, therefore an automated bisecting isn't possible I fear.
>>
>> You could try KVM. :)
> 
> Before you do that, just to clarify:
> 
> What bitness is your kernel?  That is, are you on 32-bit or 64-bit kernel?
> 
> What bitness is your test case?  'file a.out' will say.
> 
> What does /proc/cpuinfo say in flags?
> 

tfoerste@n22 ~/tmp $ uname -a                 
Linux n22 3.15.1 #4 SMP Tue Jun 17 17:22:22 CEST 2014 i686 Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz GenuineIntel GNU/Linux
tfoerste@n22 ~/tmp $ file a.out               
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, not stripped
tfoerste@n22 ~/tmp $ cat /proc/cpuinfo           
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 42
model name      : Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz
stepping        : 7
microcode       : 0x29
cpu MHz         : 800.000
cache size      : 3072 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 2
apicid          : 0
initial apicid  : 0
fdiv_bug        : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx rdtscp lm constant_tsc arch_perfmon pebs bts xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm ida arat epb xsaveopt pln pts dtherm tpr_shadow vnmi flexpriority ept vpid
bogomips        : 5183.33
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management:


> Can you try the attached patch?  It's only compile-tested.
> 
applied both on top of 3.14.8 and 3.15.1 - issue solved 
Thx

> To hpa, etc:  It appears that entry_32.S is missing any call to the
> audit exit hook on the badsys path.  If I'm diagnosing this bug report
> correctly, this causes OOPSes.
> 
> The the world at large: it's increasingly apparent that no one (except
> maybe the blackhats) has ever scrutinized the syscall auditing code.
> This is two old severe bugs in the code that have probably been there
> for a long time.

and now there are 2 less than before - this is the good news, or ?


-- 
Toralf

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/