| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 14 May 2015 19:00:57 +0300
From: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
To: Tony Luck <tony.luck@...el.com>,
Anton Vorontsov <anton@...msg.org>,
linux-kernel@...r.kernel.org, Kees Cook <keescook@...omium.org>,
Colin Cross <ccross@...roid.com>,
Aruna Balakrishnaiah <aruna@...ux.vnet.ibm.com>
Subject: Re: [PATCH] pstore: do not use message compression without lock
On 21.04.2015 14:32, Konstantin Khlebnikov wrote:
> pstore_compress() uses static stream buffer for zlib-deflate which
> easily crashes when several concurrent threads use one shared state.
>
> Signed-off-by: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
> ---
> fs/pstore/platform.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
> index c4c9a10c5760..de525ec0b490 100644
> --- a/fs/pstore/platform.c
> +++ b/fs/pstore/platform.c
> @@ -299,7 +299,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
> bool compressed;
> size_t total_len;
>
> - if (big_oops_buf) {
> + if (big_oops_buf && is_locked) {
> dst = big_oops_buf;
> hsize = sprintf(dst, "%s#%d Part%u\n", why,
> oopscount, part);
>
Bump
Example of crash:
<1>[ 3579.939946] BUG: unable to handle kernel paging request at
0000000081eea3dc
<1>[ 3579.939951] IP: [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.939953] PGD 0
<4>[ 3579.939954] Oops: 0000 [#1] SMP
<4>[ 3579.939970] Modules linked in: netconsole configfs 8021q mrp garp
stp llc x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
crc32_pclmul ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw
gf128mul glue_helper aes_x86_64 microcode sb_edac edac_core ipmi_si
ipmi_msghandler ast ttm drm_kms_helper drm sysimgblt sysfillrect
syscopyarea lpc_ich mlx4_en mlx4_core vxlan udp_tunnel ip6_udp_tunnel
tcp_htcp igb dca i2c_algo_bit isci i2c_core ptp libsas ahci pps_core
scsi_transport_sas libahci raid10 raid456 async_pq async_xor xor
async_memcpy async_raid6_recov raid6_pq async_tx raid1 raid0 multipath
linear
<4>[ 3579.939972] CPU: 12 PID: 0 Comm: swapper/12 Tainted: G W
3.18.11-11 #4
<4>[ 3579.939974] task: ffff883fd2e4baa0 ti: ffff881fd31fc000 task.ti:
ffff881fd31fc000
<4>[ 3579.939976] RIP: 0010:[<ffffffff81382274>] [<ffffffff81382274>]
zlib_tr_tally+0xe4/0x130
<4>[ 3579.939976] RSP: 0018:ffff88407fc86ae8 EFLAGS: 00010016
<4>[ 3579.939977] RAX: 000000000000006c RBX: ffff881fd0080000 RCX:
ffff881fd0087348
<4>[ 3579.939978] RDX: 00000000fffffffc RSI: 000000000000003f RDI:
ffff881fd0080000
<4>[ 3579.939978] RBP: ffff88407fc86ae8 R08: 000000000000006d R09:
0000000000000041
<4>[ 3579.939978] R10: ffff881fd0081748 R11: 0000000000000000 R12:
0000000000000577
<4>[ 3579.939979] R13: 0000000000003ae1 R14: 0000000000000005 R15:
ffff881fd00700c8
<4>[ 3579.939980] FS: 0000000000000000(0000) GS:ffff88407fc80000(0000)
knlGS:0000000000000000
<4>[ 3579.939980] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[ 3579.939981] CR2: 0000000081eea3dc CR3: 0000000001c14000 CR4:
00000000001407e0
<4>[ 3579.939981] Stack:
<4>[ 3579.939982] ffff88407fc86b18 ffffffff8137ef38 ffff881fd0080000
ffffffff81ee4340
<4>[ 3579.939983] 0000000000000005 0000000000000f00 ffff88407fc86b48
ffffffff8137fa23
<4>[ 3579.939984] ffff883fcff90000 0000000000000010 0000000000000002
0000000000000fc1
<4>[ 3579.939985] Call Trace:
<4>[ 3579.939986] <NMI>
<4>[ 3579.939987] [<ffffffff8137ef38>] deflate_slow+0x218/0x420
<4>[ 3579.939989] [<ffffffff8137fa23>] zlib_deflate+0xc3/0x400
<4>[ 3579.939993] [<ffffffff812de50e>] pstore_dump+0x26e/0x410
<4>[ 3579.939997] [<ffffffff810b0da7>] kmsg_dump+0x127/0x160
<4>[ 3579.939998] [<ffffffff810febe2>] watchdog_overflow_callback+0xa2/0xc0
<4>[ 3579.940001] [<ffffffff8113a3a8>] __perf_event_overflow+0x98/0x230
<4>[ 3579.940004] [<ffffffff8102c34a>] ?
x86_perf_event_set_period+0xda/0x150
<4>[ 3579.940005] [<ffffffff8113ae04>] perf_event_overflow+0x14/0x20
<4>[ 3579.940007] [<ffffffff810338c9>] intel_pmu_handle_irq+0x1d9/0x3c0
<4>[ 3579.940009] [<ffffffff81182641>] ?
unmap_kernel_range_noflush+0x11/0x20
<4>[ 3579.940011] [<ffffffff813f9768>] ? ghes_copy_tofrom_phys+0x118/0x1f0
<4>[ 3579.940013] [<ffffffff8102b694>] perf_event_nmi_handler+0x34/0x60
<4>[ 3579.940014] [<ffffffff81018b9a>] nmi_handle+0x8a/0x150
<4>[ 3579.940016] [<ffffffff813fa600>] ?
ghes_print_estatus.constprop.12+0x70/0x70
<4>[ 3579.940017] [<ffffffff81019266>] default_do_nmi+0x56/0x160
<4>[ 3579.940018] [<ffffffff81019400>] do_nmi+0x90/0xd0
<4>[ 3579.940020] [<ffffffff816d34e1>] end_repeat_nmi+0x1e/0x2e
<4>[ 3579.940023] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940024] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940026] [<ffffffff813c67cc>] ? intel_idle+0xcc/0x150
<4>[ 3579.940027] <<EOE>>
<4>[ 3579.940029] [<ffffffff81574787>] cpuidle_enter_state+0x57/0x1d0
<4>[ 3579.940030] [<ffffffff815749c7>] cpuidle_enter+0x17/0x20
<4>[ 3579.940032] [<ffffffff810a893f>] cpu_startup_entry+0x34f/0x3d0
<4>[ 3579.940034] [<ffffffff810cd772>] ?
clockevents_register_device+0xe2/0x140
<4>[ 3579.940036] [<ffffffff8104632c>] start_secondary+0x14c/0x160
<4>[ 3579.940046] Code: 1f 84 00 00 00 00 00 8b 87 f0 16 00 00 83 e8 01
41 39 c0 0f 94 c0 0f b6 c0 5d c3 0f 1f 40 00 89 d2 83 87 18 17 00 00 01
83 ee 01 <0f> b6 82 e0 a3 ee 81 66 83 84 87 c0 04 00 00 01 81 fe ff 00 00
<1>[ 3579.940047] RIP [<ffffffff81382274>] zlib_tr_tally+0xe4/0x130
<4>[ 3579.940048] RSP <ffff88407fc86ae8>
<4>[ 3579.940048] CR2: 0000000081eea3dc
--
Konstantin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists