linux-kernel - Re: crash by cdc_acm driver in kernels 4.8-rc1/5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1475054164.4635.7.camel@suse.com>
Date:   Wed, 28 Sep 2016 11:16:04 +0200
From:   Oliver Neukum <oneukum@...e.com>
To:     wim@....tudelft.nl
Cc:     linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: crash by cdc_acm driver in kernels 4.8-rc1/5

On Tue, 2016-09-27 at 18:34 +0200, Wim Osterholt wrote:
> On Thu, Sep 22, 2016 at 04:40:50PM +0200, Oliver Neukum wrote:
> > 
> > dmesg -c
> > echo 9 > /proc/sysrq-trigger
> > modprobe cdc_acm
> > echo "module cdc_acm +mpf" > /sys/kernel/debug/dynamic_debug/control
> > 
> > [plug your device in]
> > 
> > and provide the full output of dmesg after that.
> 
> After some experimenting I succeeded in grabbing it over the serial port.
> The console was immedately frozen, but the serial port kept working:

Very good. This is a valid oops. We can do two things. When I
decode it, seems to crash in acm_alloc_minor() which does not make
sense. It is likely that our kernels or compilers are a bit different.
Could you please call gdb on your kernel module cdc-acm.ko
and do:

list *(acm_probe+0x4ee)

this should show you where it crashes. In addition I've attached
a patch with paranoid debugging. Could you compile and test a kernel
with it?

	Regards
		Oliver

View attachment "0001-CDC-ACM-more-paranoid-debugging.patch" of type "text/x-patch" (1171 bytes)