linux-kernel - Re: keys: GPF in request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 01 Feb 2017 13:22:24 +0000
From:   David Howells <dhowells@...hat.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     dhowells@...hat.com, james.l.morris@...cle.com, serge@...lyn.com,
        keyrings@...r.kernel.org, linux-security-module@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: keys: GPF in request_key

Dmitry Vyukov <dvyukov@...gle.com> wrote:

> The line causes the crash is:
>     BUG_ON(index_key->desc_len == 0);
> 
> The addresses that the line tried to access are:
>
> RDI: ffffffffca29fa68
> RDI: ffffffffd7236a28
> RDI: 000000007d19ed68

These are all calculated from R12:

	lea    0x10(%r12),%rdi
	...
	mov    %rdi,%rdx
	shr    $0x3,%rdx
	cmpb   $0x0,(%rdx,%rax,1)

R12 would appear to be index_key - which would correlate with 0x10 being the
offset of desc_len therein - but why muck around with the pointer rather than
just 

In my compiler output,

	BUG_ON(index_key->desc_len == 0);

is turned into:

   0xffffffff8131f023 <+0>:     cmpq   $0x0,0x10(%rsi)
   0xffffffff8131f028 <+5>:     jne    0xffffffff8131f02c <__key_link_begin+9>
   0xffffffff8131f02a <+7>:     ud2    

What compiler are you using?

David