linux-kernel - Re: [PATCH 4.4 00/37] 4.4.110-stable review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Jan 2018 14:33:55 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Pavel Tatashin <pasha.tatashin@...cle.com>
Cc:     Hugh Dickins <hughd@...gle.com>,
        Andy Lutomirski <luto@...capital.net>,
        Thomas Voegtle <tv@...96.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Shuah Khan <shuahkh@....samsung.com>, patches@...nelci.org,
        Ben Hutchings <ben.hutchings@...ethink.co.uk>,
        lkft-triage@...ts.linaro.org, stable <stable@...r.kernel.org>
Subject: Re: [PATCH 4.4 00/37] 4.4.110-stable review

On Thu, Jan 4, 2018 at 1:48 PM, Pavel Tatashin
<pasha.tatashin@...cle.com> wrote:
> [    6.159992] Code: 89 83 78 06 01 00 b8 01 00 00 00 5b 41 5c 41 5d
> 5d c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 31 d2 48 8b 87 c8 00 00
> 00 48 89 e5 <f0> 0f c1 50 0c 89 97 d0 00 00 00 83 e2 01 b8 01 00 00 00
> 74 1d

Yeah, it's the "lock xadd" as suspected:

   0:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)
   5:   55                      push   %rbp
   6:   31 d2                   xor    %edx,%edx
   8:   48 8b 87 c8 00 00 00    mov    0xc8(%rdi),%rax
   f:   48 89 e5                mov    %rsp,%rbp
  12:*  f0 0f c1 50 0c          lock xadd %edx,0xc(%rax)
 <-- trapping instruction
  17:   89 97 d0 00 00 00       mov    %edx,0xd0(%rdi)
  1d:   83 e2 01                and    $0x1,%edx
  20:   b8 01 00 00 00          mov    $0x1,%eax
  25:   74 1d                   je     0x44

(that first "nop" is a 5-byte nop that is used for the function
tracing placeholder).

And %rax contains garbage (the value "1", rather than a valid kernel pointer).

Sadly, I have no idea about how that garbage came about.

                Linus