linux-kernel - "BUG: unable to handle kernel paging request in do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKHoSAuAirmoVE6oS6a7FVfJe9u9wsjfxxhNagvsfZVzZpg06A@mail.gmail.com>
Date: Mon, 2 Dec 2024 10:30:02 +0800
From: cheung wall <zzqq0103.hey@...il.com>
To: linux-kernel@...r.kernel.org
Subject: "BUG: unable to handle kernel paging request in do_wait" in Linux
 kernel Version(2.6.32)

Hello,

I am writing to report a potential vulnerability identified in the
Linux Kernel version 2.6.32, specifically on the PowerPC architecture.
This issue was discovered using our custom vulnerability discovery
tool.

Affected File:

File: kernel/exit.c

Function: do_wait

Detailed Call Stack:

Unable to handle kernel paging request for data at address 0xffffffb4
Oops: Kernel access of bad area, sig: 11 [#1]
Modules linked in:
REGS: c05cbc60 TRAP: 0300 Not tainted (2.6.32)
DEAR: ffffffb4, ESR: 00000000
GPR00: 00000004 c05cbd10 c0591330 c05cbd48 00000001 c0591328 00000000 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
NIP [c004ab64] do_wait_thread root/linux-2.6.32/kernel/exit.c:1544 [inline]
NIP [c004ab64] do_wait+0x94/0x1d0 root/linux-2.6.32/kernel/exit.c:1619
Call Trace:
[c05cbd40] [c004ad28] sys_wait4+0x88/0xe0 root/linux-2.6.32/kernel/exit.c:1749
[c05cbdd0] [c000524c] fuzz_start_one+0xc94/0xd04
root/linux-2.6.32/init/executor.c:676
[c05cbfc0] [c0555e38] start_kernel+0x324/0x338 root/linux-2.6.32/init/main.c:682
Instruction dump:
60000000 60000000 60000000 7f7ddb78 <853d0110> 3be9fee8 60000000 813f0118
Kernel panic - not syncing: Attempted to kill the idle task!

Root Cause:

Based on the stack trace and the information from the kernel, the
error occurs when do_wait tries to access an invalid memory address
(0xffffffb4). This address seems to be related to a pointer
dereferencing issue in the function, possibly caused by a race
condition or an invalid pointer being passed to do_wait during the
execution of a wait system call. It is likely that the code does not
properly handle certain edge cases, such as when child processes are
already terminated or improperly cleaned up.

We would appreciate it if the kernel maintainers could investigate
this issue further. If additional details or steps to reproduce are
needed, please let us know. We are happy to assist in any way we can.

Thank you for your time and attention.

Best regards

Wall