netdev - Re: boot crash in arp_error_report() (Re: [GIT] Networking)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 May 2010 12:27:56 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Ingo Molnar <mingo@...e.hu>
cc:	David Miller <davem@...emloft.net>,
	Thomas Gleixner <tglx@...utronix.de>,
	Andrew Morton <akpm@...ux-foundation.org>,
	netdev@...r.kernel.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: boot crash in arp_error_report() (Re: [GIT] Networking)



On Thu, 27 May 2010, Ingo Molnar wrote:
> 
> FYI, this boot crash in arp_error_report() started triggering in -tip testing:
> 
> [  113.285384] BUG: unable to handle kernel paging request at 6b6b6b87

That's the POISON_FREE signature, with an offset of 28 (0x1c).

And it looks like the whole function got captured in the Code: sequence. 
It looks like this:

   0:	55                   	push   %ebp
   1:	89 e5                	mov    %esp,%ebp
   3:	53                   	push   %ebx
   4:	0f 1f 44 00 00       	nopl   0x0(%eax,%eax,1)
   9:	89 d3                	mov    %edx,%ebx
   b:	89 d0                	mov    %edx,%eax
   d:	e8 fa fb ff ff       	call   0xfffffc0c		# skb_dst()
  12:	85 c0                	test   %eax,%eax		# dst
  14:	74 12                	je     0x28
  16:	8b 40 40             	mov    0x40(%eax),%eax		# dst->ops
  19:	85 c0                	test   %eax,%eax
  1b:	74 0b                	je     0x28
  1d:*	8b 50 1c             	mov    0x1c(%eax),%edx     <-- trapping instruction
  20:	85 d2                	test   %edx,%edx
  22:	74 04                	je     0x28
  24:	89 d8                	mov    %ebx,%eax
  26:	ff d2                	call   *%edx			# dst->ops->link_failure()
  28:	89 d8                	mov    %ebx,%eax
  2a:	e8 9b 50 fa ff       	call   0xfffa50ca		# skb_free()
  2f:	5b                   	pop    %ebx
  30:	5d                   	pop    %ebp
  31:	c3                   	ret    

Where most of it is "dst_link_failure()" being inlined (that last "callq" 
is the call to kfree_skb().

Looks like 'dst' points to free'd memory, so when we load a pointer from 
it (the dst->ops) field, we get 0x6b6b6b6b, and then when we try to load
dst->ops->link_failure it oopses.

tl;dr: that

	struct dst_entry *dst = skb_dst(skb);

in dst_link_failure seems to result in a stale skb.

		Linus
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html