| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <201104202136.52568.casteyde.christian@free.fr>
Date: Wed, 20 Apr 2011 21:36:52 +0200
From: Christian Casteyde <casteyde.christian@...e.fr>
To: Eric Dumazet <eric.dumazet@...il.com>
Cc: Christoph Lameter <cl@...ux.com>,
Pekka Enberg <penberg@...helsinki.fi>,
Andrew Morton <akpm@...ux-foundation.org>,
netdev@...r.kernel.org, bugzilla-daemon@...zilla.kernel.org,
bugme-daemon@...zilla.kernel.org,
Vegard Nossum <vegardno@....uio.no>
Subject: Re: [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb
Le mercredi 20 avril 2011 17:01:27, Eric Dumazet a écrit :
> Le mercredi 20 avril 2011 à 09:42 -0500, Christoph Lameter a écrit :
> > Avoiding the irq handling yields the savings that improve the fastpath.
> > if you do both then there is only a regression left. So lets go with
> > disabling the CMPXCHG_LOCAL.
>
> OK, let's do that then.
>
> Thanks
>
> [PATCH v4] slub: dont use cmpxchg_double if KMEMCHECK or DEBUG_PAGEALLOC
>
> Christian Casteyde reported a KMEMCHECK splat in slub code.
>
> Problem is now we are lockless and allow IRQ in slab_alloc(), the object
> we manipulate from freelist can be allocated and freed right before we
> try to read object->next.
>
> Same problem can happen with DEBUG_PAGEALLOC
>
> Just dont use cmpxchg_double() if either CONFIG_KMEMCHECK or
> CONFIG_DEBUG_PAGEALLOC is defined.
>
> Reported-by: Christian Casteyde <casteyde.christian@...e.fr>
> Signed-off-by: Eric Dumazet <eric.dumazet@...il.com>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Pekka Enberg <penberg@...helsinki.fi>
> Cc: Vegard Nossum <vegardno@....uio.no>
> Cc: Christoph Lameter <cl@...ux.com>
> ---
> mm/slub.c | 45 +++++++++++++++++++++++++--------------------
> 1 files changed, 25 insertions(+), 20 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 94d2a33..f31ab2c 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -1540,7 +1540,12 @@ static void unfreeze_slab(struct kmem_cache *s,
> struct page *page, int tail) }
> }
>
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#if defined(CONFIG_CMPXCHG_LOCAL) && !defined(CONFIG_KMEMCHECK) && \
> + !defined(CONFIG_DEBUG_PAGEALLOC)
> +#define SLUB_USE_CMPXCHG_DOUBLE
> +#endif
> +
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> #ifdef CONFIG_PREEMPT
> /*
> * Calculate the next globally unique transaction for disambiguiation
> @@ -1604,7 +1609,7 @@ static inline void note_cmpxchg_failure(const char
> *n,
>
> void init_kmem_cache_cpus(struct kmem_cache *s)
> {
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> int cpu;
>
> for_each_possible_cpu(cpu)
> @@ -1643,7 +1648,7 @@ static void deactivate_slab(struct kmem_cache *s,
> struct kmem_cache_cpu *c) page->inuse--;
> }
> c->page = NULL;
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> c->tid = next_tid(c->tid);
> #endif
> unfreeze_slab(s, page, tail);
> @@ -1780,7 +1785,7 @@ static void *__slab_alloc(struct kmem_cache *s, gfp_t
> gfpflags, int node, {
> void **object;
> struct page *new;
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> unsigned long flags;
>
> local_irq_save(flags);
> @@ -1819,7 +1824,7 @@ load_freelist:
> c->node = page_to_nid(c->page);
> unlock_out:
> slab_unlock(c->page);
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> c->tid = next_tid(c->tid);
> local_irq_restore(flags);
> #endif
> @@ -1858,7 +1863,7 @@ new_slab:
> }
> if (!(gfpflags & __GFP_NOWARN) && printk_ratelimit())
> slab_out_of_memory(s, gfpflags, node);
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_restore(flags);
> #endif
> return NULL;
> @@ -1887,7 +1892,7 @@ static __always_inline void *slab_alloc(struct
> kmem_cache *s, {
> void **object;
> struct kmem_cache_cpu *c;
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> unsigned long tid;
> #else
> unsigned long flags;
> @@ -1896,7 +1901,7 @@ static __always_inline void *slab_alloc(struct
> kmem_cache *s, if (slab_pre_alloc_hook(s, gfpflags))
> return NULL;
>
> -#ifndef CONFIG_CMPXCHG_LOCAL
> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_save(flags);
> #else
> redo:
> @@ -1910,7 +1915,7 @@ redo:
> */
> c = __this_cpu_ptr(s->cpu_slab);
>
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> /*
> * The transaction ids are globally unique per cpu and per operation on
> * a per cpu queue. Thus they can be guarantee that the cmpxchg_double
> @@ -1927,7 +1932,7 @@ redo:
> object = __slab_alloc(s, gfpflags, node, addr, c);
>
> else {
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> /*
> * The cmpxchg will only match if there was no additional
> * operation and if we are on the right processor.
> @@ -1954,7 +1959,7 @@ redo:
> stat(s, ALLOC_FASTPATH);
> }
>
> -#ifndef CONFIG_CMPXCHG_LOCAL
> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_restore(flags);
> #endif
>
> @@ -2034,7 +2039,7 @@ static void __slab_free(struct kmem_cache *s, struct
> page *page, {
> void *prior;
> void **object = (void *)x;
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> unsigned long flags;
>
> local_irq_save(flags);
> @@ -2070,7 +2075,7 @@ checks_ok:
>
> out_unlock:
> slab_unlock(page);
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_restore(flags);
> #endif
> return;
> @@ -2084,7 +2089,7 @@ slab_empty:
> stat(s, FREE_REMOVE_PARTIAL);
> }
> slab_unlock(page);
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_restore(flags);
> #endif
> stat(s, FREE_SLAB);
> @@ -2113,7 +2118,7 @@ static __always_inline void slab_free(struct
> kmem_cache *s, {
> void **object = (void *)x;
> struct kmem_cache_cpu *c;
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> unsigned long tid;
> #else
> unsigned long flags;
> @@ -2121,7 +2126,7 @@ static __always_inline void slab_free(struct
> kmem_cache *s,
>
> slab_free_hook(s, x);
>
> -#ifndef CONFIG_CMPXCHG_LOCAL
> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_save(flags);
>
> #else
> @@ -2136,7 +2141,7 @@ redo:
> */
> c = __this_cpu_ptr(s->cpu_slab);
>
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> tid = c->tid;
> barrier();
> #endif
> @@ -2144,7 +2149,7 @@ redo:
> if (likely(page == c->page && c->node != NUMA_NO_NODE)) {
> set_freepointer(s, object, c->freelist);
>
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> if (unlikely(!this_cpu_cmpxchg_double(
> s->cpu_slab->freelist, s->cpu_slab->tid,
> c->freelist, tid,
> @@ -2160,7 +2165,7 @@ redo:
> } else
> __slab_free(s, page, x, addr);
>
> -#ifndef CONFIG_CMPXCHG_LOCAL
> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
> local_irq_restore(flags);
> #endif
> }
> @@ -2354,7 +2359,7 @@ static inline int alloc_kmem_cache_cpus(struct
> kmem_cache *s) BUILD_BUG_ON(PERCPU_DYNAMIC_EARLY_SIZE <
> SLUB_PAGE_SHIFT * sizeof(struct kmem_cache_cpu));
>
> -#ifdef CONFIG_CMPXCHG_LOCAL
> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
> /*
> * Must align to double word boundary for the double cmpxchg instructions
> * to work.
I applied this patch to 2.6.39-rc4 (sorry for the last test, it indeed applied
correctly), I still get the following:
ADDRCONF(NETDEV_UP): eth1: link is not ready
b43-phy0: Loading firmware version 478.104 (2008-07-01 00:50:23)
ADDRCONF(NETDEV_UP): eth1: link is not ready
eth1: direct probe to 2e:94:8b:66:86:88 (try 1/3)
eth1: direct probe responded
eth1: authenticate with 2e:94:8b:66:86:88 (try 1)
eth1: authenticated
eth1: associate with 2e:94:8b:66:86:88 (try 1)
eth1: RX AssocResp from 2e:94:8b:66:86:88 (capab=0x411 status=0 aid=1)
eth1: associated
ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
eth1: no IPv6 routers present
WARNING: kmemcheck: Caught 64-bit read from uninitialized memory
(ffff88001b000c00)
0008001b0088ffff0010000000000000c055530000eaffff0010000000000000
u u u u u u u u u u u u u u u u u u u u u u u u u u u u u u u u
^
Pid: 1874, comm: dhcpcd Not tainted 2.6.39-rc4 #4 Acer,Inc. Aspire 1510
/Aspire 1510
RIP: 0010:[<ffffffff81263d9c>] [<ffffffff81263d9c>] memmove+0x2c/0x190
RSP: 0018:ffff88001c17f8a0 EFLAGS: 00010206
RAX: ffff88001b000c00 RBX: ffff88001b070400 RCX: 0000000000000020
RDX: 000000000000016f RSI: ffff88001b000c00 RDI: ffff88001b000c00
RBP: ffff88001c17f8f8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000200 R14: 0000000000000000 R15: 0000000000000001
FS: 00007fd7df758700(0000) GS:ffffffff81a1b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff88001d23a4b8 CR3: 000000001ba46000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
[<ffffffff815c7584>] ieee80211_skb_resize+0x94/0x120
[<ffffffff815c97a4>] ieee80211_xmit+0xa4/0x280
[<ffffffff815caf86>] ieee80211_subif_start_xmit+0x3e6/0x910
[<ffffffff81486654>] dev_hard_start_xmit+0x384/0x6a0
[<ffffffff8149d344>] sch_direct_xmit+0xd4/0x260
[<ffffffff81486b4e>] dev_queue_xmit+0x1de/0x710
[<ffffffff8156af23>] packet_sendmsg+0xa73/0xbe0
[<ffffffff81471813>] sock_sendmsg+0xe3/0x110
[<ffffffff81472154>] sys_sendto+0x134/0x180
[<ffffffff815e74f8>] system_call_fastpath+0x16/0x1b
[<ffffffffffffffff>] 0xffffffffffffffff
I'm not sure it's the same problem anyway as I've said previously.
I append my config file used to build this kernel.
View attachment "config-debug" of type "text/x-mpsub" (65241 bytes)
Powered by blists - more mailing lists