2.6.13-rc3 + kdb (which does not touch udev/hotplug) on IA64 (Altix).
gcc version 3.3.3 (SuSE Linux). Compiled with DEBUG_SLAB,
DEBUG_PREEMPT, DEBUG_SPINLOCK, DEBUG_SPINLOCK_SLEEP, DEBUG_KOBJECT.
There is a use after free somewhere above class_device_attr_show.
<7>fill_kobj_path: path = '/class/vc/vcs13'
<7>kobject_hotplug: /sbin/hotplug vc seq=1377 HOME=/ PATH=/sbin:/bin:/usr/sbin:/usr/bin ACTION=remove DEVPATH=/class/vc/vcs13 SUBSYSTEM=vc
<7>kobject vcs13: cleaning up
<7>kobject_hotplug
<7>fill_kobj_path: path = '/class/vc/vcsa13'
<1>Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b6b6b
<4>udev[13708]: Oops 8813272891392 [1]
<7>kobject_hotplug: /sbin/hotplug vc seq=1378 HOME=/ PATH=/sbin:/bin:/usr/sbin:/usr/bin ACTION=remove DEVPATH=/class/vc/vcsa13 SUBSYSTEM=vc
<4>Modules linked in: md5 ipv6 usbcore raid0 md_mod nls_iso8859_1 nls_cp437 dm_mod sg st osst
<4>
<4>Pid: 13708, CPU 0, comm: udev
<4>psr : 0000101008126038 ifs : 8000000000000308 ip : [<a0000001004c8ed0>] Not tainted
<4>ip is at class_device_attr_show+0x50/0xa0
The offending code is
[0]kdb> id class_device_attr_show
0xa0000001004c8e80 class_device_attr_show[MII] alloc r36=ar.pfs,8,6,0
0xa0000001004c8e86 class_device_attr_show+0x6 mov r8=r0;;
0xa0000001004c8e8c class_device_attr_show+0xc adds r2=24,r33
0xa0000001004c8e90 class_device_attr_show+0x10[MMI] mov r37=r1
0xa0000001004c8e96 class_device_attr_show+0x16 mov r39=r34
0xa0000001004c8e9c class_device_attr_show+0x1c adds r38=-16,r32
0xa0000001004c8ea0 class_device_attr_show+0x20[MII] nop.m 0x0
0xa0000001004c8ea6 class_device_attr_show+0x26 mov r35=b0;;
0xa0000001004c8eac class_device_attr_show+0x2c mov.i ar.pfs=r36
0xa0000001004c8eb0 class_device_attr_show+0x30[MII] ld8 r33=[r2]
0xa0000001004c8eb6 class_device_attr_show+0x36 mov b0=r35;;
0xa0000001004c8ebc class_device_attr_show+0x3c cmp.eq p8,p9=0,r33
0xa0000001004c8ec0 class_device_attr_show+0x40[MBB] nop.m 0x0
0xa0000001004c8ec6 class_device_attr_show+0x46 (p09) br.cond.dpnt.few 0xa0000001004c8ed0 class_device_attr_show+0x50
0xa0000001004c8ecc class_device_attr_show+0x4c br.ret.sptk.many b0
0xa0000001004c8ed0 class_device_attr_show+0x50[MMI] ld8 r8=[r33],8;;
0xa0000001004c8ed6 class_device_attr_show+0x56 ld8 r1=[r33],-8
0xa0000001004c8edc class_device_attr_show+0x5c mov b7=r8
At the oops, r33 has been loaded from [r2], r33 contains
0x6b6b6b6b6b6b6b6b. IOW, use after free.
[0]kdb> r
psr: 0x0000101008126038 ifs: 0x8000000000000308 ip: 0xa0000001004c8ed0
unat: 0x0000000000000000 pfs: 0x0000000000000711 rsc: 0x0000000000000003
rnat: 0xe00000b47a429e78 bsps: 0xe00000b00bf5d320 pr: 0x0000000000155659
ldrs: 0x0000000000000000 ccv: 0x0000000000000000 fpsr: 0x0009804c0270033f
b0: 0xa0000001001fc830 b6: 0xa00000010000f4e0 b7: 0xa0000001004c8e80
r1: 0xa000000100d31900 r2: 0xe000003473de5080 r3: 0xe000003008f78da4
r8: 0x0000000000000000 r9: 0xa000000100b4b818 r10: 0xe00000b077270000
r11: 0x0000000002c1dc9c r12: 0xe000003008f7fe20 r13: 0xe000003008f78000
r14: 0xa0000001004c8e80 r15: 0xe00000b077270000 r16: 0x6db6db6db6db6db7
r17: 0x000000009a684220 r18: 0xa0007fff62138000 r19: 0xe00000b003031318
r20: 0xe00000b003030080 r21: 0x0000000000000001 r22: 0xa000000100b4b818
r23: 0xa000000100d23100 r24: 0x00000000134d0844 r25: 0x000000009a684220
r26: 0xa0000001008732d8 r27: 0xe000003004fe8188 r28: 0xe00000b003030080
r29: 0xa000000100d23120 r30: 0x0000000000000004 r31: 0x0100000000000000
[0]kdb> r s
r32: e0000034714fbb30 r33: 6b6b6b6b6b6b6b6b r34: e00000b077270000
r35: a0000001001fc830 r36: 0000000000000711 r37: a000000100d31900
r38: e0000034714fbb20 r39: e00000b077270000
Dumping where r2 points, the area has been reused by the time that the
oops occurred. Again, use after free.
[0]kdb> mds 0xe000003473de5080-24
0xe000003473de5068 2d646c2f62696c2f /lib/ld-
0xe000003473de5070 61692d78756e696c linux-ia
0xe000003473de5078 322e6f732e3436 64.so.2.
0xe000003473de5080 5a5a5a5a5a5a5a5a ZZZZZZZZ
0xe000003473de5088 5a5a5a5a5a5a5a5a ZZZZZZZZ
0xe000003473de5090 5a5a5a5a5a5a5a5a ZZZZZZZZ
0xe000003473de5098 5a5a5a5a5a5a5a5a ZZZZZZZZ
0xe000003473de50a0 a55a5a5a5a5a5a5a ZZZZZZZ.
ps. Handy things, kernel debuggers ...
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
| |
 |