From: Al Viro <viro@ZenIV.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matthew Wilcox <willy@infradead.org>,
"Tobin C. Harding" <me@tobin.cc>,
Dmitry Vyukov <dvyukov@google.com>,
Kees Cook <keescook@chromium.org>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
Linux-MM <linux-mm@kvack.org>,
syzbot
<bot+719398b443fd30155f92f2a888e749026c62b427@syzkaller.appspotmail.com>,
David Windsor <dave@nullcore.net>,
keun-o.park@darkmatter.ae, Laura Abbott <labbott@redhat.com>,
LKML <linux-kernel@vger.kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Ingo Molnar <mingo@kernel.org>,
syzkaller-bugs@googlegroups.com,
Will Deacon <will.deacon@arm.com>
Subject: Re: BUG: bad usercopy in memdup_user
Date: Tue, 19 Dec 2017 21:48:49 +0000 [thread overview]
Message-ID: <20171219214849.GU21978@ZenIV.linux.org.uk> (raw)
In-Reply-To: <CA+55aFwvMMg0Kt8z+tkgPREbX--Of0R5nr_wS4B64kFxiVVKmw@mail.gmail.com>
On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote:
> I suspect that an "offset and size within the kernel object" value
> might make sense. But what does the _pointer_ tell you?
Well, for example seeing a 0xfffffffffffffff4 where a pointer to object
must have been is a pretty strong hint to start looking for a way for
that ERR_PTR(-ENOMEM) having ended up there... Something like
0x6e69622f7273752f is almost certainly a misplaced "/usr/bin", i.e. a
pathname overwriting whatever it ends up in, etc. And yes, I have run
into both of those in real life.
Debugging the situation when crap value has ended up in place of a
pointer is certainly a case where you do want to see what exactly has
ended up in there...
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matthew Wilcox <willy@infradead.org>,
"Tobin C. Harding" <me@tobin.cc>,
Dmitry Vyukov <dvyukov@google.com>,
Kees Cook <keescook@chromium.org>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
Linux-MM <linux-mm@kvack.org>,
syzbot
<bot+719398b443fd30155f92f2a888e749026c62b427@syzkaller.appspotmail.com>,
David Windsor <dave@nullcore.net>,
keun-o.park@darkmatter.ae, Laura Abbott <labbott@redhat.com>,
LKML <linux-kernel@vger.kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Ingo Molnar <mingo@kernel.org>,
syzkaller-bugs@googlegroups.com,
Will Deacon <will.deacon@arm.com>
Subject: Re: BUG: bad usercopy in memdup_user
Date: Tue, 19 Dec 2017 21:48:49 +0000 [thread overview]
Message-ID: <20171219214849.GU21978@ZenIV.linux.org.uk> (raw)
In-Reply-To: <CA+55aFwvMMg0Kt8z+tkgPREbX--Of0R5nr_wS4B64kFxiVVKmw@mail.gmail.com>
On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote:
> I suspect that an "offset and size within the kernel object" value
> might make sense. But what does the _pointer_ tell you?
Well, for example seeing a 0xfffffffffffffff4 where a pointer to object
must have been is a pretty strong hint to start looking for a way for
that ERR_PTR(-ENOMEM) having ended up there... Something like
0x6e69622f7273752f is almost certainly a misplaced "/usr/bin", i.e. a
pathname overwriting whatever it ends up in, etc. And yes, I have run
into both of those in real life.
Debugging the situation when crap value has ended up in place of a
pointer is certainly a case where you do want to see what exactly has
ended up in there...
next prev parent reply other threads:[~2017-12-19 21:49 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-18 13:40 BUG: bad usercopy in memdup_user syzbot
2017-12-18 14:22 ` Tetsuo Handa
2017-12-18 14:22 ` Tetsuo Handa
2017-12-19 0:57 ` Kees Cook
2017-12-19 0:57 ` Kees Cook
2017-12-19 8:12 ` Dmitry Vyukov
2017-12-19 8:12 ` Dmitry Vyukov
2017-12-19 8:37 ` Tobin C. Harding
2017-12-19 8:37 ` Tobin C. Harding
2017-12-19 8:41 ` Dmitry Vyukov
2017-12-19 8:41 ` Dmitry Vyukov
2017-12-19 9:04 ` Tobin C. Harding
2017-12-19 9:04 ` Tobin C. Harding
2017-12-19 9:07 ` Dmitry Vyukov
2017-12-19 9:07 ` Dmitry Vyukov
2017-12-19 13:22 ` Matthew Wilcox
2017-12-19 13:22 ` Matthew Wilcox
2017-12-19 13:41 ` Dmitry Vyukov
2017-12-19 13:41 ` Dmitry Vyukov
2017-12-19 14:08 ` Tetsuo Handa
2017-12-19 14:08 ` Tetsuo Handa
2017-12-19 14:12 ` Dmitry Vyukov
2017-12-19 14:12 ` Dmitry Vyukov
2017-12-19 20:45 ` Tobin C. Harding
2017-12-19 20:45 ` Tobin C. Harding
2017-12-19 20:33 ` Tobin C. Harding
2017-12-19 20:33 ` Tobin C. Harding
2017-12-19 21:36 ` Linus Torvalds
2017-12-19 21:36 ` Linus Torvalds
2017-12-19 21:48 ` Al Viro [this message]
2017-12-19 21:48 ` Al Viro
2017-12-19 22:09 ` Randy Dunlap
2017-12-19 22:09 ` Randy Dunlap
2017-12-19 23:24 ` Linus Torvalds
2017-12-19 23:24 ` Linus Torvalds
2017-12-20 3:50 ` Matthew Wilcox
2017-12-20 3:50 ` Matthew Wilcox
2017-12-20 4:05 ` Linus Torvalds
2017-12-20 4:05 ` Linus Torvalds
2017-12-20 4:36 ` Linus Torvalds
2017-12-20 4:36 ` Linus Torvalds
2017-12-20 9:44 ` David Laight
2017-12-20 9:44 ` David Laight
2017-12-31 8:11 ` Dmitry Vyukov
2017-12-31 8:11 ` Dmitry Vyukov
2017-12-19 21:54 ` Kees Cook
2017-12-19 21:54 ` Kees Cook
2017-12-19 22:16 ` Matthew Wilcox
2017-12-19 22:16 ` Matthew Wilcox
2017-12-19 22:24 ` Laura Abbott
2017-12-19 22:24 ` Laura Abbott
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171219214849.GU21978@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=bot+719398b443fd30155f92f2a888e749026c62b427@syzkaller.appspotmail.com \
--cc=dave@nullcore.net \
--cc=dvyukov@google.com \
--cc=keescook@chromium.org \
--cc=keun-o.park@darkmatter.ae \
--cc=labbott@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mark.rutland@arm.com \
--cc=me@tobin.cc \
--cc=mingo@kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=syzkaller-bugs@googlegroups.com \
--cc=torvalds@linux-foundation.org \
--cc=will.deacon@arm.com \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.