From: Sasha Levin <levinsasha928@gmail.com>
To: Ming Lei <tom.leiming@gmail.com>
Cc: Dave Jones <davej@redhat.com>,
Greg Kroah-Hartman <greg@kroah.com>,
Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: use after free in sysfs_find_dirent
Date: Fri, 15 Mar 2013 12:27:51 -0400 [thread overview]
Message-ID: <51434C07.9050407@gmail.com> (raw)
In-Reply-To: <CACVXFVOZ=3WwnTPbi66Crgg1azqHMMYiRQ9YcEgrh_e65MLH1Q@mail.gmail.com>
On 03/15/2013 03:38 AM, Ming Lei wrote:
> Hi,
>
> On Fri, Mar 15, 2013 at 1:04 PM, Sasha Levin <levinsasha928@gmail.com> wrote:
>> On 03/15/2013 12:03 AM, Sasha Levin wrote:
>>>
>>> [ 350.140100] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
>>> [ 350.141468] Dumping ftrace buffer:
>>> [ 350.142048] (ftrace buffer empty)
>>> [ 350.142619] Modules linked in:
>>> [ 350.143128] CPU 0
>>> [ 350.143434] Pid: 25064, comm: trinity-child14 Tainted: G W 3.9.0-rc2-next-20130314-sasha-00046-g3897511 #295
>>> [ 350.145415] RIP: 0010:[<ffffffff819ebfb3>] [<ffffffff819ebfb3>] rb_next+0x23/0x60
>>> [ 350.146680] RSP: 0018:ffff88007b9dde48 EFLAGS: 00010202
>>> [ 350.147528] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8800b8524b70 RCX: ffff8800b8524b70
>>> [ 350.148738] RDX: 6b6b6b6b6b6b6b6b RSI: ffff8800b63b96e0 RDI: ffff8800b8524bb8
>>> [ 350.149939] RBP: ffff88007b9dde48 R08: 2222222222222222 R09: 2222222222222222
>>> [ 350.150035] R10: 2222222222222222 R11: 0000000000000000 R12: ffff88008c5cb180
>>> [ 350.150035] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000010
>>> [ 350.150035] FS: 00007fec4eae2700(0000) GS:ffff8800bb800000(0000) knlGS:0000000000000000
>>> [ 350.150035] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 350.150035] CR2: 0000000000000001 CR3: 000000007c32d000 CR4: 00000000000406f0
>>> [ 350.150035] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>> [ 350.150035] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
>>> [ 350.150035] Process trinity-child14 (pid: 25064, threadinfo ffff88007b9dc000, task ffff880096413000)
>>> [ 350.150035] Stack:
>>> [ 350.150035] ffff88007b9ddeb8 ffffffff812fa959 2222222222222222 2222222200000008
>>> [ 350.150035] 000000000000293e ffffffff8128cca0 ffff88007b9ddf28 ffff8800b63b96e0
>>> [ 350.150035] ffff8800a14e9b78 ffff88008c5cb180 ffff88007b9ddf28 ffffffff8128cca0
>>> [ 350.150035] Call Trace:
>>> [ 350.150035] [<ffffffff812fa959>] sysfs_readdir+0x219/0x280
>>> [ 350.150035] [<ffffffff8128cca0>] ? filldir+0x100/0x100
>>> [ 350.150035] [<ffffffff8128cca0>] ? filldir+0x100/0x100
>>> [ 350.150035] [<ffffffff8128cf18>] vfs_readdir+0x78/0xc0
>>> [ 350.150035] [<ffffffff8117ad3d>] ? trace_hardirqs_on+0xd/0x10
>>> [ 350.150035] [<ffffffff8128d190>] SyS_getdents64+0x90/0x120
>>> [ 350.150035] [<ffffffff83d946d8>] tracesys+0xe1/0xe6
>>> [ 350.150035] Code: 85 d2 75 f4 5d c3 66 90 55 31 c0 48 8b 17 48 89 e5 48 39 d7 74 4a 48 8b 47 08 48 85 c0 75 0c eb 17 0f 1f 80
>>> 00 00 00 00 48 89 d0 <48> 8b 50 10 48 85 d2 75 f4 eb 2a 66 90 48 89 d1 48 83 e1 fc 74
>>> [ 350.150035] RIP [<ffffffff819ebfb3>] rb_next+0x23/0x60
>>> [ 350.150035] RSP <ffff88007b9dde48>
>>> [ 350.179705] ---[ end trace a39f58a515b594d5 ]---
>>
>> And on the bright side, unlike in Dave's case, similar issues reproduce rather easily
>> over here:
>
> Could you share how to reproduce that easily?
Reproduces easily with trinity, didn't look into manually doing it yet.
Thought it looks like the dir is going away while we're listing the directory,
so I assume it would be easy to reproduce if we put a short delay into sysfs_dir_next_pos
and remove the directory underneath? I can try that later today/tomorrow.
Thanks,
Sasha
next prev parent reply other threads:[~2013-03-15 16:27 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-07 5:28 use after free in sysfs_find_dirent Dave Jones
2013-03-07 5:33 ` sysfs_dir_cache slab corruption Dave Jones
2013-03-07 6:03 ` Greg Kroah-Hartman
2013-03-07 6:02 ` use after free in sysfs_find_dirent Greg Kroah-Hartman
2013-03-07 6:26 ` Dave Jones
2013-03-13 11:47 ` Ming Lei
2013-03-15 4:03 ` Sasha Levin
2013-03-15 5:04 ` Sasha Levin
2013-03-15 7:38 ` Ming Lei
2013-03-15 16:27 ` Sasha Levin [this message]
2013-03-16 12:39 ` Hillf Danton
2013-03-16 13:30 ` Ming Lei
2013-03-16 15:07 ` Sasha Levin
2013-03-16 15:22 ` Ming Lei
2013-03-16 15:58 ` Ming Lei
2013-03-16 18:33 ` Sasha Levin
2013-03-17 1:02 ` Ming Lei
2013-03-17 14:24 ` Sasha Levin
2013-03-17 16:23 ` Ming Lei
2013-03-19 2:06 ` Sasha Levin
2013-03-19 3:40 ` Ming Lei
2013-03-19 11:54 ` Ming Lei
2013-03-19 16:28 ` Sasha Levin
2013-03-20 1:02 ` Ming Lei
2013-03-20 14:34 ` Sasha Levin
2013-03-20 17:17 ` Greg Kroah-Hartman
2013-03-16 15:59 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51434C07.9050407@gmail.com \
--to=levinsasha928@gmail.com \
--cc=davej@redhat.com \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tom.leiming@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.