From: Dave Jones <davej@redhat.com>
To: Linux Kernel <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Subject: [3.3-rc7] sys_poll use after free (hibernate)
Date: Mon, 12 Mar 2012 20:58:56 -0400 [thread overview]
Message-ID: <20120313005855.GA24639@redhat.com> (raw)
While trying to reproduce the i915 memory corruption problem with hibernate,
I've hit the following use-after-free quite a few times, by running my
syscall fuzzer and hibernating/resuming in a loop.
oops below on 3.3rc7, but same problem also affects 3.2.9, and probably
many versions before that.
Dave
general protection fault: 0000 [#1] PREEMPT SMP
CPU 3
Modules linked in: binfmt_misc cmtp kernelcapi hidp can_bcm sctp dccp_ipv6 dccp_ipv4 dccp af_802154 phonet bluetooth rfkill can pppo
e pppox ppp_generic slhc irda crc_ccitt rds af_key rose ax25 atm appletalk ipx p8022 psnap llc p8023 nfs fscache auth_rpcgss nfs_acl lockd ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6
xt_state nf_conntrack ip6table_filter ip6_tables btrfs dm_mirror dm_region_hash dm_log zlib_deflate libcrc32c snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq sunrpc ppd
ev snd_seq_device snd_pcm tg3 iTCO_wdt parport_pc microcode snd_timer snd raid0 i5000_edac iTCO_vendor_support dcdbas parport soundcore usb_debug shpchp pcspkr serio_raw floppy edac_co
re snd_page_alloc i2c_i801 i5k_amb firewire_ohci firewire_core crc_itu_t nouveau ttm drm_kms_helper drm i2c_core mxm_wmi video wmi [last unloaded: scsi_wait_scan]
Pid: 18277, comm: trinity Not tainted 3.3.0-rc7+ #11 Dell Inc. Precision WorkStation 490 /0DT031
RIP: 0010:[<ffffffff81233e3e>] [<ffffffff81233e3e>] proc_sys_poll+0x4e/0x90
RSP: 0018:ffff880207167b08 EFLAGS: 00010246
RAX: 0000000000000145 RBX: ffff88020cab6940 RCX: 0000000000000000
RDX: ffffffff81233df0 RSI: 6b6b6b6b6b6b6b6b RDI: ffff88020cab6940
RBP: ffff880207167b28 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8802085fd510
R13: 0000000000000000 R14: ffff8802098c63e4 R15: 0000000000000000
FS: 00007fa1a4f70700(0000) GS:ffff880236c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000021d8928 CR3: 000000012dff9000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process trinity (pid: 18277, threadinfo ffff880207166000, task ffff880233300000)
Stack:
000000000000002a ffff8802098c5dfc 000000000000002a ffff88020cab6940
ffff880207167f38 ffffffff811d4360 00000000021d7a10 ffffc900000000e1
00000000021d7920 ffff880233300000 0000000000000000 ffff880207167b88
Call Trace:
[<ffffffff811d4360>] do_sys_poll+0x280/0x500
[<ffffffff811d2e20>] ? poll_freewait+0xe0/0xe0
[<ffffffff81179c9a>] ? do_wp_page+0x1da/0x720
[<ffffffff810a09a1>] ? get_parent_ip+0x11/0x50
[<ffffffff816a1bad>] ? sub_preempt_count+0x9d/0xd0
[<ffffffff8169d8e5>] ? _raw_spin_unlock+0x35/0x60
[<ffffffff81179dc8>] ? do_wp_page+0x308/0x720
[<ffffffff81333e74>] ? debug_object_activate+0x84/0x1a0
[<ffffffff8117b92d>] ? handle_pte_fault+0x27d/0xa10
[<ffffffff811b1d71>] ? mem_cgroup_count_vm_event+0x31/0x1a0
[<ffffffff816a1bad>] ? sub_preempt_count+0x9d/0xd0
[<ffffffff811d46bb>] sys_poll+0x6b/0x100
[<ffffffff816a5ae9>] system_call_fastpath+0x16/0x1b
Code: 00 48 89 fb 48 89 f1 48 8b 40 30 4c 8b 60 e8 b8 45 01 00 00 49 83 7c 24 28 00 74 2e 49 8b 74 24 30 48 85 f6 74 24 48 85 c9 75 32 <8b> 16 b8 45 01 00 00 48 63 d2 49 39 d5 74 10 8b 06 48 98 48 89
next reply other threads:[~2012-03-13 0:59 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-13 0:58 Dave Jones [this message]
2012-03-18 19:02 ` [3.3-rc7] sys_poll use after free (hibernate) Linus Torvalds
2012-03-18 19:27 ` Al Viro
2012-03-19 8:17 ` Alexey Dobriyan
2012-03-20 6:08 ` Lucas De Marchi
2012-03-20 18:29 ` [PATCH] sysctl: protect poll() in entries that may go away Lucas De Marchi
2012-03-22 21:31 ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-22 22:12 ` Lucas De Marchi
2012-03-22 23:02 ` Eric W. Biederman
2012-03-24 0:25 ` [REVIEW][PATCH] Making poll generally useful for sysctls Eric W. Biederman
2012-03-24 6:20 ` Lucas De Marchi
2012-03-24 7:58 ` Eric W. Biederman
2012-03-26 17:44 ` Lucas De Marchi
2012-03-27 4:02 ` Lucas De Marchi
2012-03-28 2:00 ` Eric W. Biederman
2012-03-22 22:24 ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-18 19:47 ` richard -rw- weinberger
2012-03-18 21:24 ` Dave Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120313005855.GA24639@redhat.com \
--to=davej@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox