On 06/06/2014 01:45 AM, Sasha Levin wrote:
> On 06/05/2014 04:21 PM, Sasha Levin wrote:
>> Hi all,
>>
>> While fuzzing with trinity inside a KVM tools guest running the latest -next
>> kernel I've stumbled on the following spew:
>>
>> [ 306.065161] kernel tried to execute NX-protected page - exploit attempt?
>> (uid: 0)
>> [ 306.067295] BUG: unable to handle kernel paging request at
>> ffff880053b8fd08
>
> Same issue reproduced multiple times with exactly the same trace, so I think
> that it
> rules out random memory corruption.
I might have another lead of this: I caught debug objects complaining about
freeing
active objects:
[ 592.020501] ODEBUG: free active (active state 1) object type: rcu_head hint:
(null)
[ 592.020501] Modules linked in:
[ 592.020501] CPU: 15 PID: 16543 Comm: trinity-c47 Not tainted
3.15.0-rc8-next-20140606-sasha-00021-ga9d3a0b-dirty #596
[ 592.020501] 0000000000000009 ffff880224793988 ffffffff9350fe6b
0000000000000002
[ 592.020501] ffff8802247939d8 ffff8802247939c8 ffffffff9015f96c
ffff88000fd40cf8
[ 592.020501] ffff88006d9a9870 ffffffff9508a000 ffffffff948fbd48
ffffffff97891e90
[ 592.020501] Call Trace:
[ 592.020501] dump_stack (lib/dump_stack.c:52)
[ 592.020501] warn_slowpath_common (kernel/panic.c:430)
[ 592.020501] warn_slowpath_fmt (kernel/panic.c:445)
[ 592.020501] debug_print_object (lib/debugobjects.c:265)
[ 592.020501] __debug_check_no_obj_freed (lib/debugobjects.c:698)
[ 592.020501] debug_check_no_obj_freed (lib/debugobjects.c:727)
[ 592.020501] __vunmap (mm/vmalloc.c:1457)
[ 592.020501] vfree (mm/vmalloc.c:1505)
[ 592.020501] netlink_skb_destructor (net/netlink/af_netlink.c:882)
[ 592.020501] skb_release_head_state (net/core/skbuff.c:566)
[ 592.020501] skb_release_all (net/core/skbuff.c:584)
[ 592.020501] __kfree_skb (net/core/skbuff.c:529 net/core/skbuff.c:600)
[ 592.020501] consume_skb (net/core/skbuff.c:672)
[ 592.020501] skb_free_datagram (include/net/sock.h:1419
include/net/sock.h:1450 net/core/datagram.c:244)
[ 592.020501] netlink_recvmsg (net/netlink/af_netlink.c:2482)
[ 592.020501] ? preempt_count_sub (kernel/sched/core.c:2602)
[ 592.020501] sock_aio_read (net/socket.c:917 net/socket.c:935)
[ 592.020501] ? rw_copy_check_uvector (fs/read_write.c:753)
[ 592.020501] do_sync_readv_writev (fs/read_write.c:683)
[ 592.020501] do_readv_writev (fs/read_write.c:837)
[ 592.020501] ? vtime_account_user (kernel/sched/cputime.c:687)
[ 592.020501] ? get_parent_ip (kernel/sched/core.c:2546)
[ 592.020501] ? __fget_light (include/linux/rcupdate.h:428
include/linux/fdtable.h:80 fs/file.c:684)
[ 592.020501] vfs_readv (fs/read_write.c:866)
[ 592.020501] SyS_readv (fs/read_write.c:892 fs/read_write.c:884)
[ 592.020501] tracesys (arch/x86/kernel/entry_64.S:542)
I can't link them together (stacks don't match with what I'd expect to see in
that
case), but that might be related somehow.
Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
