From: Vince Weaver <vincent.weaver@maine.edu>
To: Vince Weaver <vincent.weaver@maine.edu>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
"H.J. Lu" <hjl.tools@gmail.com>
Subject: Re: perf_fuzzer compiled for x32 causes reboot
Date: Fri, 21 Feb 2014 23:50:38 -0500 (EST) [thread overview]
Message-ID: <alpine.DEB.2.10.1402212342090.17416@vincent-weaver-1.um.maine.edu> (raw)
In-Reply-To: <alpine.DEB.2.10.1402211732290.11615@vincent-weaver-1.um.maine.edu>
So I changed the perf_fuzzer so when it randomly stomps all over the
perf_event_mmap_page, it uses a constant value of 0xdeadbeef rather
than a random value.
The result is below. The segfaults make a bit more sense now, it
almost looks like what is happening is we are corrupting an address
value somehow (head? tail?) and the kernel then uses the corrupt address
and writes to memory outside of the mmap ring buffer.
I still haven't figured out how to trigger this exactly, but you can
see when over-written with 0xdeadbeef the memory address written to is
consistently some small multiple of 0x120.
I imagine it would be a bad thing if it turned out to be possible to
select what memory address got written to. Although since I've
only reproduced this on x32 maybe it won't be possible to over-write
the kernel; but I have seen this bug cause a reboot when the
wrong thing got over-written.
[28002.850192] perf_fuzzer[7083]: segfault at 2be0 ip 000000000041efab sp 00000000ff826748 error 6 in perf_fuzzer[400000+d1000]
[28639.769869] perf_fuzzer[7100]: segfault at 1320 ip 000000000041efab sp 00000000ffa65038 error 6 in perf_fuzzer[400000+d1000]
[29396.986242] perf_fuzzer[7120]: segfault at 10e0 ip 000000000041efab sp 00000000ffd48e68 error 6 in perf_fuzzer[400000+d1000]
[29738.892931] perf_fuzzer[7128]: segfault at 18c0 ip 000000000041efab sp 00000000ffcdcd88 error 6 in perf_fuzzer[400000+d1000]
[29815.550210] perf_fuzzer[7132]: segfault at 120 ip 000000000041efab sp 00000000ffe673b8 error 6 in perf_fuzzer[400000+d1000]
[30173.455348] perf_fuzzer[7141]: segfault at 120 ip 000000000041efab sp 00000000ffda1948 error 6 in perf_fuzzer[400000+d1000]
[30570.625642] perf_fuzzer[7156]: segfault at 1680 ip 000000000041efab sp 00000000ffaad028 error 6 in perf_fuzzer[400000+d1000]
[31047.887784] perf_fuzzer[7169]: segfault at 60c0 ip 000000000041efab sp 00000000ffaa86e8 error 6 in perf_fuzzer[400000+d1000]
[31300.168714] perf_fuzzer[7175]: segfault at 3a80 ip 000000000041efab sp 00000000ffd83228 error 6 in perf_fuzzer[400000+d1000]
[31984.727278] perf_fuzzer[7193]: segfault at 7e0 ip 000000000041efab sp 00000000ff9db1f8 error 6 in perf_fuzzer[400000+d1000]
Vince
next prev parent reply other threads:[~2014-02-22 4:48 UTC|newest]
Thread overview: 115+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-21 20:25 perf_fuzzer causes reboot Vince Weaver
2014-02-21 22:13 ` perf_fuzzer compiled for x32 " Vince Weaver
2014-02-21 22:34 ` Vince Weaver
2014-02-22 4:50 ` Vince Weaver [this message]
2014-02-22 5:03 ` H. Peter Anvin
2014-02-22 6:26 ` H. Peter Anvin
2014-02-23 5:18 ` Vince Weaver
2014-02-23 5:24 ` H. Peter Anvin
2014-02-23 6:07 ` H. Peter Anvin
2014-02-23 14:05 ` Vince Weaver
2014-02-24 3:02 ` Vince Weaver
2014-02-24 5:22 ` H. Peter Anvin
2014-02-24 15:35 ` Vince Weaver
2014-02-24 16:34 ` Vince Weaver
2014-02-24 16:47 ` H. Peter Anvin
2014-02-24 17:10 ` Vince Weaver
2014-02-24 17:25 ` Peter Zijlstra
2014-02-24 17:32 ` Vince Weaver
2014-02-24 17:40 ` H. Peter Anvin
2014-02-24 18:00 ` Vince Weaver
2014-02-24 18:07 ` Vince Weaver
2014-02-24 18:34 ` H. Peter Anvin
2014-02-24 19:13 ` Steven Rostedt
2014-02-24 19:15 ` H. Peter Anvin
2014-02-24 19:30 ` Peter Zijlstra
2014-02-24 19:32 ` Steven Rostedt
2014-02-25 3:49 ` H. Peter Anvin
2014-02-25 14:07 ` Vince Weaver
2014-02-25 14:34 ` H. Peter Anvin
2014-02-25 14:43 ` Steven Rostedt
2014-02-25 15:33 ` Vince Weaver
2014-02-26 15:06 ` Vince Weaver
2014-02-27 22:06 ` Vince Weaver
2014-02-27 22:31 ` Steven Rostedt
2014-02-27 22:52 ` H. Peter Anvin
2014-02-27 23:30 ` Steven Rostedt
2014-02-27 23:46 ` H. Peter Anvin
2014-02-28 1:00 ` Vince Weaver
2014-02-28 20:34 ` Paul E. McKenney
2014-02-28 20:47 ` Steven Rostedt
2014-02-28 20:54 ` Peter Zijlstra
2014-02-28 21:17 ` Paul E. McKenney
2014-02-28 21:27 ` Peter Zijlstra
2014-02-28 21:51 ` Paul E. McKenney
2014-02-28 21:55 ` Peter Zijlstra
2014-02-28 22:05 ` Steven Rostedt
2014-02-28 22:23 ` Paul E. McKenney
2014-02-28 1:34 ` Vince Weaver
2014-02-28 2:17 ` H. Peter Anvin
2014-02-28 2:57 ` Steven Rostedt
2014-02-28 11:11 ` Peter Zijlstra
2014-02-28 13:37 ` Steven Rostedt
2014-02-28 14:15 ` Vince Weaver
2014-02-28 14:23 ` Steven Rostedt
2014-02-28 15:07 ` Vince Weaver
2014-02-28 15:13 ` H. Peter Anvin
2014-02-28 15:40 ` Peter Zijlstra
2014-02-28 16:15 ` H. Peter Anvin
2014-02-28 16:29 ` Steven Rostedt
2014-02-28 19:33 ` [PATCH] x86: Rename copy_from_user_nmi() to copy_from_user_trace() Steven Rostedt
2014-02-28 20:46 ` Peter Zijlstra
2014-02-28 20:51 ` Steven Rostedt
2014-02-28 20:58 ` Peter Zijlstra
2014-02-28 21:01 ` Steven Rostedt
2014-02-28 21:17 ` Peter Zijlstra
2014-02-28 20:56 ` perf_fuzzer compiled for x32 causes reboot Peter Zijlstra
2014-02-28 21:06 ` Steven Rostedt
2014-03-01 9:16 ` Ingo Molnar
2014-03-01 9:50 ` Borislav Petkov
2014-03-01 16:50 ` H. Peter Anvin
2014-03-04 23:05 ` Borislav Petkov
2014-03-03 9:16 ` Peter Zijlstra
2014-02-28 20:55 ` Peter Zijlstra
2014-02-28 15:20 ` Steven Rostedt
2014-02-28 15:30 ` Steven Rostedt
2014-02-28 20:38 ` H. Peter Anvin
2014-02-28 20:46 ` Steven Rostedt
2014-02-28 21:18 ` Vince Weaver
2014-02-28 21:30 ` Steven Rostedt
2014-02-28 23:34 ` Vince Weaver
2014-03-01 0:43 ` H. Peter Anvin
2014-03-01 3:36 ` Steven Rostedt
2014-03-01 16:24 ` Andi Kleen
2014-03-02 15:34 ` Vince Weaver
2014-03-02 16:02 ` Vince Weaver
2014-02-28 9:39 ` Peter Zijlstra
2014-02-24 17:40 ` Peter Zijlstra
2014-02-24 17:41 ` Vince Weaver
2014-02-24 17:42 ` H. Peter Anvin
2014-02-24 17:52 ` H. Peter Anvin
2014-02-28 15:33 [PATCH] x86 trace: Fix page fault tracing bug Jiri Olsa
2014-02-28 15:47 ` Peter Zijlstra
2014-02-28 16:05 ` [PATCHv2] " Jiri Olsa
2014-02-28 16:11 ` H. Peter Anvin
2014-02-28 16:23 ` Steven Rostedt
2014-02-28 16:15 ` Steven Rostedt
2014-03-05 0:03 ` [tip:x86/urgent] x86, trace: Fix CR2 corruption when tracing page faults tip-bot for Jiri Olsa
2014-03-05 11:14 ` Peter Zijlstra
2014-03-05 12:20 ` Steven Rostedt
2014-03-05 12:25 ` Peter Zijlstra
2014-03-05 12:33 ` Steven Rostedt
2014-03-05 12:54 ` Peter Zijlstra
2014-03-05 13:02 ` Peter Zijlstra
2014-03-05 13:07 ` Peter Zijlstra
2014-03-05 12:36 ` Peter Zijlstra
2014-03-05 13:00 ` Steven Rostedt
2014-03-05 13:08 ` Peter Zijlstra
2014-03-05 21:37 ` H. Peter Anvin
2014-03-06 8:40 ` Peter Zijlstra
2014-03-06 11:02 ` Steven Rostedt
2014-03-06 14:53 ` [PATCH] x86: Further robustify CR2 handling vs tracing Peter Zijlstra
2014-03-07 23:07 ` [tip:x86/urgent] x86, trace: " tip-bot for Peter Zijlstra
2014-02-28 15:47 ` [PATCH] x86 trace: Fix page fault tracing bug Jiri Olsa
2014-02-28 16:00 ` Steven Rostedt
2014-02-28 16:01 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.10.1402212342090.17416@vincent-weaver-1.um.maine.edu \
--to=vincent.weaver@maine.edu \
--cc=hjl.tools@gmail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).