Skip to contentSkip to conversation

new kernel bug

DISCUSSION Manuel Arostegui Ramirez 7 participants 12 messages Jun 12, 2004 – Jun 15, 2004

lore
Share & tools
lore

Manuel Arostegui Ramirez

author
#0 lore raw

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)
o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Cheers

Signature · 1 line
Manuel Arostegui Ramirez #Linux Registered User 200896
#1 lore raw
Quoted 15 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)
o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Quoted 2 lines

Cheers

Hey, I just crashed my system (2.6.6) as well :-(

Any more light on this?
Anybody, patches?

Kalin.

Signature · 3 lines
||///_ o  *****************************
||//'_/>     WWW: http://ThinRope.net/
|||\/<" |||\\ ' ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
author
#2 lore raw
Quoted 16 lines · Kalin KOZHUHAROV
Quoted 15 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)
o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Quoted 8 lines
Quoted 1 line

Cheers

Hey, I just crashed my system (2.6.6) as well :-(

Any more light on this?
Anybody, patches?

Kalin.

I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug. Any ideas?

Manuel

Signature · 1 line
Manuel Arostegui Ramirez #Linux Registered User 200896
#3 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 2 lines · Manuel

I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug. Any ideas?

I use 2.6.7-rc2-mm2, and the crash.c program produces the console race, 2.6.7-rc3 maybe not worth the effort mate.

How would I go about trapping SIGFPE to prevent end users of login server crashing the box, can anyone point me in the direction of advice? We really don't want to have to disable user logins!

Thanks,
- -David Connolly
admin2 on netsoc-dkit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAywcjHyDWKYgIFNcRAkcKAJ9rrp7s2h5HZhVP9/7OpMtGzljgAACfaEIx Ph+ubI+G3sJPC80AYhDqVnw=
=0EFM
-----END PGP SIGNATURE-----

#4 lore raw
In reply to Manuel Arostegui Ramirez
Quoted 2 lines · Manuel Arostegui Ramirez

I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug.

I just tried and 2.6.7-rc3 doesn't fix this bug. Ow well it's `just' a local crash. Annoying but not something big.

# Han

author
#5 lore raw
Quoted 8 lines · Han Boetes
Quoted 2 lines · Manuel Arostegui Ramirez

I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug.

I just tried and 2.6.7-rc3 doesn't fix this bug. Ow well it's `just' a local crash. Annoying but not something big.

Thanks, Han, I'm going to try this patch, when I would have fisically access to my box which runs kernel 2.4.20-8.
This is the orignaly thread for this discussion.
http://marc.theaimsgroup.com/?l=linux-kernel&m=108705340404567&w=2

This is the patch I'm going to try, Han:

[email protected] wrote:

kernel/signal.c 2004-06-12 renamed from kernel/signal.c 2004-02-18 14:36:32.000000000 +0100 +0 -0
diff -ur linux-2.4.26/kernel/signal.c linux-2.4.26-fpuhotfix/kernel/signal.c

15:26:10.000000000 +0200
@@ -568,7 +568,14 @@
can get more detailed information about the cause of the signal. */
if (sig < SIGRTMIN && sigismember(&t->pending.signal, sig))
+ {
+ if (sig==8)
+ {
+ printk("Attempt to exploit known bug, process=%s
pid=%d uid=%d\n", t->comm, t->pid, t->uid);
+ do_exit(0);
+ }

                goto out;

+ }

        ret = deliver_signal(sig, info, t);

out:

Signature · 1 line
Manuel Arostegui Ramirez #Linux Registered User 200896
#6 lore raw

Local DoS attack on i386 (was: new kernel bug)

In reply to Manuel Arostegui Ramirez
Quoted 6 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)

Quoted 8 lines

o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Seems to be a scheduler race or something?

Signature · 3 lines
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source www.scaramanga.co.uk/scaramanga.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
#7 lore raw

Re: Local DoS attack on i386 (was: new kernel bug)

Quoted 1 line · Gianni Tedesco

Seems to be a scheduler race or something?

sysrq+t shows the offending task (freezes here, doesnt even print "Call Trace:\n"):

evil R running 0 1964 1861 (NOTLB)

Signature · 3 lines
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source www.scaramanga.co.uk/scaramanga.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
author
#8 lore raw

Re: Local DoS attack on i386 (was: new kernel bug)

In reply to Gianni Tedesco
Quoted 16 lines · Gianni Tedesco
Quoted 6 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)

Quoted 8 lines

o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Quoted 1 line

Seems to be a scheduler race or something?

The timer and fpu stuff locks the console race, io-schedules also stops. This seems serious.
Look at the original thread, it's called:
"timer + fpu stuff locks my console race"
Here you are:
http://marc.theaimsgroup.com/?l=linux-kernel&m=108704334308688&w=2

Cheers

Signature · 1 line
Manuel Arostegui Ramirez #Linux Registered User 200896
#9 lore raw

Re: Local DoS attack on i386 (was: new kernel bug)

In reply to Gianni Tedesco
Quoted 16 lines · Gianni Tedesco
Quoted 6 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)

Quoted 8 lines

o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Quoted 2 lines

Seems to be a scheduler race or something?

This was already fixed in 2.6, see http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[email protected]?nav=index.html|src/.|src/include|src/include/asm-i386|hist/include/asm-i386/i387.h

The same fix should be applied to 2.4. I'm running locally a very hacked version of 2.4.22 with it and it survives that crash.c program.

Here's the diff. Marcelo, please merge.

include/asm-i386/i387.h renamed from include/asm-i386/i387.h~fix-x86-clear_fpu-macro +1 -1
@@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);
 
 #define clear_fpu( tsk ) do { \
 	if ( tsk->flags & PF_USEDFPU ) { \
-		asm volatile("fwait"); \
+		asm volatile("fnclex ; fwait"); \
 		tsk->flags &= ~PF_USEDFPU; \
 		stts(); \
 	} \
author
#10 lore raw

Re: Local DoS attack on i386 (was: new kernel bug)

Quoted 38 lines · Nuno Monteiro
Quoted 16 lines · Gianni Tedesco
Quoted 6 lines · Manuel Arostegui Ramirez

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.e
n Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)

Quoted 8 lines

o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Quoted 1 line

Seems to be a scheduler race or something?

This was already fixed in 2.6, see
http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[email protected]?n
av=index.html|src/.|src/include|src/include/asm-i386|hist/include/asm-i386/i 387.h

The same fix should be applied to 2.4. I'm running locally a very hacked version of 2.4.22 with it and it survives that crash.c program.

Here's the diff. Marcelo, please merge.

---
linux-2.4.27-pre5/include/asm-i386/i387.h~fix-x86-clear_fpu-macro 2004-06-1
4 15:12:13.909059344 +0100 +++
linux-2.4.27-pre5/include/asm-i386/i387.h 2004-06-14 15:12:45.970185312
+0100 @@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);

#define clear_fpu( tsk ) do { \

include/asm-i386/i387.h extern void kernel_fpu_begin(void);

Quoted 7 lines
include/asm-i386/i387.h renamed from include/asm-i386/i387.h~fix-x86-clear_fpu-macro +1 -2
 	if ( tsk->flags & PF_USEDFPU ) { \
-		asm volatile("fwait"); \
+		asm volatile("fnclex ; fwait"); \
 		tsk->flags &= ~PF_USEDFPU; \
 		stts(); \
 	} \
-

This diff fixed the bug in 2.4.X?
Thanks, Nuno, I'm going to apply it.
Best Regards

Signature · 1 line
Manuel Arostegui Ramirez #Linux Registered User 200896
#11 lore raw

Re: Local DoS attack on i386

In reply to Nuno Monteiro
Quoted 9 lines · Nuno Monteiro

The same fix should be applied to 2.4. I'm running locally a very hacked version of 2.4.22 with it and it survives that crash.c program.

Here's the diff. Marcelo, please merge.

include/asm-i386/i387.h extern void kernel_fpu_begin(void); · line 40

Quoted 8 lines
include/asm-i386/i387.h renamed from include/asm-i386/i387.h~fix-x86-clear_fpu-macro +1 -1
@@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);
 
 #define clear_fpu( tsk ) do { \
 	if ( tsk->flags & PF_USEDFPU ) { \
-		asm volatile("fwait"); \
+		asm volatile("fnclex ; fwait"); \
 		tsk->flags &= ~PF_USEDFPU; \
 		stts(); \
 	} \

You're missing x86-64.

Complete patches are up at <http://tomt.net/kernel/clear_fpu/> - these covers 2.4 and 2.6, plus i386 and x86-64.

But I guess Marcelo would want the x86-64 part to come through ak.

Signature · 2 lines
Cheers,
André Tomt