2004-06-12 10:01:44

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: new kernel bug

Somebody know a patch to solved this new bug?
http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
Affected versions:
* Linux 2.6.x
o Linux 2.6.7-rc2
o Linux 2.6.6 (all versions)
o Linux 2.6.6 SMP (verified by riven)
o Linux 2.6.5-gentoo (verified by RatiX)
o Linux 2.6.5-mm6 - (verified by Mariux)
* Linux 2.4.2x
o Linux 2.4.26 vanilla
o Linux 2.4.26-rc1 vanilla
o Linux 2.4.26-gentoo-r1
o Linux 2.4.22

Cheers

--
Manuel Arostegui Ramirez #Linux Registered User 200896


2004-06-12 12:33:37

by Kalin KOZHUHAROV

[permalink] [raw]
Subject: Re: new kernel bug

Manuel Arostegui Ramirez wrote:
> Somebody know a patch to solved this new bug?
> http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
> Affected versions:
> * Linux 2.6.x
> o Linux 2.6.7-rc2
> o Linux 2.6.6 (all versions)
> o Linux 2.6.6 SMP (verified by riven)
> o Linux 2.6.5-gentoo (verified by RatiX)
> o Linux 2.6.5-mm6 - (verified by Mariux)
> * Linux 2.4.2x
> o Linux 2.4.26 vanilla
> o Linux 2.4.26-rc1 vanilla
> o Linux 2.4.26-gentoo-r1
> o Linux 2.4.22
>
> Cheers
>

Hey, I just crashed my system (2.6.6) as well :-(

Any more light on this?
Anybody, patches?

Kalin.

--
||///_ o *****************************
||//'_/> WWW: http://ThinRope.net/
|||\/<"
|||\\ '
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

2004-06-12 12:40:28

by stian

[permalink] [raw]
Subject: Re: new kernel bug

You can keep an eye on the
"timer + fpu stuff locks my console race"
thread I orignaly created when I found the bug or see here for web version:
http://marc.theaimsgroup.com/?l=linux-kernel&m=108704334308688&w=2


I'll put on a quick 2.4.26 fix that should work (can't test, since my
linux box that I have physical access to isn't wired to the Internett
currently)


Stian Skjelstad

2004-06-12 12:45:10

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: Re: new kernel bug

El S?bado 12 Junio 2004 14:33, Kalin KOZHUHAROV escribi?:
> Manuel Arostegui Ramirez wrote:
> > Somebody know a patch to solved this new bug?
> > http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
> > Affected versions:
> > * Linux 2.6.x
> > o Linux 2.6.7-rc2
> > o Linux 2.6.6 (all versions)
> > o Linux 2.6.6 SMP (verified by riven)
> > o Linux 2.6.5-gentoo (verified by RatiX)
> > o Linux 2.6.5-mm6 - (verified by Mariux)
> > * Linux 2.4.2x
> > o Linux 2.4.26 vanilla
> > o Linux 2.4.26-rc1 vanilla
> > o Linux 2.4.26-gentoo-r1
> > o Linux 2.4.22
> >
> > Cheers
>
> Hey, I just crashed my system (2.6.6) as well :-(
>
> Any more light on this?
> Anybody, patches?
>
> Kalin.

I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug.
Any ideas?

Manuel


--
Manuel Arostegui Ramirez #Linux Registered User 200896

2004-06-12 12:50:55

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: Re: new kernel bug

El S?bado 12 Junio 2004 14:40, [email protected] escribi?:
> You can keep an eye on the
> "timer + fpu stuff locks my console race"
> thread I orignaly created when I found the bug or see here for web version:
> http://marc.theaimsgroup.com/?l=linux-kernel&m=108704334308688&w=2
>
>
> I'll put on a quick 2.4.26 fix that should work (can't test, since my
> linux box that I have physical access to isn't wired to the Internett
> currently)
>
>
> Stian Skjelstad
>
I'm going to fix it with that quick solution, I'll upgrade my 2.4.20-8
to 2.4.26 and the look at the "timer + fpu stuff locks my console race"
thread.
Lot of thakns, Stian.

Manuel
--
Manuel Arostegui Ramirez #Linux Registered User 200896

2004-06-12 13:37:21

by David Connolly

[permalink] [raw]
Subject: Re: new kernel bug

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Saturday 12 June 2004 13:42, Manuel wrote:
> I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that bug.
> Any ideas?

I use 2.6.7-rc2-mm2, and the crash.c program produces the console race,
2.6.7-rc3 maybe not worth the effort mate.

How would I go about trapping SIGFPE to prevent end users of login server
crashing the box, can anyone point me in the direction of advice? We really
don't want to have to disable user logins!

Thanks,
- -David Connolly
admin2 on netsoc-dkit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAywcjHyDWKYgIFNcRAkcKAJ9rrp7s2h5HZhVP9/7OpMtGzljgAACfaEIx
Ph+ubI+G3sJPC80AYhDqVnw=
=0EFM
-----END PGP SIGNATURE-----

2004-06-12 13:44:29

by stian

[permalink] [raw]
Subject: Re: new kernel bug

Can you try the patch that lies in this mail?
http://marc.theaimsgroup.com/?l=linux-kernel&m=108704705509728&w=2

I posted the bug orignaly in that thread since I didn't know much about it
yet (and it's not a race, but the kernel get stuck in a exception loop
beetween the program an the kernel while trying to make the SIGFPE)


Stian Skjelstad

2004-06-12 15:06:48

by Han

[permalink] [raw]
Subject: Re: new kernel bug

Manuel Arostegui Ramirez wrote:
> I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that
> bug.

I just tried and 2.6.7-rc3 doesn't fix this bug. Ow well it's `just' a
local crash. Annoying but not something big.



# Han

2004-06-12 15:21:24

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: Re: new kernel bug

El S?bado 12 Junio 2004 17:08, Han Boetes escribi?:
> Manuel Arostegui Ramirez wrote:
> > I'm thinking about download patch-2.6.7-rc3, maybe it will fixed that
> > bug.
>
> I just tried and 2.6.7-rc3 doesn't fix this bug. Ow well it's `just' a
> local crash. Annoying but not something big.
>
>
Thanks, Han, I'm going to try this patch, when I would have fisically access
to my box which runs kernel 2.4.20-8.
This is the orignaly thread for this discussion.
http://marc.theaimsgroup.com/?l=linux-kernel&m=108705340404567&w=2

This is the patch I'm going to try, Han:

[email protected] wrote:

diff -ur linux-2.4.26/kernel/signal.c linux-2.4.26-fpuhotfix/kernel/signal.c
--- linux-2.4.26/kernel/signal.c 2004-02-18 14:36:32.000000000 +0100
+++ linux-2.4.26-fpuhotfix/kernel/signal.c 2004-06-12
15:26:10.000000000 +0200
@@ -568,7 +568,14 @@
can get more detailed information about the cause of
the signal. */
if (sig < SIGRTMIN && sigismember(&t->pending.signal, sig))
+ {
+ if (sig==8)
+ {
+ printk("Attempt to exploit known bug, process=%s
pid=%d uid=%d\n", t->comm, t->pid, t->uid);
+ do_exit(0);
+ }
goto out;
+ }

ret = deliver_signal(sig, info, t);
out:


--
Manuel Arostegui Ramirez #Linux Registered User 200896

2004-06-14 13:58:49

by Gianni Tedesco

[permalink] [raw]
Subject: Local DoS attack on i386 (was: new kernel bug)

On Sat, 2004-06-12 at 11:59 +0200, Manuel Arostegui Ramirez wrote:
> Somebody know a patch to solved this new bug?
> http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
> Affected versions:
> * Linux 2.6.x
> o Linux 2.6.7-rc2
> o Linux 2.6.6 (all versions)
> o Linux 2.6.6 SMP (verified by riven)
> o Linux 2.6.5-gentoo (verified by RatiX)
> o Linux 2.6.5-mm6 - (verified by Mariux)
> * Linux 2.4.2x
> o Linux 2.4.26 vanilla
> o Linux 2.4.26-rc1 vanilla
> o Linux 2.4.26-gentoo-r1
> o Linux 2.4.22

Seems to be a scheduler race or something?

--
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source http://www.scaramanga.co.uk/scaramanga.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D


Attachments:
signature.asc (189.00 B)
This is a digitally signed message part

2004-06-14 14:05:33

by Gianni Tedesco

[permalink] [raw]
Subject: Re: Local DoS attack on i386 (was: new kernel bug)

On Mon, 2004-06-14 at 14:58 +0100, Gianni Tedesco wrote:
> Seems to be a scheduler race or something?

sysrq+t shows the offending task (freezes here, doesnt even print "Call
Trace:\n"):

evil R running 0 1964 1861 (NOTLB)

--
// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source http://www.scaramanga.co.uk/scaramanga.asc | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D


Attachments:
signature.asc (189.00 B)
This is a digitally signed message part

2004-06-14 14:09:10

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: Re: Local DoS attack on i386 (was: new kernel bug)

El Lunes 14 Junio 2004 15:58, Gianni Tedesco escribi?:
> On Sat, 2004-06-12 at 11:59 +0200, Manuel Arostegui Ramirez wrote:
> > Somebody know a patch to solved this new bug?
> > http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
> > Affected versions:
> > * Linux 2.6.x
> > o Linux 2.6.7-rc2
> > o Linux 2.6.6 (all versions)
> > o Linux 2.6.6 SMP (verified by riven)
> > o Linux 2.6.5-gentoo (verified by RatiX)
> > o Linux 2.6.5-mm6 - (verified by Mariux)
> > * Linux 2.4.2x
> > o Linux 2.4.26 vanilla
> > o Linux 2.4.26-rc1 vanilla
> > o Linux 2.4.26-gentoo-r1
> > o Linux 2.4.22
>
> Seems to be a scheduler race or something?

The timer and fpu stuff locks the console race, io-schedules also stops.
This seems serious.
Look at the original thread, it's called:
"timer + fpu stuff locks my console race"
Here you are:
http://marc.theaimsgroup.com/?l=linux-kernel&m=108704334308688&w=2

Cheers

--
Manuel Arostegui Ramirez #Linux Registered User 200896

2004-06-14 14:23:27

by Nuno Monteiro

[permalink] [raw]
Subject: Re: Local DoS attack on i386 (was: new kernel bug)


On 2004.06.14 14:58, Gianni Tedesco wrote:
> On Sat, 2004-06-12 at 11:59 +0200, Manuel Arostegui Ramirez wrote:
> > Somebody know a patch to solved this new bug?
> > http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.en
> > Affected versions:
> > * Linux 2.6.x
> > o Linux 2.6.7-rc2
> > o Linux 2.6.6 (all versions)
> > o Linux 2.6.6 SMP (verified by riven)
> > o Linux 2.6.5-gentoo (verified by RatiX)
> > o Linux 2.6.5-mm6 - (verified by Mariux)
> > * Linux 2.4.2x
> > o Linux 2.4.26 vanilla
> > o Linux 2.4.26-rc1 vanilla
> > o Linux 2.4.26-gentoo-r1
> > o Linux 2.4.22
>
> Seems to be a scheduler race or something?
>

This was already fixed in 2.6, see http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[email protected]?nav=index.html|src/.|src/include|src/include/asm-i386|hist/include/asm-i386/i387.h


The same fix should be applied to 2.4. I'm running locally a very
hacked version of 2.4.22 with it and it survives that crash.c program.

Here's the diff. Marcelo, please merge.


--- linux-2.4.27-pre5/include/asm-i386/i387.h~fix-x86-clear_fpu-macro 2004-06-14 15:12:13.909059344 +0100
+++ linux-2.4.27-pre5/include/asm-i386/i387.h 2004-06-14 15:12:45.970185312 +0100
@@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);

#define clear_fpu( tsk ) do { \
if ( tsk->flags & PF_USEDFPU ) { \
- asm volatile("fwait"); \
+ asm volatile("fnclex ; fwait"); \
tsk->flags &= ~PF_USEDFPU; \
stts(); \
} \

2004-06-14 14:59:59

by Manuel Arostegui Ramirez

[permalink] [raw]
Subject: Re: Local DoS attack on i386 (was: new kernel bug)

El Lunes 14 Junio 2004 16:20, Nuno Monteiro escribi?:
> On 2004.06.14 14:58, Gianni Tedesco wrote:
> > On Sat, 2004-06-12 at 11:59 +0200, Manuel Arostegui Ramirez wrote:
> > > Somebody know a patch to solved this new bug?
> > > http://reviewed.homelinux.org/news/2004-06-11_kernel_crash/index.html.e
> > >n Affected versions:
> > > * Linux 2.6.x
> > > o Linux 2.6.7-rc2
> > > o Linux 2.6.6 (all versions)
> > > o Linux 2.6.6 SMP (verified by riven)
> > > o Linux 2.6.5-gentoo (verified by RatiX)
> > > o Linux 2.6.5-mm6 - (verified by Mariux)
> > > * Linux 2.4.2x
> > > o Linux 2.4.26 vanilla
> > > o Linux 2.4.26-rc1 vanilla
> > > o Linux 2.4.26-gentoo-r1
> > > o Linux 2.4.22
> >
> > Seems to be a scheduler race or something?
>
> This was already fixed in 2.6, see
> http://linux.bkbits.net:8080/linux-2.5/diffs/include/asm-i386/[email protected]?n
>av=index.html|src/.|src/include|src/include/asm-i386|hist/include/asm-i386/i
>387.h
>
>
> The same fix should be applied to 2.4. I'm running locally a very
> hacked version of 2.4.22 with it and it survives that crash.c program.
>
> Here's the diff. Marcelo, please merge.
>
>
> ---
> linux-2.4.27-pre5/include/asm-i386/i387.h~fix-x86-clear_fpu-macro 2004-06-1
>4 15:12:13.909059344 +0100 +++
> linux-2.4.27-pre5/include/asm-i386/i387.h 2004-06-14 15:12:45.970185312
> +0100 @@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);
>
> #define clear_fpu( tsk ) do { \
> if ( tsk->flags & PF_USEDFPU ) { \
> - asm volatile("fwait"); \
> + asm volatile("fnclex ; fwait"); \
> tsk->flags &= ~PF_USEDFPU; \
> stts(); \
> } \
> -

This diff fixed the bug in 2.4.X?
Thanks, Nuno, I'm going to apply it.
Best Regards

--
Manuel Arostegui Ramirez #Linux Registered User 200896

2004-06-15 04:34:43

by Andre Tomt

[permalink] [raw]
Subject: Re: Local DoS attack on i386

Nuno Monteiro wrote:
> The same fix should be applied to 2.4. I'm running locally a very
> hacked version of 2.4.22 with it and it survives that crash.c program.
>
> Here's the diff. Marcelo, please merge.
>
>
> --- linux-2.4.27-pre5/include/asm-i386/i387.h~fix-x86-clear_fpu-macro 2004-06-14 15:12:13.909059344 +0100
> +++ linux-2.4.27-pre5/include/asm-i386/i387.h 2004-06-14 15:12:45.970185312 +0100
> @@ -34,7 +34,7 @@ extern void kernel_fpu_begin(void);
>
> #define clear_fpu( tsk ) do { \
> if ( tsk->flags & PF_USEDFPU ) { \
> - asm volatile("fwait"); \
> + asm volatile("fnclex ; fwait"); \
> tsk->flags &= ~PF_USEDFPU; \
> stts(); \
> } \

You're missing x86-64.

Complete patches are up at <http://tomt.net/kernel/clear_fpu/> - these
covers 2.4 and 2.6, plus i386 and x86-64.

But I guess Marcelo would want the x86-64 part to come through ak.

--
Cheers,
Andr? Tomt