2.6.13-rc4 use after free in class_device_attr_show

[Keith Owens]

2.6.13-rc4 + kdb, with lots of CONFIG_DEBUG options.  There is an
intermittent use after free in class_device_attr_show.  Reboot with no
changes and the problem does not always recur.

Starting SSH daemon                                                   done
Starting sound driver                                                 done
Starting cupsd                                                        done
loading ACPI modules () Starting powersaved                           done
Try to get initial date and time via NTP from  ntp0                   done
Starting network time protocol daemon (NTPD)                          done
Starting kernel based NFS server                                      done
Starting service automounter                                          done
udev[21369]: Oops 8813272891392 [1]

udev[21369]: Oops 8813272891392 [1]
Modules linked in: md5 ipv6 usbcore raid0 md_mod nls_iso8859_1 nls_cp437 dm_mod sg st osst

Pid: 21369, CPU 0, comm:                 udev
psr : 00001010081a6018 ifs : 8000000000000308 ip  : [<a0000001005807b0>]    Not tainted
ip is at class_device_attr_show+0x50/0xa0
unat: 0000000000000000 pfs : 0000000000000711 rsc : 0000000000000003
rnat: a000000100abbae0 bsps: 00000000000001fb pr  : 0000000000159659
ldrs: 0000000000000000 ccv : 0000000000000000 fpsr: 0009804c0270033f
csd : 0000000000000000 ssd : 0000000000000000
b0  : a00000010025def0 b6  : a00000010000e8c0 b7  : a000000100580760
f6  : 1003e6db6db6db6db6db7 f7  : 1003e0000000000c1d6ca
f8  : 1003e0000000000c1d6ca f9  : 1003e00000000054cdf86
f10 : 000000000000000000000 f11 : 000000000000000000000
r1  : a000000100ddf0a0 r2  : e000003072ab7288 r3  : e00000300301c498
r8  : 0000000000000000 r9  : a000000100bfb5d0 r10 : e000003075b28000
r11 : 0000000000c1d6ca r12 : e000003076ce7e20 r13 : e000003076ce0000
r14 : a000000100580760 r15 : e000003075b28000 r16 : 6db6db6db6db6db7
r17 : 000000002a66fc30 r18 : a0007fff62138000 r19 : e0000030030102c8
r20 : e000003003010000 r21 : fffffffffffefcf1 r22 : 0000000000000010
r23 : a000000100d46c50 r24 : a000000100bfb5d0 r25 : 00000000054cdf86
r26 : a0000001009968c8 r27 : e000003003015208 r28 : 0000000000000000
r29 : e000003003010000 r30 : a000000100d46c50 r31 : 0000000000000000

Call Trace:
 [<a000000100011f80>] show_stack+0x80/0xa0
                                sp=e000003076ce79c0 bsp=e000003076ce10d8
 [<a0000001000127f0>] show_regs+0x850/0x880
                                sp=e000003076ce7b90 bsp=e000003076ce1078
 [<a00000010003c000>] die+0x280/0x4a0
                                sp=e000003076ce7ba0 bsp=e000003076ce1028
 [<a000000100060ad0>] ia64_do_page_fault+0x650/0xba0
                                sp=e000003076ce7ba0 bsp=e000003076ce0fb8
 [<a00000010000b6c0>] ia64_leave_kernel+0x0/0x290
                                sp=e000003076ce7c50 bsp=e000003076ce0fb8
 [<a0000001005807b0>] class_device_attr_show+0x50/0xa0
                                sp=e000003076ce7e20 bsp=e000003076ce0f78
 [<a00000010025def0>] sysfs_read_file+0x2b0/0x360
                                sp=e000003076ce7e20 bsp=e000003076ce0f08
 [<a000000100198a40>] vfs_read+0x1c0/0x360
                                sp=e000003076ce7e20 bsp=e000003076ce0eb0
 [<a000000100198d80>] sys_read+0x80/0xe0
                                sp=e000003076ce7e20 bsp=e000003076ce0e38
 [<a00000010000b520>] ia64_ret_from_syscall+0x0/0x20
                                sp=e000003076ce7e30 bsp=e000003076ce0e38
kdb> id class_device_attr_show
0xa000000100580760 class_device_attr_show[MII]       alloc r36=ar.pfs,8,6,0
0xa000000100580766 class_device_attr_show+0x6            mov r8=r0;;
0xa00000010058076c class_device_attr_show+0xc            adds r2=24,r33

0xa000000100580770 class_device_attr_show+0x10[MMI]       mov r37=r1
0xa000000100580776 class_device_attr_show+0x16            mov r39=r34
0xa00000010058077c class_device_attr_show+0x1c            adds r38=-16,r32

0xa000000100580780 class_device_attr_show+0x20[MII]       nop.m 0x0
0xa000000100580786 class_device_attr_show+0x26            mov r35=b0;;
0xa00000010058078c class_device_attr_show+0x2c            mov.i ar.pfs=r36

0xa000000100580790 class_device_attr_show+0x30[MII]       ld8 r33=[r2]
0xa000000100580796 class_device_attr_show+0x36            mov b0=r35;;
0xa00000010058079c class_device_attr_show+0x3c            cmp.eq p8,p9=0,r33

0xa0000001005807a0 class_device_attr_show+0x40[MBB]       nop.m 0x0
0xa0000001005807a6 class_device_attr_show+0x46      (p09) br.cond.dpnt.few 0xa0000001005807b0 class_device_attr_show+0x50
0xa0000001005807ac class_device_attr_show+0x4c            br.ret.sptk.many b0

0xa0000001005807b0 class_device_attr_show+0x50[MMI]       ld8 r8=[r33],8;;
0xa0000001005807b6 class_device_attr_show+0x56            ld8 r1=[r33],-8
0xa0000001005807bc class_device_attr_show+0x5c            mov b7=r8

0xa0000001005807c0 class_device_attr_show+0x60[MIB]       nop.m 0x0
0xa0000001005807c6 class_device_attr_show+0x66            nop.i 0x0
0xa0000001005807cc class_device_attr_show+0x6c            br.call.sptk.many b0=b7;;

0xa0000001005807d0 class_device_attr_show+0x70[MII]       mov r1=r37
0xa0000001005807d6 class_device_attr_show+0x76            mov.i ar.pfs=r36
0xa0000001005807dc class_device_attr_show+0x7c            mov b0=r35

kdb> r s
 r32: e00000b4793c37e8  r33: 6b6b6b6b6b6b6b6b  r34: e000003075b28000
 r35: a00000010025def0  r36: 0000000000000711  r37: a000000100ddf0a0
 r38: e00000b4793c37d8  r39: e000003075b28000
kdb> mds 0xe000003072ab7288
0xe000003072ab7288 6b6b6b6b6b6b6b6b   kkkkkkkk
0xe000003072ab7290 6b6b6b6b6b6b6b6b   kkkkkkkk
0xe000003072ab7298 6b6b6b6b6b6b6b6b   kkkkkkkk
0xe000003072ab72a0 6b6b6b6b6b6b6b6b   kkkkkkkk
0xe000003072ab72a8 a56b6b6b6b6b6b6b   kkkkkkk.
0xe000003072ab72b0 5a2cf071   q.,Z....
0xe000003072ab72b8 a000000100459640 linvfs_follow_link+0x1e0
0xe000003072ab72c0 5a2cf071   q.,Z....
[<a000000000010640>] __kernel_syscall_via_break+0x0/
                                sp=e000003076ce8000 bsp=e000003076ce0e38


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/