Page 1 of 1

crash in fs/anon_inodes.c

PostPosted: Sat Mar 29, 2014 4:51 pm
by androsyn
It looks like the following change broke for me:
commit 07944030e3c21211bb0c663084340c7929d0a90c
Author: Jan Kara <jack@suse.cz>
Date: Tue Mar 25 21:37:09 2014 +0100

Upstream commit: d6f2589ad561aa5fa39f347eca6942668b7560a1

fs: Avoid userspace mounting anon_inodefs filesystem

anon_inodefs filesystem is a kernel internal filesystem userspace
shouldn't mess with. Remove registration of it so userspace cannot
even try to mount it (which would fail anyway because the filesystem is
MS_NOUSER).


[<00128b78>] ? strlcpy+0x18/0x7b
[<00130eaf>] __list_add+0x11/0x24
[<0007660a>] sget+0x256/0x274
[<00075e60>] ? get_anon_bdev+0xa0/0xa0
[<0008fffb>] mount_pseudo+0x20/0x122
[<000a4f6b>] anon_inodefs_mount+0x21/0x23
[<00076f46>] mount_fs+0x16/0xb9
[<0008b38b>] ? alloc_vfsmnt+0x72/0x111
[<0008b4e7>] vfs_kern_mount+0x3c/0x83
[<00400000>] ? 0x3fffff
[<0100cf7e>] ? eventpoll_init+0xb5/0xb5
[<0008b541>] kern_mount_data+0x13/0x15
[<0100cf91>] anon_inode_init+0x13/0xcc
[<0100c5bc>] ? init_pipe_fs+0x20/0x3d
[<000020d1>] do_one_initcall+0xd1/0x11f
[<01000717>] ? start_kernel+0x28a/0x28a
[<00125bdc>] ? radix_tree_lookup+0xa/0xc
[<00043538>] ? irq_to_desc+0xf/0x11
[<01000717>] ? start_kernel+0x28a/0x28a
[<0100079c>] kernel_init+0x85/0x118
[<0030b342>] kernel_thread_helper+0x6/0xd


If I back out this part of the patch, my system boots up fine without a panic.

Re: crash in fs/anon_inodes.c

PostPosted: Sat Mar 29, 2014 6:04 pm
by spender
Can you post the full oops from dmesg?

-Brad

Re: crash in fs/anon_inodes.c

PostPosted: Sat Mar 29, 2014 10:42 pm
by androsyn
Sure thing, I had issues pasting it from the serial terminal before and lost half of the oops. I just crashed the system again. Let me know what else I can provide.

Thanks,

Aaron

Loading /vmlinuz-3.2.55-bad.....
Loading /initrd.img-3.2.55-grsec.....ready.
Linux version 3.2.55-grsec (androsyn@salem) (gcc version 4.8.2 (Debian 4.8.2-17) ) #6 Sat Mar 29 22:31:30 EDT 2014
KERNEL supported cpus:
AMD AuthenticAMD
BIOS-provided physical RAM map:
BIOS-e820: 0000000000000000 - 000000000009fc00 (usable)
BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved)
BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved)
BIOS-e820: 0000000000100000 - 0000000010000000 (usable)
BIOS-e820: 00000000fff00000 - 0000000100000000 (reserved)
Notice: NX (Execute Disable) protection missing in CPU!
last_pfn = 0x10000 max_arch_pfn = 0x100000
init_memory_mapping: 0000000000000000-0000000010000000
RAMDISK: 0fd77000 - 0ffff000
256MB LOWMEM available.
mapped low ram: 0 - 10000000
low ram: 0 - 10000000
Zone PFN ranges:
DMA 0x00000001 -> 0x00001000
Normal 0x00001000 -> 0x00010000
Movable zone start PFN for each node
early_node_map[2] active PFN ranges
0: 0x00000001 -> 0x0000009f
0: 0x00000100 -> 0x00010000
Allocating PCI resources starting at 10000000 (gap: 10000000:eff00000)
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 64926
Kernel command line: initrd=/initrd.img-3.2.55-grsec root=/dev/mapper/VG00-root ro console=ttyS0,115200n8 pc87360.init=3 geodewdt.nowayout=1 BOOT_IMAGE=/vmlinuz-3.2.55-bad
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Initializing CPU#0
Memory: 239752k/262144k available (8192k kernel code, 22000k reserved, 147k data, 188k init, 0k highmem)
virtual kernel memory layout:
fixmap : 0xfffe4000 - 0xfffff000 ( 108 kB)
vmalloc : 0xd0800000 - 0xfffe2000 ( 759 MB)
lowmem : 0xc0000000 - 0xd0000000 ( 256 MB)
.init : 0xc2000000 - 0xc202f000 ( 188 kB)
.data : 0xc1c00000 - 0xc1c24f20 ( 147 kB)
.text : 0xc1000000 - 0xc1800000 (8192 kB)
Checking if this processor honours the WP bit even in supervisor mode...Ok.
SLUB: Genslabs=15, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:16 nr_irqs:16 16
console [ttyS0] enabled
Fast TSC calibration using PIT
Detected 433.298 MHz processor.
Calibrating delay loop (skipped), value calculated using timer frequency.. 866.59 BogoMIPS (lpj=4332980)
pid_max: default: 32768 minimum: 501
Mount-cache hash table entries: 512
CPU: Geode(TM) Integrated Processor by AMD PCS stepping 02
Performance Events: no PMU driver, software events only.
NMI watchdog disabled (cpu0): hardware events not enabled
devtmpfs: initialized
NET: Registered protocol family 16
Soekris net5501: comBIOS ver. 1.33c 20080626
PCI: Using configuration type 1 for base access
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI: Probing PCI hardware
pci 0000:00:14.0: CS5536 ISA bridge bug detected (incorrect header); workaround applied.
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource pit
PAX: suspicious general protection fault: 0000 [#1]
Modules linked in:

Pid: 1, comm: swapper Not tainted 3.2.55-grsec #6
EIP: 0060:[<00130e33>] EFLAGS: 00010286 CPU: 0
EAX: cf4933a8 EBX: cf4933a8 ECX: 00000000 EDX: c1c0b4d8
ESI: c1c0b4d8 EDI: 00000000 EBP: cf429ecc ESP: cf429eb8
DS: 0068 ES: 0068 FS: 0000 GS: 0068 SS: 0068
Process swapper (pid: 1, ti=cf424324 task=cf424000 task.ti=cf424324)
Stack:
cf493294 c1c0b4c0 cf429ee0 00128b78 cf4933a8 cf429ee0 00130eaf 00000000
cf493200 c1c0b4c0 cf429f00 0007660a 00075e60 c1c0b4c0 c1c0b4d8 cf40e640
00000000 c18c0666 cf429f24 0008fffb 00000000 cf40e668 00000000 c2081118
Call Trace:
[<00128b78>] ? strlcpy+0x18/0x7b
[<00130eaf>] __list_add+0x11/0x24
[<0007660a>] sget+0x256/0x274
[<00075e60>] ? get_anon_bdev+0xa0/0xa0
[<0008fffb>] mount_pseudo+0x20/0x122
[<000a4f6b>] anon_inodefs_mount+0x21/0x23
[<00076f46>] mount_fs+0x16/0xb9
[<0008b38b>] ? alloc_vfsmnt+0x72/0x111
[<0008b4e7>] vfs_kern_mount+0x3c/0x83
[<00400000>] ? 0x3fffff
[<0100cf7e>] ? eventpoll_init+0xb5/0xb5
[<0008b541>] kern_mount_data+0x13/0x15
[<0100cf91>] anon_inode_init+0x13/0xcc
[<0100c5bc>] ? init_pipe_fs+0x20/0x3d
[<000020d1>] do_one_initcall+0xd1/0x11f
[<01000717>] ? start_kernel+0x28a/0x28a
[<00125bdc>] ? radix_tree_lookup+0xa/0xc
[<00043538>] ? irq_to_desc+0xf/0x11
[<01000717>] ? start_kernel+0x28a/0x28a
[<0100079c>] kernel_init+0x85/0x118
[<0030b342>] kernel_thread_helper+0x6/0xd
Code: e0 10 81 e1 0f 0f 0f 0f 01 c2 89 c8 c1 e0 08 01 c8 89 c1 c1 e1 10 01 c8 c1 ea 18 c1 e8 18 01 d0 5a 59 5d c3 55 89 e5 53 83 ec 10 <8b> 59 04 39 d3 75 4a 8b 13 39 d1 75 2a 39 c3 74 0c 39 c1 74 08
EIP: [<00130e33>] __list_add_debug+0x7/0x72 SS:ESP 0068:cf429eb8
---[ end trace bcdeb228ccf82a85 ]---
Kernel panic - not syncing: grsec: halting the system due to suspicious kernel crash caused by root


POST: 012345689bcefghips1234ajklnopqr,,,tvwxy



Re: crash in fs/anon_inodes.c

PostPosted: Sun Mar 30, 2014 9:02 am
by spender
Hi,

Thanks, this is fixed in the latest patch: https://grsecurity.net/~spender/changelog-stable2.txt

-Brad