lkml.org 
[lkml]   [2014]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf_fuzzer compiled for x32 causes reboot
On Mon, 24 Feb 2014, Vince Weaver wrote:

> Just touching the mmap page with a write of a single byte (it doesn't
> matter where) is enough to trigger the bug.

OK, investigating this more.

perf_fuzzer-2971 [000] 154.944114: page_fault_user: address=0xf7729000 ip=0x41efab error_code=0x6
perf_fuzzer-2971 [000] 154.944118: function: ip=0xffffffff810d40e7 parent_ip=0xffffffff810d0840
perf_fuzzer-2971 [000] 154.944119: function: ip=0xffffffff812a91a5 parent_ip=0xffffffff81013ff5
perf_fuzzer-2971 [000] 154.944120: function: ip=0xffffffff8153837c parent_ip=0xffffffff81535432
perf_fuzzer-2971 [000] 154.944121: page_fault_kernel: address=0x22e0 ip=0xffffffff812a7d5c error_code=0x0

It looks like there are two page faults. The first is caused by the user
code accessing the mmap'd page. It looks sort of normal and what you'd
expect if the perf_event mmap ring buffer is being accessed for the first
time.

What follows is a kernel page fault, and this is the one where for
whatever reason CR2 has obtained the value of the userspace RBP register.

Vince




\
 
 \ /
  Last update: 2014-02-25 07:04    [W:0.272 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site