lkml.org 
[lkml]   [2003]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectBUG: Use after free in detach_pid
Hi Manfred, much quicker turnover if i leave it to you. kernel/box is SMP 
i triggered it whilst doing a find in a large NFS directory and writing
out 512M to that same directory.

187 }
188
189 static inline int __detach_pid(task_t *task, enum pid_type type)
190 {
191 struct pid_link *link = task->pids + type;
192 struct pid *pid = link->pidptr;
193 int nr;
194
195 list_del(&link->pid_chain); <==
196 if (!atomic_dec_and_test(&pid->count))

Unable to handle kernel paging request at virtual address 6b6b6b6b
printing eip:
c013479c
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0060:[<c013479c>] Not tainted
EFLAGS: 00010046
EIP is at detach_pid+0x1c/0xf0
eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 6b6b6b6b edx: c1bb93d0
esi: 00000000 edi: bfffef74 ebp: 00000000 esp: caaa3f08
ds: 007b es: 007b ss: 0068
Process bash (pid: 1292, threadinfo=caaa2000 task=cbb02560)
Stack: c1bb9380 00000000 bfffef74 00000000 c01232ec c1bb9380 c01233dc c1bb9380
c1bb9380 c1bb9944 c1bb9380 00000526 c01251cb c1bb9380 bfffef74 bfffef74
c1bb9424 c1bb9380 cbb02560 cbb025fc c0125681 c1bb9380 bfffef74 00000000
Call Trace:
[<c01232ec>] __unhash_process+0x10c/0x170
[<c01233dc>] release_task+0x8c/0x200
[<c01251cb>] wait_task_zombie+0x15b/0x1c0
[<c0125681>] sys_wait4+0x241/0x290
[<c011cb10>] default_wake_function+0x0/0x20
[<c011cb10>] default_wake_function+0x0/0x20
[<c0109477>] syscall_call+0x7/0xb

Code: 89 01 89 48 04 f0 ff 4b 04 0f 94 c0 31 f6 84 c0 74 1f 8b 43

--
function.linuxpower.ca
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:34    [W:0.132 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site