Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-10 Thread Maneesh Soni
On Wed, Aug 10, 2005 at 03:35:53PM -0700, Greg KH wrote: > On Wed, Aug 10, 2005 at 03:36:36PM +0530, Maneesh Soni wrote: > > On Wed, Aug 10, 2005 at 04:26:51PM +1000, Keith Owens wrote: > > > FYI, the intermittent free after use in sysfs is still there in > > > 2.6.13-rc6. > > > > > > > The race

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-10 Thread Greg KH
On Wed, Aug 10, 2005 at 03:36:36PM +0530, Maneesh Soni wrote: > On Wed, Aug 10, 2005 at 04:26:51PM +1000, Keith Owens wrote: > > FYI, the intermittent free after use in sysfs is still there in > > 2.6.13-rc6. > > > > The race condition is known here. It is some thing in the upper layer. > In thi

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-10 Thread Maneesh Soni
On Wed, Aug 10, 2005 at 04:26:51PM +1000, Keith Owens wrote: > FYI, the intermittent free after use in sysfs is still there in > 2.6.13-rc6. > The race condition is known here. It is some thing in the upper layer. In this case "driver/base/class.c" which frees the kobject's attributes even if t

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-09 Thread Keith Owens
FYI, the intermittent free after use in sysfs is still there in 2.6.13-rc6. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-02 Thread Greg KH
On Tue, Aug 02, 2005 at 01:34:22PM +0530, Maneesh Soni wrote: > Looks like the attribute structure is allocated dynamically and > is freed before the sysfs_release() is called? > > Basically it could be like this.. > > file (/sys/class/vc/vcs16/dev) is still open and the corresponding > attribute

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-02 Thread Maneesh Soni
On Tue, Aug 02, 2005 at 01:05:50PM +1000, Keith Owens wrote: > On Mon, 1 Aug 2005 12:03:21 -0700, > Andrew Morton <[EMAIL PROTECTED]> wrote: > >Keith Owens <[EMAIL PROTECTED]> wrote: > >> > >> On Sat, 30 Jul 2005 02:29:55 -0700, > >> Andrew Morton <[EMAIL PROTECTED]> wrote: > >> >Keith Owens <[EMAI

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-01 Thread Keith Owens
On Tue, 02 Aug 2005 13:05:50 +1000, Keith Owens <[EMAIL PROTECTED]> wrote: >The vcsnn value varies. I traced the dentry parent chain for the >latest event. From bottom to top the d_name entries are > > dev, vcs16, vc, class, /. > >That makes no sense, why is dev a child of vcs16? Raw data at t

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-01 Thread Keith Owens
On Mon, 1 Aug 2005 12:03:21 -0700, Andrew Morton <[EMAIL PROTECTED]> wrote: >Keith Owens <[EMAIL PROTECTED]> wrote: >> >> On Sat, 30 Jul 2005 02:29:55 -0700, >> Andrew Morton <[EMAIL PROTECTED]> wrote: >> >Keith Owens <[EMAIL PROTECTED]> wrote: >> >> >> >> 2.6.13-rc4 + kdb, with lots of CONFIG_DEBU

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-01 Thread Andrew Morton
Keith Owens <[EMAIL PROTECTED]> wrote: > > On Sat, 30 Jul 2005 02:29:55 -0700, > Andrew Morton <[EMAIL PROTECTED]> wrote: > >Keith Owens <[EMAIL PROTECTED]> wrote: > >> > >> 2.6.13-rc4 + kdb, with lots of CONFIG_DEBUG options. There is an > >> intermittent use after free in class_device_attr_show

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-01 Thread Keith Owens
Another (different) manifestation of use after free in sysfs. It broke on module_put(owner) in sysfs_release(). FWIW this ia64 build is uni-processor, so there is a lot more context switching than normally occurs on udev. fill_kobj_path: path = '/class/vc/vcs2' kobject_hotplug: /sbin/hotplug vc

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-08-01 Thread Keith Owens
On Sat, 30 Jul 2005 02:29:55 -0700, Andrew Morton <[EMAIL PROTECTED]> wrote: >Keith Owens <[EMAIL PROTECTED]> wrote: >> >> 2.6.13-rc4 + kdb, with lots of CONFIG_DEBUG options. There is an >> intermittent use after free in class_device_attr_show. Reboot with no >> changes and the problem does no

Re: 2.6.13-rc4 use after free in class_device_attr_show

2005-07-30 Thread Andrew Morton
Keith Owens <[EMAIL PROTECTED]> wrote: > > 2.6.13-rc4 + kdb, with lots of CONFIG_DEBUG options. There is an > intermittent use after free in class_device_attr_show. Reboot with no > changes and the problem does not always recur. > ... > ip is at class_device_attr_show+0x50/0xa0 > ... > > Cal

2.6.13-rc4 use after free in class_device_attr_show

2005-07-29 Thread Keith Owens
2.6.13-rc4 + kdb, with lots of CONFIG_DEBUG options. There is an intermittent use after free in class_device_attr_show. Reboot with no changes and the problem does not always recur. Starting SSH daemon done Starting sound driver