dirtycow / dirtycow.github.io

Dirty COW
https://dirtycow.ninja
3.35k stars 940 forks source link

Triggering vuln often hangs machines (oops log in post) #16

Closed jpouellet closed 8 years ago

jpouellet commented 8 years ago

Not sure of a better place to share this, so here:

[  377.279334] kernel BUG at /home/user/rpmbuild/BUILD/kernel-4.4.14/linux-4.4.14/fs/ext4/inode.c:2422!
[  377.279352] invalid opcode: 0000 [#1] SMP 
[  377.279368] Modules linked in: fuse ip6table_filter ip6_tables xt_conntrack ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp crct10dif_pclmul xen_netfront crc32_pclmul crc32c_intel pcspkr dummy_hcd udc_core xen_blkback xenfs xen_privcmd u2mfn(O) xen_blkfront
[  377.279481] CPU: 0 PID: 6 Comm: kworker/u4:0 Tainted: G           O    4.4.14-11.pvops.qubes.x86_64 #1
[  377.279507] Workqueue: writeback wb_workfn (flush-251:0)
[  377.279523] task: ffff880013799e00 ti: ffff8800137a4000 task.ti: ffff8800137a4000
[  377.279537] RIP: e030:[<ffffffff812acace>]  [<ffffffff812acace>] mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.279563] RSP: e02b:ffff8800137a7918  EFLAGS: 00010246
[  377.279574] RAX: 003fff800001007d RBX: ffff8800137a7938 RCX: 0000000000000000
[  377.279587] RDX: 0000000080000000 RSI: 0000000000000000 RDI: ffff880003b40aa8
[  377.279599] RBP: ffff8800137a79e8 R08: 0000000000000000 R09: 0000000000000040
[  377.279613] R10: 0000000000000000 R11: 0000000000000220 R12: ffffffffffffffff
[  377.279627] R13: 0000000000000800 R14: ffffea00039c1cc0 R15: ffff8800137a7a90
[  377.279655] FS:  0000000000000000(0000) GS:ffff880013e00000(0000) knlGS:ffff880012900000
[  377.279682] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[  377.279698] CR2: 0000555d8299c6f0 CR3: 0000000011db9000 CR4: 0000000000042660
[  377.279717] Stack:
[  377.279729]  0000000000000000 ffff880003b40aa0 ffff8800137a7938 0000000000000001
[  377.279760]  0000000000000001 0000000000000000 ffffea00039c1cc0 0000000000000000
[  377.279792]  ffff8800137a79a8 ffffffff812f946b fffffffffffffff4 ffff880002400040
[  377.279823] Call Trace:
[  377.279844]  [<ffffffff812f946b>] ? jbd2__journal_start+0xdb/0x1e0
[  377.279867]  [<ffffffff812b0920>] ? ext4_writepages+0x3b0/0xd70
[  377.279889]  [<ffffffff812dfc6d>] ? __ext4_journal_start_sb+0x6d/0x120
[  377.279911]  [<ffffffff812b0943>] ext4_writepages+0x3d3/0xd70
[  377.279937]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.279966]  [<ffffffff811ab82b>] ? generic_writepages+0x5b/0x80
[  377.279991]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.280021]  [<ffffffff811adcae>] do_writepages+0x1e/0x30
[  377.280041]  [<ffffffff8124d9e5>] __writeback_single_inode+0x45/0x330
[  377.280059]  [<ffffffff8124e1e2>] writeback_sb_inodes+0x262/0x600
[  377.280059]  [<ffffffff8124e60c>] __writeback_inodes_wb+0x8c/0xc0
[  377.280059]  [<ffffffff8124e963>] wb_writeback+0x253/0x310
[  377.280059]  [<ffffffff8123b841>] ? get_nr_dirty_inodes+0x51/0x80
[  377.280059]  [<ffffffff8124f1cf>] wb_workfn+0x2df/0x3f0
[  377.280059]  [<ffffffff810b724e>] process_one_work+0x15e/0x430
[  377.280059]  [<ffffffff810b756e>] worker_thread+0x4e/0x460
[  377.280059]  [<ffffffff810b7520>] ? process_one_work+0x430/0x430
[  377.280059]  [<ffffffff810bd548>] kthread+0xd8/0xf0
[  377.280059]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.280059]  [<ffffffff81756c8f>] ret_from_fork+0x3f/0x70
[  377.280059]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.280059] Code: c0 eb a3 4c 89 f7 e8 f2 26 ef ff e9 a1 fe ff ff be 0d 00 00 00 4c 89 f7 e8 60 22 ef ff 49 8b 06 f6 c4 20 0f 84 d3 fe ff ff 0f 0b <0f> 0b 48 8d bd 50 ff ff ff e8 f4 3e f0 ff eb af e8 fd 26 df ff 
[  377.280059] RIP  [<ffffffff812acace>] mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.280059]  RSP <ffff8800137a7918>
[  377.280640] ---[ end trace a311745f90e0a79b ]---
[  377.280656] ------------[ cut here ]------------
[  377.280689] WARNING: CPU: 0 PID: 6 at /home/user/rpmbuild/BUILD/kernel-4.4.14/linux-4.4.14/kernel/exit.c:661 do_exit+0x5f/0xae0()
[  377.280716] Modules linked in: fuse ip6table_filter ip6_tables xt_conntrack ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp crct10dif_pclmul xen_netfront crc32_pclmul crc32c_intel pcspkr dummy_hcd udc_core xen_blkback xenfs xen_privcmd u2mfn(O) xen_blkfront
[  377.280870] CPU: 0 PID: 6 Comm: kworker/u4:0 Tainted: G      D    O    4.4.14-11.pvops.qubes.x86_64 #1
[  377.280901] Workqueue: writeback wb_workfn (flush-251:0)
[  377.280920]  0000000000000200 000000001ab54008 ffff8800137a7620 ffffffff813b06f3
[  377.280951]  0000000000000000 ffffffff81a52458 ffff8800137a7658 ffffffff8109f402
[  377.280984]  ffff880013799e00 000000000000000b ffff8800137a7868 0000000000000000
[  377.281018] Call Trace:
[  377.281040]  [<ffffffff813b06f3>] dump_stack+0x63/0x90
[  377.281059]  [<ffffffff8109f402>] warn_slowpath_common+0x82/0xc0
[  377.281077]  [<ffffffff8109f54a>] warn_slowpath_null+0x1a/0x20
[  377.281096]  [<ffffffff810a1d5f>] do_exit+0x5f/0xae0
[  377.281118]  [<ffffffff8101a751>] oops_end+0xa1/0xd0
[  377.281135]  [<ffffffff8101ac0b>] die+0x4b/0x70
[  377.281153]  [<ffffffff81017d21>] do_trap+0xb1/0x140
[  377.281170]  [<ffffffff810180a9>] do_error_trap+0x89/0x110
[  377.281191]  [<ffffffff812acace>] ? mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.281213]  [<ffffffff8138e6b0>] ? blk_sq_make_request+0x110/0x360
[  377.281233]  [<ffffffff81018610>] do_invalid_op+0x20/0x30
[  377.281251]  [<ffffffff8175849e>] invalid_op+0x1e/0x30
[  377.281296]  [<ffffffff812acace>] ? mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.281321]  [<ffffffff812ac948>] ? mpage_prepare_extent_to_map+0x148/0x2f0
[  377.281346]  [<ffffffff812f946b>] ? jbd2__journal_start+0xdb/0x1e0
[  377.281371]  [<ffffffff812b0920>] ? ext4_writepages+0x3b0/0xd70
[  377.281396]  [<ffffffff812dfc6d>] ? __ext4_journal_start_sb+0x6d/0x120
[  377.281421]  [<ffffffff812b0943>] ext4_writepages+0x3d3/0xd70
[  377.281449]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.281484]  [<ffffffff811ab82b>] ? generic_writepages+0x5b/0x80
[  377.281509]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.281538]  [<ffffffff811adcae>] do_writepages+0x1e/0x30
[  377.281561]  [<ffffffff8124d9e5>] __writeback_single_inode+0x45/0x330
[  377.281592]  [<ffffffff8124e1e2>] writeback_sb_inodes+0x262/0x600
[  377.281617]  [<ffffffff8124e60c>] __writeback_inodes_wb+0x8c/0xc0
[  377.281617]  [<ffffffff8124e963>] wb_writeback+0x253/0x310
[  377.281617]  [<ffffffff8123b841>] ? get_nr_dirty_inodes+0x51/0x80
[  377.281617]  [<ffffffff8124f1cf>] wb_workfn+0x2df/0x3f0
[  377.281617]  [<ffffffff810b724e>] process_one_work+0x15e/0x430
[  377.281617]  [<ffffffff810b756e>] worker_thread+0x4e/0x460
[  377.281617]  [<ffffffff810b7520>] ? process_one_work+0x430/0x430
[  377.281617]  [<ffffffff810bd548>] kthread+0xd8/0xf0
[  377.281617]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.281617]  [<ffffffff81756c8f>] ret_from_fork+0x3f/0x70
[  377.281617]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.281893] ---[ end trace a311745f90e0a79c ]---
[  377.282484] BUG: unable to handle kernel paging request at ffffffffffffffd8
[  377.282523] IP: [<ffffffff810bdbd0>] kthread_data+0x10/0x20
[  377.282559] PGD 1c0c067 PUD 1c0e067 PMD 0 
[  377.282592] Oops: 0000 [#2] SMP 
[  377.282614] Modules linked in: fuse ip6table_filter ip6_tables xt_conntrack ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp crct10dif_pclmul xen_netfront crc32_pclmul crc32c_intel pcspkr dummy_hcd udc_core xen_blkback xenfs xen_privcmd u2mfn(O) xen_blkfront
[  377.283015] CPU: 0 PID: 6 Comm: kworker/u4:0 Tainted: G      D W  O    4.4.14-11.pvops.qubes.x86_64 #1
[  377.283015] task: ffff880013799e00 ti: ffff8800137a4000 task.ti: ffff8800137a4000
[  377.283015] RIP: e030:[<ffffffff810bdbd0>]  [<ffffffff810bdbd0>] kthread_data+0x10/0x20
[  377.283015] RSP: e02b:ffff8800137a75e8  EFLAGS: 00010002
[  377.283015] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81f18e40
[  377.283015] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880013799e00
[  377.283015] RBP: ffff8800137a75e8 R08: ffff880013799e88 R09: 0000000000000000
[  377.283015] R10: 0000000000008000 R11: ffff880013799e60 R12: 0000000000000000
[  377.283015] R13: 0000000000016c80 R14: ffff880013799e00 R15: ffff880013e16c80
[  377.283015] FS:  0000000000000000(0000) GS:ffff880013e00000(0000) knlGS:ffff880012900000
[  377.283015] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[  377.283015] CR2: 0000000000000028 CR3: 0000000012651000 CR4: 0000000000042660
[  377.283015] Stack:
[  377.283015]  ffff8800137a7600 ffffffff810b8641 ffff880013e16c80 ffff8800137a7650
[  377.283015]  ffffffff817523e0 ffff8800137a7610 ffff880000000000 ffff880013799e00
[  377.283015]  ffff8800137a8000 ffff88001379a4c8 ffff8800137a76a0 ffff8800137a7210
[  377.283015] Call Trace:
[  377.283015]  [<ffffffff810b8641>] wq_worker_sleeping+0x11/0x90
[  377.283015]  [<ffffffff817523e0>] __schedule+0x520/0x790
[  377.283015]  [<ffffffff81752685>] schedule+0x35/0x80
[  377.283015]  [<ffffffff810a247e>] do_exit+0x77e/0xae0
[  377.283015]  [<ffffffff8101a751>] oops_end+0xa1/0xd0
[  377.283015]  [<ffffffff8101ac0b>] die+0x4b/0x70
[  377.283015]  [<ffffffff81017d21>] do_trap+0xb1/0x140
[  377.283015]  [<ffffffff810180a9>] do_error_trap+0x89/0x110
[  377.283015]  [<ffffffff812acace>] ? mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.283015]  [<ffffffff8138e6b0>] ? blk_sq_make_request+0x110/0x360
[  377.283015]  [<ffffffff81018610>] do_invalid_op+0x20/0x30
[  377.283015]  [<ffffffff8175849e>] invalid_op+0x1e/0x30
[  377.283015]  [<ffffffff812acace>] ? mpage_prepare_extent_to_map+0x2ce/0x2f0
[  377.283015]  [<ffffffff812ac948>] ? mpage_prepare_extent_to_map+0x148/0x2f0
[  377.283015]  [<ffffffff812f946b>] ? jbd2__journal_start+0xdb/0x1e0
[  377.283015]  [<ffffffff812b0920>] ? ext4_writepages+0x3b0/0xd70
[  377.283015]  [<ffffffff812dfc6d>] ? __ext4_journal_start_sb+0x6d/0x120
[  377.283015]  [<ffffffff812b0943>] ext4_writepages+0x3d3/0xd70
[  377.283015]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.283015]  [<ffffffff811ab82b>] ? generic_writepages+0x5b/0x80
[  377.283015]  [<ffffffff810e7e21>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[  377.283015]  [<ffffffff811adcae>] do_writepages+0x1e/0x30
[  377.283015]  [<ffffffff8124d9e5>] __writeback_single_inode+0x45/0x330
[  377.283015]  [<ffffffff8124e1e2>] writeback_sb_inodes+0x262/0x600
[  377.283015]  [<ffffffff8124e60c>] __writeback_inodes_wb+0x8c/0xc0
[  377.283015]  [<ffffffff8124e963>] wb_writeback+0x253/0x310
[  377.283015]  [<ffffffff8123b841>] ? get_nr_dirty_inodes+0x51/0x80
[  377.283015]  [<ffffffff8124f1cf>] wb_workfn+0x2df/0x3f0
[  377.283015]  [<ffffffff810b724e>] process_one_work+0x15e/0x430
[  377.283015]  [<ffffffff810b756e>] worker_thread+0x4e/0x460
[  377.283015]  [<ffffffff810b7520>] ? process_one_work+0x430/0x430
[  377.283015]  [<ffffffff810bd548>] kthread+0xd8/0xf0
[  377.283015]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.283015]  [<ffffffff81756c8f>] ret_from_fork+0x3f/0x70
[  377.283015]  [<ffffffff810bd470>] ? kthread_create_on_node+0x190/0x190
[  377.283015] Code: 02 00 00 48 c7 c7 b8 34 a5 81 e8 7c 19 fe ff e9 bb fe ff ff 0f 1f 80 00 00 00 00 0f 1f 44 00 00 48 8b 87 08 05 00 00 55 48 89 e5 <48> 8b 40 d8 5d c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 
[  377.283015] RIP  [<ffffffff810bdbd0>] kthread_data+0x10/0x20
[  377.283015]  RSP <ffff8800137a75e8>
[  377.283015] CR2: ffffffffffffffd8
[  377.283015] ---[ end trace a311745f90e0a79d ]---
[  377.283015] Fixing recursive fault but reboot is needed!
dirtycow commented 8 years ago

hanged