Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Found a 20-Year-Old Linux Kernel Bug

robert.ocallahan.org

Post reply on HN
Print view View original

1–10 of 45 posts

Re: How I Found a 20-Year-Old Linux Kernel Bug

#3

Post by metalliqaz »

I have not ready anything about this bug, other than the very short description in the linked blog, however this seems like a bug that would have been flagged by a static analysis tool. I know they've been used on the kernel (e.g. Coverity) Very surprised it survived until now.

Re: How I Found a 20-Year-Old Linux Kernel Bug

#4

Post by dom0 »

Linux ~4.7 or so fixed a bug in fadvise, specifically FADV_DONTNEED, that incorrectly rounded page boundaries to the effect of making some calls less effective. Found and fixed by a developer who wondered why his page cache was filling up, even though the backup software he used made use of DONTNEED :)

The bug was in from day 1.

Re: How I Found a 20-Year-Old Linux Kernel Bug

#5

Post by benmmurphy »

metalliqaz wrote: post #3

I have not ready anything about this bug, other than the very short description in the linked blog, however this seems like a bug that would have been flagged by a static analysis tool. I know they've been used on the kernel (e.g. Coverity) Very surprised it survived until now.

the syscall function takes a void* parameter then does a copy from user space into the kernel using the wrong target type/sizeof. i think it works because the incorrect type was a superset of the correct type. i don't think any static analyser could catch this.

proposed patch here:

https://bugzilla.kernel.org/attachment.cgi?id=256997&action=...

Re: How I Found a 20-Year-Old Linux Kernel Bug

#6

Post by galapago »

hultner wrote: post #2

It's always nice to see fixes of problems found with improved testing. It would be nice to see something like Haskells QuickCheck rigorously applied on the majority of the kernel functions/interfaces.

Is there a Haskell type of Linux syscalls? If it is the case, we can automatically derive Haskell code to generate an arbitrary list of syscalls.

(disclamer: I'm one of the QuickFuzz [0] developers and I'm very interested in testing for this kind of bugs)

[0]: http://quickfuzz.org/

Re: How I Found a 20-Year-Old Linux Kernel Bug

#8

Post by wyc »

Great work!

Segfaults are horrible, but bugs like these are even more so. Crawling, sneaking, living in your walls. Stealing precious CPU cycles and memory from millions of machines at once--petabytes and petaflops when you add it all up.

Worst yet, they don't make a peep until you shine the holy light of benchmarks, code reviews, automated testing, or the (un)lucky corner case on them.

At least segfaults let you know something's definitely wrong. These bugs? Now that's insidious.

Post reply on HN