Date: Wed, 22 Aug 2001 12:33:01 +0300 From: Peter Pentchev <roam@ringlet.net> To: arch@FreeBSD.org Subject: kern/29931: problems with kern.corefile handling Message-ID: <20010822123301.D8694@ringworld.oblivion.bg>
next in thread | raw e-mail | index | archive | help
Hi, This looks genuine. Any objections to committing it, and MFC'ing before 4.4 comes out? G'luck, Peter -- .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI ----- Forwarded message from Foldi Tamas <crow@kapu.hu> ----- Date: 21 Aug 2001 22:07:51 +0200 From: Foldi Tamas <crow@kapu.hu> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/29931: problems with kern.corefile handling >Number: 29931 >Category: kern >Synopsis: if expand_name() return with NULL, coredump() crashes the kernel >Responsible: freebsd-bugs >State: open >Originator: Foldi Tamas >Release: FreeBSD 4.3-RELEASE i386 >Organization: Nektor IT >Environment: System: FreeBSD mancika.kapusoft 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001 jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC i386 Generic kernel. x86 architecture. >Description: When the expand_name() generates too large core filename, it's return value is NULL address. This NULL value is given to vn_open(), which causes kernel panic. In some cases (non default kern.corefile settings) users can freeze the system (of course, root always can). >How-To-Repeat: #!/bin/sh /sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'` echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c cd /tmp && make seg && /tmp/seg cd - >Fix: --- kern_sig.c.orig Thu Feb 22 06:15:04 2001 +++ kern_sig.c Tue Aug 21 11:35:35 2001 @@ -1620,6 +1620,8 @@ return 0; name = expand_name(p->p_comm, p->p_ucred->cr_uid, p->p_pid); + if (name == NULL) + return (EINVAL); NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, p); error = vn_open(&nd, O_CREAT | FWRITE | O_NOFOLLOW, S_IRUSR | S_IWUSR); free(name, M_TEMP); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010822123301.D8694>