Date: 21 Aug 2001 22:07:51 +0200 From: Foldi Tamas <crow@kapu.hu> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/29931: problems with kern.corefile handling Message-ID: <998424471.1690.18.camel@DarkSun>
next in thread | raw e-mail | index | archive | help
>Number: 29931 >Category: kern >Synopsis: if expand_name() return with NULL, coredump() crashes the kernel >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Aug 21 13:10:01 PDT 2001 >Closed-Date: >Last-Modified: >Originator: Foldi Tamas >Release: FreeBSD 4.3-RELEASE i386 >Organization: Nektor IT >Environment: System: FreeBSD mancika.kapusoft 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001 jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC i386 Generic kernel. x86 architecture. >Description: When the expand_name() generates too large core filename, it's return value is NULL address. This NULL value is given to vn_open(), which causes kernel panic. In some cases (non default kern.corefile settings) users can freeze the system (of course, root always can). >How-To-Repeat: #!/bin/sh /sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'` echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c cd /tmp && make seg && /tmp/seg cd - >Fix: --- kern_sig.c.orig Thu Feb 22 06:15:04 2001 +++ kern_sig.c Tue Aug 21 11:35:35 2001 @@ -1620,6 +1620,8 @@ return 0; name = expand_name(p->p_comm, p->p_ucred->cr_uid, p->p_pid); + if (name == NULL) + return (EINVAL); NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, p); error = vn_open(&nd, O_CREAT | FWRITE | O_NOFOLLOW, S_IRUSR | S_IWUSR); free(name, M_TEMP); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?998424471.1690.18.camel>