Date: Sun, 07 Dec 2014 05:27:53 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 195767] New: [unionfs] unionfs_relookup_for_delete passing null pointer to strlen Message-ID: <bug-195767-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195767 Bug ID: 195767 Summary: [unionfs] unionfs_relookup_for_delete passing null pointer to strlen Product: Base System Version: 10.1-RELEASE Hardware: i386 OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: mqudsi@neosmart.net Created attachment 150294 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=150294&action=edit backtrace screenshot This is a bug that may have been present in earlier versions of FreeBSD, but since upgrading to FreeBSD 10.1-RELEASE I can regularly reproduce. The environment is a custom live CD, configured with a preloaded ufs.gz base bootstrap image that mounts a ufs.uzip file as the new root, creates a malloc-based virtual disk, and overlays it over the existing RO ufs.uzip image via unionfs. Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00 fault virtual address= 0x0 fault code= supervisor read, page not present ... current process= 2626 (rmdir) [ thread pid 2626 tid 100065 ] Stopped at strlen+0xd: movl 0(%ecx),%eax db> bt tracing pid 2626 tid 100065 td 0xc8dfe620 strlen(0,.... unionfs_rerelookup_for_delete unionfs_rmdir VOP_RMDIR_APV kern_rmdirat sys_rmdir syscall Xinit0x80_syscall() --- syscall (137, FreeBSD ELF32, sys_rmdir) -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-195767-8>