Date: 21 Aug 2001 22:07:51 +0200 From: Foldi Tamas <crow@kapu.hu> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/29931: problems with kern.corefile handling Message-ID: <998424471.1690.18.camel@DarkSun>
next in thread | raw e-mail | index | archive | help
>Number: 29931
>Category: kern
>Synopsis: if expand_name() return with NULL, coredump() crashes the kernel
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Aug 21 13:10:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Foldi Tamas
>Release: FreeBSD 4.3-RELEASE i386
>Organization:
Nektor IT
>Environment:
System: FreeBSD mancika.kapusoft 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001 jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC i386
Generic kernel. x86 architecture.
>Description:
When the expand_name() generates too large core filename, it's return value
is NULL address. This NULL value is given to vn_open(), which causes kernel
panic. In some cases (non default kern.corefile settings) users can freeze
the system (of course, root always can).
>How-To-Repeat:
#!/bin/sh
/sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'`
echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c
cd /tmp && make seg && /tmp/seg
cd -
>Fix:
--- kern_sig.c.orig Thu Feb 22 06:15:04 2001
+++ kern_sig.c Tue Aug 21 11:35:35 2001
@@ -1620,6 +1620,8 @@
return 0;
name = expand_name(p->p_comm, p->p_ucred->cr_uid, p->p_pid);
+ if (name == NULL)
+ return (EINVAL);
NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, p);
error = vn_open(&nd, O_CREAT | FWRITE | O_NOFOLLOW, S_IRUSR | S_IWUSR);
free(name, M_TEMP);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?998424471.1690.18.camel>