Date: Wed, 22 Aug 2001 12:33:01 +0300 From: Peter Pentchev <roam@ringlet.net> To: arch@FreeBSD.org Subject: kern/29931: problems with kern.corefile handling Message-ID: <20010822123301.D8694@ringworld.oblivion.bg>
next in thread | raw e-mail | index | archive | help
Hi,
This looks genuine. Any objections to committing it, and MFC'ing before
4.4 comes out?
G'luck,
Peter
--
.siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI
----- Forwarded message from Foldi Tamas <crow@kapu.hu> -----
Date: 21 Aug 2001 22:07:51 +0200
From: Foldi Tamas <crow@kapu.hu>
To: FreeBSD-gnats-submit@freebsd.org
Subject: kern/29931: problems with kern.corefile handling
>Number: 29931
>Category: kern
>Synopsis: if expand_name() return with NULL, coredump() crashes the kernel
>Responsible: freebsd-bugs
>State: open
>Originator: Foldi Tamas
>Release: FreeBSD 4.3-RELEASE i386
>Organization:
Nektor IT
>Environment:
System: FreeBSD mancika.kapusoft 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001 jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC i386
Generic kernel. x86 architecture.
>Description:
When the expand_name() generates too large core filename, it's return value
is NULL address. This NULL value is given to vn_open(), which causes kernel
panic. In some cases (non default kern.corefile settings) users can freeze
the system (of course, root always can).
>How-To-Repeat:
#!/bin/sh
/sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'`
echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c
cd /tmp && make seg && /tmp/seg
cd -
>Fix:
--- kern_sig.c.orig Thu Feb 22 06:15:04 2001
+++ kern_sig.c Tue Aug 21 11:35:35 2001
@@ -1620,6 +1620,8 @@
return 0;
name = expand_name(p->p_comm, p->p_ucred->cr_uid, p->p_pid);
+ if (name == NULL)
+ return (EINVAL);
NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, p);
error = vn_open(&nd, O_CREAT | FWRITE | O_NOFOLLOW, S_IRUSR | S_IWUSR);
free(name, M_TEMP);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-arch" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010822123301.D8694>