From owner-freebsd-arch Wed Aug 22 2:34:40 2001 Delivered-To: freebsd-arch@freebsd.org Received: from ringworld.nanolink.com (dialmess.nanolink.com [217.75.135.246]) by hub.freebsd.org (Postfix) with SMTP id BA4D837B407 for ; Wed, 22 Aug 2001 02:34:25 -0700 (PDT) (envelope-from roam@ringlet.net) Received: (qmail 12895 invoked by uid 1000); 22 Aug 2001 09:33:01 -0000 Date: Wed, 22 Aug 2001 12:33:01 +0300 From: Peter Pentchev To: arch@FreeBSD.org Subject: kern/29931: problems with kern.corefile handling Message-ID: <20010822123301.D8694@ringworld.oblivion.bg> Reply-To: freebsd-gnats-submit@FreeBSD.org Mail-Followup-To: arch@FreeBSD.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i Sender: owner-freebsd-arch@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi, This looks genuine. Any objections to committing it, and MFC'ing before 4.4 comes out? G'luck, Peter -- .siht ekil ti gnidaer eb d'uoy ,werbeH ni erew ecnetnes siht fI ----- Forwarded message from Foldi Tamas ----- Date: 21 Aug 2001 22:07:51 +0200 From: Foldi Tamas To: FreeBSD-gnats-submit@freebsd.org Subject: kern/29931: problems with kern.corefile handling >Number: 29931 >Category: kern >Synopsis: if expand_name() return with NULL, coredump() crashes the kernel >Responsible: freebsd-bugs >State: open >Originator: Foldi Tamas >Release: FreeBSD 4.3-RELEASE i386 >Organization: Nektor IT >Environment: System: FreeBSD mancika.kapusoft 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001 jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC i386 Generic kernel. x86 architecture. >Description: When the expand_name() generates too large core filename, it's return value is NULL address. This NULL value is given to vn_open(), which causes kernel panic. In some cases (non default kern.corefile settings) users can freeze the system (of course, root always can). >How-To-Repeat: #!/bin/sh /sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'` echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c cd /tmp && make seg && /tmp/seg cd - >Fix: --- kern_sig.c.orig Thu Feb 22 06:15:04 2001 +++ kern_sig.c Tue Aug 21 11:35:35 2001 @@ -1620,6 +1620,8 @@ return 0; name = expand_name(p->p_comm, p->p_ucred->cr_uid, p->p_pid); + if (name == NULL) + return (EINVAL); NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, name, p); error = vn_open(&nd, O_CREAT | FWRITE | O_NOFOLLOW, S_IRUSR | S_IWUSR); free(name, M_TEMP); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-arch" in the body of the message