| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070919193308.GA4253@uranus.ravnborg.org>
Date: Wed, 19 Sep 2007 21:33:08 +0200
From: Sam Ravnborg <sam@...nborg.org>
To: Gabriel C <nix.or.die@...glemail.com>
Cc: Miles Lane <miles.lane@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>,
linux-kernel@...r.kernel.org, Roman Zippel <zippel@...ux-m68k.org>
Subject: Re: 2.6.23-rc6-mm1
On Wed, Sep 19, 2007 at 12:48:26AM +0200, Gabriel C wrote:
> Gabriel C wrote:
> > Sam Ravnborg wrote:
> >> On Tue, Sep 18, 2007 at 03:42:58PM -0400, Miles Lane wrote:
> >>> On 9/18/07, Sam Ravnborg <sam@...nborg.org> wrote:
> >>>> Hi Miles.
> >>>> On Tue, Sep 18, 2007 at 11:27:23AM -0400, Miles Lane wrote:
> >>>>> Selecting Help for "Subarchitecture Type" causes "make menuconfig" to
> >>>>> crash, and the bash display settings have to be reset.
> >>>> Not reproduceable here.
> >>>> But I noticed that we pass a null pointer to a vsprintf function which
> >>>> in the cases you pointed out printed a (null) at my system.
> >>>> Could you plase try if attached patch fix your system.
> >>> Sorry, it still crashes. I am running Ubuntu pre-6.10 (Gutsy -- the
> >>> development version of the distro). Maybe I should try "make
> >>> mrproper" first?
> >> make mrproper should not do any difference here.
> >> I rather think you hit some ncurses bug.
> >>
> >> If you could add '-g' to HOSTCFLAGS in top-level Makefile
> >> and then do:
> >> rm scripts/kconfig/mconf.o scripts/kconfig/mconf
> >> make menuconfig
> >>
> >> (to build mconf and to check that the error is still reproduceable).
> >> And then run it in a debugger like this:
> >> gdb scripts/kconfig/mconf
> >> run arch/x86_64/Kconfig
> >> ^^^^^^ replace with your actual arch
> >>
> >> Provoke the error and get a back-trace with 'bt'.
> >
> > Hi Sam,
> >
> > I can reproduce this bug on Frugalware Linux.
> >
> > Here the bt:
> >
> > Program received signal SIGSEGV, Segmentation fault.
> > 0xb7dc4143 in strlen () from /lib/libc.so.6
> > (gdb) bt
> > #0 0xb7dc4143 in strlen () from /lib/libc.so.6
> > #1 0x0804fd60 in str_append (gs=0xbfe4f6e8, s=0x0) at scripts/kconfig/util.c:87
> > #2 0x0804e0cb in expr_print (e=0x8e22df8, fn=0x804fda0 <expr_print_gstr_helper>, data=0xbfe4f6e8, prevtoken=0) at scripts/kconfig/expr.c:1037
> > #3 0x0804e1e7 in expr_gstr_print (e=0x8e22df8, gs=0xbfe4f6e8) at scripts/kconfig/expr.c:1099
> > #4 0x0804a07e in get_symbol_str (r=0xbfe4f6e8, sym=0x8b54ee8) at scripts/kconfig/mconf.c:334
> > #5 0x0804a363 in show_help (menu=0x8b54f88) at scripts/kconfig/mconf.c:738
> > #6 0x0804acec in conf (menu=0x8b69480) at scripts/kconfig/mconf.c:781
> > #7 0x0804a971 in conf (menu=0x8063c40) at scripts/kconfig/mconf.c:703
> > #8 0x0804af8a in main (ac=Cannot access memory at address 0x0
> > ) at scripts/kconfig/mconf.c:917
> >
> >
> > Looks somewhat strange -> http://194.231.229.228/menuconfig.png
> >
> > PS: Is without the patch you posted , I'll try with in a bit
>
> The crash is still there but the (null)'s are all fixed by this patch.
Got it. We sometimes get a numm pointer when printing the expression (in expr.c).
I have queued following fix.
Thanks for reporting!
Sam
Patch is copy'n'pased due to temporary setup troubles after upgradign to Gutsy.
Will be at kbuil.git in a few minutes.
>From 69d39ec036b4fca541efc3c9ee31ec65d6b95bd4 Mon Sep 17 00:00:00 2001
From: Sam Ravnborg <sam@...nborg.org>
Date: Wed, 19 Sep 2007 21:23:09 +0200
Subject: [PATCH] kconfig: fix segv fault in menuconfig
With specific configurations requesting help for certain
menu lines caused menuconfig to crash.
This was tracked down to a null pointer bug.
Thanks to "Miles Lane" <miles.lane@...il.com> for inital reporting
and to Gabriel C <nix.or.die@...glemail.com> for the backtrace
that helped me locating the bug.
Signed-off-by: Sam Ravnborg <sam@...nborg.org>
---
scripts/kconfig/mconf.c | 5 +++--
scripts/kconfig/util.c | 13 ++++++++-----
2 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 2ee12a7..1935818 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -357,8 +357,9 @@ static void get_symbol_str(struct gstr *r, struct symbol *sym)
bool hit;
struct property *prop;
- str_printf(r, "Symbol: %s [=%s]\n", sym->name,
- sym_get_string_value(sym));
+ if (sym && sym->name)
+ str_printf(r, "Symbol: %s [=%s]\n", sym->name,
+ sym_get_string_value(sym));
for_all_prompts(sym, prop)
get_prompt_str(r, prop);
hit = false;
diff --git a/scripts/kconfig/util.c b/scripts/kconfig/util.c
index e3f28b9..e1cad92 100644
--- a/scripts/kconfig/util.c
+++ b/scripts/kconfig/util.c
@@ -84,12 +84,15 @@ void str_free(struct gstr *gs)
/* Append to growable string */
void str_append(struct gstr *gs, const char *s)
{
- size_t l = strlen(gs->s) + strlen(s) + 1;
- if (l > gs->len) {
- gs->s = realloc(gs->s, l);
- gs->len = l;
+ size_t l;
+ if (s) {
+ l = strlen(gs->s) + strlen(s) + 1;
+ if (l > gs->len) {
+ gs->s = realloc(gs->s, l);
+ gs->len = l;
+ }
+ strcat(gs->s, s);
}
- strcat(gs->s, s);
}
/* Append printf formatted string to growable string */
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists