| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <46F18861.80705@googlemail.com>
Date: Wed, 19 Sep 2007 22:36:49 +0200
From: Gabriel C <nix.or.die@...glemail.com>
To: Sam Ravnborg <sam@...nborg.org>
CC: Miles Lane <miles.lane@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>,
linux-kernel@...r.kernel.org, Roman Zippel <zippel@...ux-m68k.org>
Subject: Re: 2.6.23-rc6-mm1
Sam Ravnborg wrote:
> On Wed, Sep 19, 2007 at 12:48:26AM +0200, Gabriel C wrote:
>> Gabriel C wrote:
>>> Sam Ravnborg wrote:
>>>> On Tue, Sep 18, 2007 at 03:42:58PM -0400, Miles Lane wrote:
>>>>> On 9/18/07, Sam Ravnborg <sam@...nborg.org> wrote:
>>>>>> Hi Miles.
>>>>>> On Tue, Sep 18, 2007 at 11:27:23AM -0400, Miles Lane wrote:
>>>>>>> Selecting Help for "Subarchitecture Type" causes "make menuconfig" to
>>>>>>> crash, and the bash display settings have to be reset.
>>>>>> Not reproduceable here.
>>>>>> But I noticed that we pass a null pointer to a vsprintf function which
>>>>>> in the cases you pointed out printed a (null) at my system.
>>>>>> Could you plase try if attached patch fix your system.
>>>>> Sorry, it still crashes. I am running Ubuntu pre-6.10 (Gutsy -- the
>>>>> development version of the distro). Maybe I should try "make
>>>>> mrproper" first?
>>>> make mrproper should not do any difference here.
>>>> I rather think you hit some ncurses bug.
>>>>
>>>> If you could add '-g' to HOSTCFLAGS in top-level Makefile
>>>> and then do:
>>>> rm scripts/kconfig/mconf.o scripts/kconfig/mconf
>>>> make menuconfig
>>>>
>>>> (to build mconf and to check that the error is still reproduceable).
>>>> And then run it in a debugger like this:
>>>> gdb scripts/kconfig/mconf
>>>> run arch/x86_64/Kconfig
>>>> ^^^^^^ replace with your actual arch
>>>>
>>>> Provoke the error and get a back-trace with 'bt'.
>>> Hi Sam,
>>>
>>> I can reproduce this bug on Frugalware Linux.
>>>
>>> Here the bt:
>>>
>>> Program received signal SIGSEGV, Segmentation fault.
>>> 0xb7dc4143 in strlen () from /lib/libc.so.6
>>> (gdb) bt
>>> #0 0xb7dc4143 in strlen () from /lib/libc.so.6
>>> #1 0x0804fd60 in str_append (gs=0xbfe4f6e8, s=0x0) at scripts/kconfig/util.c:87
>>> #2 0x0804e0cb in expr_print (e=0x8e22df8, fn=0x804fda0 <expr_print_gstr_helper>, data=0xbfe4f6e8, prevtoken=0) at scripts/kconfig/expr.c:1037
>>> #3 0x0804e1e7 in expr_gstr_print (e=0x8e22df8, gs=0xbfe4f6e8) at scripts/kconfig/expr.c:1099
>>> #4 0x0804a07e in get_symbol_str (r=0xbfe4f6e8, sym=0x8b54ee8) at scripts/kconfig/mconf.c:334
>>> #5 0x0804a363 in show_help (menu=0x8b54f88) at scripts/kconfig/mconf.c:738
>>> #6 0x0804acec in conf (menu=0x8b69480) at scripts/kconfig/mconf.c:781
>>> #7 0x0804a971 in conf (menu=0x8063c40) at scripts/kconfig/mconf.c:703
>>> #8 0x0804af8a in main (ac=Cannot access memory at address 0x0
>>> ) at scripts/kconfig/mconf.c:917
>>>
>>>
>>> Looks somewhat strange -> http://194.231.229.228/menuconfig.png
>>>
>>> PS: Is without the patch you posted , I'll try with in a bit
>> The crash is still there but the (null)'s are all fixed by this patch.
>
> Got it. We sometimes get a numm pointer when printing the expression (in expr.c).
> I have queued following fix.
>
Patch is fine , fixes the problem here.
> Thanks for reporting!
>
> Sam
>
> Patch is copy'n'pased due to temporary setup troubles after upgradign to Gutsy.
> Will be at kbuil.git in a few minutes.
>
>>>From 69d39ec036b4fca541efc3c9ee31ec65d6b95bd4 Mon Sep 17 00:00:00 2001
> From: Sam Ravnborg <sam@...nborg.org>
> Date: Wed, 19 Sep 2007 21:23:09 +0200
> Subject: [PATCH] kconfig: fix segv fault in menuconfig
>
> With specific configurations requesting help for certain
> menu lines caused menuconfig to crash.
> This was tracked down to a null pointer bug.
> Thanks to "Miles Lane" <miles.lane@...il.com> for inital reporting
> and to Gabriel C <nix.or.die@...glemail.com> for the backtrace
> that helped me locating the bug.
>
> Signed-off-by: Sam Ravnborg <sam@...nborg.org>
> ---
> scripts/kconfig/mconf.c | 5 +++--
> scripts/kconfig/util.c | 13 ++++++++-----
> 2 files changed, 11 insertions(+), 7 deletions(-)
>
> diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
> index 2ee12a7..1935818 100644
> --- a/scripts/kconfig/mconf.c
> +++ b/scripts/kconfig/mconf.c
> @@ -357,8 +357,9 @@ static void get_symbol_str(struct gstr *r, struct symbol *sym)
> bool hit;
> struct property *prop;
>
> - str_printf(r, "Symbol: %s [=%s]\n", sym->name,
> - sym_get_string_value(sym));
> + if (sym && sym->name)
> + str_printf(r, "Symbol: %s [=%s]\n", sym->name,
> + sym_get_string_value(sym));
> for_all_prompts(sym, prop)
> get_prompt_str(r, prop);
> hit = false;
> diff --git a/scripts/kconfig/util.c b/scripts/kconfig/util.c
> index e3f28b9..e1cad92 100644
> --- a/scripts/kconfig/util.c
> +++ b/scripts/kconfig/util.c
> @@ -84,12 +84,15 @@ void str_free(struct gstr *gs)
> /* Append to growable string */
> void str_append(struct gstr *gs, const char *s)
> {
> - size_t l = strlen(gs->s) + strlen(s) + 1;
> - if (l > gs->len) {
> - gs->s = realloc(gs->s, l);
> - gs->len = l;
> + size_t l;
> + if (s) {
> + l = strlen(gs->s) + strlen(s) + 1;
> + if (l > gs->len) {
> + gs->s = realloc(gs->s, l);
> + gs->len = l;
> + }
> + strcat(gs->s, s);
> }
> - strcat(gs->s, s);
> }
>
> /* Append printf formatted string to growable string */
>
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists