linux-kernel - Re: [BUG] rfcomm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080211224812.GA30068@slug>
Date:	Mon, 11 Feb 2008 23:48:12 +0100
From:	Frederik Deweerdt <deweerdt@...e.fr>
To:	Alon Bar-Lev <alon.barlev@...il.com>
Cc:	Dave Young <hidave.darkstar@...il.com>,
	linux-kernel@...r.kernel.org, marcel@...tmann.org,
	bluez-devel@...ts.sf.net
Subject: Re: [BUG] rfcomm

Hello Alon,

On Mon, Feb 11, 2008 at 05:57:54PM +0200, Alon Bar-Lev wrote:
[...]
> Feb 11 17:46:05 alon1 BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008
> Feb 11 17:46:05 alon1 printing eip: c01b2da6 *pde = 00000000 
> Feb 11 17:46:05 alon1 Oops: 0000 [#1] PREEMPT 
> Feb 11 17:46:05 alon1 Modules linked in: aes_generic crypto_algapi ieee80211_crypt_ccmp ppp_deflate zlib_deflate zlib_inflate bsd_comp ppp_async thinkpad_acpi hwmon nvram vmnet(P) vmmon(P) tun radeon drm autofs4 ipv6 nf_nat_irc nf_nat_ftp nf_conntrack_irc nf_conntrack_ftp ipt_MASQUERADE iptable_nat nf_nat ipt_REJECT xt_tcpudp ipt_LOG xt_limit xt_state nf_conntrack_ipv4 nf_conntrack iptable_filter ip_tables x_tables rfcomm l2cap snd_pcm_oss snd_mixer_oss snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device ppp_generic slhc ioatdma dca cfq_iosched cpufreq_powersave cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_table uinput fan af_packet nls_cp1255 nls_iso8859_1 nls_utf8 nls_base hci_usb bluetooth pcmcia snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm ipw2200 nsc_ircc snd_timer irda ieee80211 snd psmouse yenta_socket ehci_hcd pcspkr ieee80211_crypt e1000 rsrc_nonstatic uhci_hcd soundcore i2c_i801 intel_agp crc_ccitt thermal sr_mod pcmcia_core snd_page_alloc battery rtc firmware_class agpgart ac processor cdrom sg button unix usbcore evdev ext3 jbd ext2 mbcache loop ata_piix libata sd_mod scsi_mod
> Feb 11 17:46:05 alon1 
> Feb 11 17:46:05 alon1 Pid: 4, comm: events/0 Tainted: P        (2.6.24-gentoo-r1 #1)
> Feb 11 17:46:05 alon1 EIP: 0060:[<c01b2da6>] EFLAGS: 00010286 CPU: 0
> Feb 11 17:46:05 alon1 EIP is at sysfs_get_dentry+0x26/0x80
> Feb 11 17:46:05 alon1 EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: ebf21000
> Feb 11 17:46:05 alon1 ESI: eab4e880 EDI: f713bb40 EBP: f713bb40 ESP: f7c49f00
> Feb 11 17:46:05 alon1 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
> Feb 11 17:46:05 alon1 Process events/0 (pid: 4, ti=f7c48000 task=f7c3efc0 task.ti=f7c48000)
> Feb 11 17:46:05 alon1 Stack: f7c97120 f7135a68 f7e71e10 c01b303d ffffffff ffffffff fffffffe c030ba9c 
> Feb 11 17:46:05 alon1 f7c97120 f7135a68 f2fefb40 f7c97120 f7135a68 f2fefb40 c030ba8e c01ce1fb 
> Feb 11 17:46:05 alon1 f75f1b00 c030ba8e f2fefb40 f75f1b00 f75f1b00 00000000 f7135a00 00000000 
> Feb 11 17:46:05 alon1 Call Trace:
> Feb 11 17:46:05 alon1 [<c01b303d>] sysfs_move_dir+0x3d/0x1f0
> Feb 11 17:46:05 alon1 [<c01ce1fb>] kobject_move+0x9b/0x120
> Feb 11 17:46:05 alon1 [<c0241701>] device_move+0x51/0x110
> Feb 11 17:46:05 alon1 [<f9a8adb0>] del_conn+0x0/0x40 [bluetooth]
> Feb 11 17:46:05 alon1 [<f9a8adc0>] del_conn+0x10/0x40 [bluetooth]
> Feb 11 17:46:05 alon1 [<c012c1a1>] run_workqueue+0x81/0x140
> Feb 11 17:46:05 alon1 [<c02c0c78>] schedule+0x168/0x2e0
> Feb 11 17:46:05 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
> Feb 11 17:46:05 alon1 [<c012c9cb>] worker_thread+0x9b/0xf0
> Feb 11 17:46:05 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
> Feb 11 17:46:05 alon1 [<c012c930>] worker_thread+0x0/0xf0
> Feb 11 17:46:05 alon1 [<c012f962>] kthread+0x42/0x70
> Feb 11 17:46:05 alon1 [<c012f920>] kthread+0x0/0x70
> Feb 11 17:46:05 alon1 [<c0104c2f>] kernel_thread_helper+0x7/0x18
> Feb 11 17:46:05 alon1 =======================
> Feb 11 17:46:05 alon1 Code: 26 00 00 00 00 57 89 c7 a1 50 1b 3a c0 56 53 8b 70 38 85 f6 74 08 8b 0e 85 c9 74 58 ff 06 8b 56 50 39 fa 74 47 89 fb eb 02 89 c3 <8b> 43 08 39 c2 75 f7 8b 46 08 83 c0 68 e8 98 e7 10 00 8b 43 10 
> Feb 11 17:46:05 alon1 EIP: [<c01b2da6>] sysfs_get_dentry+0x26/0x80 SS:ESP 0068:f7c49f00

If your compiler doesn't produce a code too different from mine, it
looks like cur in sysfs_get_dentry()...

	while (cur->s_parent != dentry->d_fsdata)
		cur = cur->s_parent;

... got NULL and dereferenced. Could you try the following (merely
tested by booting) patch? While not a fix, it could help pointing to
the right direction.

Regards,
Frederik


diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 4948d9b..90cdf0d 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -106,8 +106,11 @@ struct dentry *sysfs_get_dentry(struct sysfs_dirent *sd)
 
 		/* find the first ancestor which hasn't been looked up */
 		cur = sd;
-		while (cur->s_parent != dentry->d_fsdata)
+		while (cur->s_parent != dentry->d_fsdata) {
 			cur = cur->s_parent;
+			if (!cur)
+				return ERR_PTR(-ENOENT);
+		}
 
 		/* look it up */
 		parent = dentry;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/