linux-kernel - Re: [linux-cifs-client] Re: [2.6.30-rc6] cifs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <524f69650905162324x249b59a0i3fb74036cd3ab53d@mail.gmail.com>
Date:	Sun, 17 May 2009 01:24:36 -0500
From:	Steve French <smfrench@...il.com>
To:	Jeff Layton <jlayton@...hat.com>
Cc:	Luca Tettamanti <kronos.it@...il.com>,
	linux-kernel@...r.kernel.org, linux-cifs-client@...ts.samba.org,
	Shirish Pargaonkar <shirishpargaonkar@...il.com>
Subject: Re: [linux-cifs-client] Re: [2.6.30-rc6] cifs_close: NULL pointer 
	dereference

On Sat, May 16, 2009 at 9:13 PM, Jeff Layton <jlayton@...hat.com> wrote:
> On Sat, 16 May 2009 22:55:58 +0200
> Luca Tettamanti <kronos.it@...il.com> wrote:
>
>> On Sat, May 16, 2009 at 06:28:13PM +0200, Luca Tettamanti wrote:
>> > Hello,
>> > I just hit a NULL pointer dereference in cifs_close while accessing a file on a
>> > remote Samba shared directory.
>> [...]
>> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
>> > IP: [<ffffffffa05f105c>] cifs_close+0x1c1/0x2e8 [cifs]
>>
>> Ok, I've reproduced this on a machine with a serial port :)
>>
>> 0xffffffff803574e0 in list_del (entry=0xffff8800ac184210)
>> at /home/kronos/src/linux-2.6.git/lib/list_debug.c:46
>> 46              WARN(entry->prev->next != entry,
>> (gdb) bt
>> #0  0xffffffff803574e0 in list_del (entry=0xffff8800ac184210)
>>     at /home/kronos/src/linux-2.6.git/lib/list_debug.c:46
>> #1  0xffffffff80319588 in cifs_close (inode=0xffff8800b8d5f088, file=0xffff8800ad8f6d00)
>>     at /home/kronos/src/linux-2.6.git/fs/cifs/file.c:670
>> #2  0xffffffff8029d95e in __fput (file=0xffff8800ad8f6d00)
>>     at /home/kronos/src/linux-2.6.git/fs/file_table.c:281
>> #3  0xffffffff8029da32 in fput (file=0xffff8800ac184210)
>>     at /home/kronos/src/linux-2.6.git/fs/file_table.c:227
>> #4  0xffffffff8029ad30 in filp_close (filp=0xffff8800ad8f6d00, id=0xffff880037a3e080)
>>     at /home/kronos/src/linux-2.6.git/fs/open.c:1108
>> #5  0xffffffff8029ade0 in sys_close (fd=0)
>>     at /home/kronos/src/linux-2.6.git/fs/open.c:1137
>> #6  0xffffffff802271e4 in sysenter_dispatch ()
>>     at /home/kronos/src/linux-2.6.git/arch/x86/ia32/ia32entry.S:161
>> #7  0x0000000000000000 in ?? ()
>>
>> (gdb) f 1
>> #1  0xffffffff80319588 in cifs_close (inode=0xffff8800b8d5f088, file=0xffff8800ad8f6d00)
>>     at /home/kronos/src/linux-2.6.git/fs/cifs/file.c:670
>> 670                     list_del(&pSMBFile->flist);
>>
>> (gdb) p *&pSMBFile->flist
>> $2 = {next = 0x0, prev = 0x0}
>>
>> (gdb) p *&pSMBFile->tlist
>> $5 = {next = 0x0, prev = 0x0}
>>
>> So both flist and tlist were not initilized in cifs_open.
>>
>> The content of the whole pSMBFile structure:
>>
>
> Luca...thanks for the bug report and analysis. I've been able to
> reproduce this too against 3.3.2.

After reproducing the problem, I just looked at this in more detail:
the flist and tlist look like they were initialized, but the problem
is instead that they are being deleted from the wrong cifs file
struct.

Tthe create adds them to the 1st pSMBFile, the close deletes them from
the 1st pSMBFile, the subsequent open added them to the 2nd pSMBFile,
the close deleted them from the 1st pSMBfile (which oopses).

This should be straightforward to fix, but I want to talk with Shirish about it.


-- 
Thanks,

Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/