linux-kernel - Re: 2.6.31-rc2: BUG: unable to handle kernel NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 12 Jul 2009 17:30:06 +0000 (UTC)
From:	Parag Warudkar <parag.warudkar@...il.com>
To:	linux-kernel@...r.kernel.org
Subject:  Re: 2.6.31-rc2: BUG: unable to handle kernel NULL pointer dereference

Thomas Meyer <thomas <at> m3y3r.de> writes:

> 
> [ 6190.368242] Restarting tasks ... done.
> [ 6191.252241] BUG: unable to handle kernel NULL pointer dereference at
0000000000000040
> [ 6191.252253] IP: [<ffffffff8134beea>] strchr+0x24/0x45

[ ... ]

> [ 6191.252253] Call Trace:
> [ 6191.252253]  [<ffffffff812e37d7>] ? selinux_sb_show_options+0x246/0x33c
> [ 6191.252253]  [<ffffffff811306a2>] ? show_vfsmnt+0xbb/0x133
> [ 6191.252253]  [<ffffffff81134785>] ? seq_read+0x293/0x376
> [ 6191.252253]  [<ffffffff81117f49>] ? vfs_read+0xb1/0x123
> [ 6191.252253]  [<ffffffff811180a3>] ? sys_read+0x55/0x90
> [ 6191.252253]  [<ffffffff8102bf2b>] ? system_call_fastpath+0x16/0x1b
> [ 6191.252253] Code: d2 ff 48 83 c4 18 c3 48 83 ec 18 48 89 f8 65 48 8b 14 25
28 00 00 00 48 89 54 24 08 31 d2 eb 0b 84 d2 75 04
> 31 c0 eb 0a 48 ff c0 <8a> 10 40 38 f2 75 ee 48 8b 54 24 08 65 48 33 14 25 28
00 00 00 
> [ 6191.252253] RIP  [<ffffffff8134beea>] strchr+0x24/0x45
> [ 6191.252253]  RSP <ffff8801771b9d98>
> [ 6191.252253] CR2: 0000000000000040
> [ 6191.258135] ---[ end trace f7a4d612974b9b43 ]---

Hmm. It very likely died in selinux_write_opts. 
That is the only function that does the strchr in that code path -

static void selinux_write_opts(struct seq_file *m,
1012                                struct security_mnt_opts *opts)
1013 {
1014         int i;
1015         char *prefix;
1016
1017         for (i = 0; i < opts->num_mnt_opts; i++) {
1018                 char *has_comma;
1019
1020                 if (opts->mnt_opts[i])
1021                         has_comma = strchr(opts->mnt_opts[i], ',');
                                         ^^^^^^^^^^^^^^^^^^^^^^^^^
And that is a NULL pointer dereference - but we just checked for
opts->mnt_opts[i] for not NULL. 

Were there other problems before this trace.
The Tainted: G seems to suggest that?

Parag

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/