linux-kernel - Re: [PATCH] bdev: fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <858239cb-4b97-c071-2317-7e6da11675ac@fb.com>
Date:   Mon, 22 Aug 2016 08:06:32 -0600
From:   Jens Axboe <axboe@...com>
To:     Vegard Nossum <vegard.nossum@...cle.com>
CC:     <linux-kernel@...r.kernel.org>, <syzkaller@...glegroups.com>,
        Shaohua Li <shli@...com>, Tejun Heo <tj@...nel.org>,
        <stable@...r.kernel.org>
Subject: Re: [PATCH] bdev: fix NULL pointer dereference

On 08/22/2016 04:47 AM, Vegard Nossum wrote:
> I got this:
>
>     kasan: GPF could be caused by NULL-ptr deref or user memory access
>     general protection fault: 0000 [#1] PREEMPT SMP KASAN
>     Dumping ftrace buffer:
>        (ftrace buffer empty)
>     CPU: 0 PID: 5505 Comm: syz-executor Not tainted 4.8.0-rc2+ #161
>     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
>     task: ffff880113415940 task.stack: ffff880118350000
>     RIP: 0010:[<ffffffff8172cb32>]  [<ffffffff8172cb32>] bd_mount+0x52/0xa0
>     RSP: 0018:ffff880118357ca0  EFLAGS: 00010207
>     RAX: dffffc0000000000 RBX: ffffffffffffffff RCX: ffffc90000bb6000
>     RDX: 0000000000000018 RSI: ffffffff846d6b20 RDI: 00000000000000c7
>     RBP: ffff880118357cb0 R08: ffff880115967c68 R09: 0000000000000000
>     R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801188211e8
>     R13: ffffffff847baa20 R14: ffff8801139cb000 R15: 0000000000000080
>     FS:  00007fa3ff6c0700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000
>     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>     CR2: 00007fc1d8cc7e78 CR3: 0000000109f20000 CR4: 00000000000006f0
>     DR0: 000000000000001e DR1: 000000000000001e DR2: 0000000000000000
>     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
>     Stack:
>      ffff880112cfd6c0 ffff8801188211e8 ffff880118357cf0 ffffffff8167f207
>      ffffffff816d7a1e ffff880112a413c0 ffffffff847baa20 ffff8801188211e8
>      0000000000000080 ffff880112cfd6c0 ffff880118357d38 ffffffff816dce0a
>     Call Trace:
>      [<ffffffff8167f207>] mount_fs+0x97/0x2e0
>      [<ffffffff816d7a1e>] ? alloc_vfsmnt+0x55e/0x760
>      [<ffffffff816dce0a>] vfs_kern_mount+0x7a/0x300
>      [<ffffffff83c3247c>] ? _raw_read_unlock+0x2c/0x50
>      [<ffffffff816dfc87>] do_mount+0x3d7/0x2730
>      [<ffffffff81235fd4>] ? trace_do_page_fault+0x1f4/0x3a0
>      [<ffffffff816df8b0>] ? copy_mount_string+0x40/0x40
>      [<ffffffff8161ea81>] ? memset+0x31/0x40
>      [<ffffffff816df73e>] ? copy_mount_options+0x1ee/0x320
>      [<ffffffff816e2a02>] SyS_mount+0xb2/0x120
>      [<ffffffff816e2950>] ? copy_mnt_ns+0x970/0x970
>      [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
>      [<ffffffff83c3282a>] entry_SYSCALL64_slow_path+0x25/0x25
>     Code: 83 e8 63 1b fc ff 48 85 c0 48 89 c3 74 4c e8 56 35 d1 ff 48 8d bb c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 36 4c 8b a3 c8 00 00 00 48 b8 00 00 00 00 00 fc
>     RIP  [<ffffffff8172cb32>] bd_mount+0x52/0xa0
>      RSP <ffff880118357ca0>
>     ---[ end trace 13690ad962168b98 ]---
>
> mount_pseudo() returns ERR_PTR(), not NULL, on error.

Thanks, applied.

-- 
Jens Axboe