Bug 29931
| Summary: | if expand_name() return with NULL, coredump() crashes the kernel | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | Tamas Foldi <crow> | ||||
| Component: | kern | Assignee: | Peter Pentchev <roam> | ||||
| Status: | Closed FIXED | ||||||
| Severity: | Affects Only Me | ||||||
| Priority: | Normal | ||||||
| Version: | 4.3-RELEASE | ||||||
| Hardware: | Any | ||||||
| OS: | Any | ||||||
| Attachments: |
|
||||||
Peter Pentchev <roam@ringlet.net> writes: > This looks genuine. Any objections to committing it, and MFC'ing before > 4.4 comes out? I don't see any reason to rush the MFC. Responsible Changed From-To: freebsd-bugs->roam Peter inquired about this on -arch, so it's his problem now :-). On Thu, Aug 23, 2001 at 02:21:18PM -0700, Dima Dorfman wrote:
> Peter Pentchev <roam@ringlet.net> writes:
> > This looks genuine. Any objections to committing it, and MFC'ing before
> > 4.4 comes out?
>
> I don't see any reason to rush the MFC.
Mmmm.. preventing foot-shooting? A panicked kernel is a bit too harsh
a punishment for a misconfigured kern.corefile, IMHO..
Granted, this level of misconfiguration is not easy to attain ;)
But it could always happen as a result of a cut-and-paste-o and
corefiles kept in a central directory or something..
G'luck,
Peter
--
I am jealous of the first word in this sentence.
Peter Pentchev <roam@ringlet.net> writes: > On Thu, Aug 23, 2001 at 02:21:18PM -0700, Dima Dorfman wrote: > > Peter Pentchev <roam@ringlet.net> writes: > > > This looks genuine. Any objections to committing it, and MFC'ing before > > > 4.4 comes out? > > > > I don't see any reason to rush the MFC. > > Mmmm.. preventing foot-shooting? A panicked kernel is a bit too harsh > a punishment for a misconfigured kern.corefile, IMHO.. > Granted, this level of misconfiguration is not easy to attain ;) > But it could always happen as a result of a cut-and-paste-o and > corefiles kept in a central directory or something.. I didn't say it shouldn't be MFC'd at all, just that I think it shouldn't be MFC'd this late into a code freeze since it's hardly critical. Anyway, that's for jkh and murray to decide. There's nothing wrong with the patch that I can see. State Changed From-To: open->suspended The patch was committed to -current, I'll MFC it in a month. Thanks for the problem report, the analysis and the patch! State Changed From-To: suspended->closed The patch was merged into 4.4-STABLE. Thanks for the problem report and the analysis! |
When the expand_name() generates too large core filename, it's return value is NULL address. This NULL value is given to vn_open(), which causes kernel panic. In some cases (non default kern.corefile settings) users can freeze the system (of course, root always can). How-To-Repeat: #!/bin/sh /sbin/sysctl -w kern.corefile=`perl -e 'print "%N" x 512'` echo 'int main (){int *a;printf("segfaulting...\n");printf("%u",*a);}'>/tmp/seg.c cd /tmp && make seg && /tmp/seg cd -