lkml.org 
[lkml]   [2010]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] ima: avoid null pointer deref in ima_main.c
    Date
    I've met following oops when kernel is running ltp test pipe07.
    Which is trying to open pipes until EMFILE is returned.

    BUG: unable to handle kernel NULL pointer dereference at 00000000000000ae
    IP: [<ffffffff811f4c75>] ima_file_free+0x2e/0x26d
    PGD 21d7cc067 PUD 21b20b067 PMD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/kernel/mm/ksm/run
    CPU 2
    Pid: 1581, comm: pipe07 Not tainted 2.6.33-rc6-git #59 0M860N/OptiPlex 760
    RIP: 0010:[<ffffffff811f4c75>] [<ffffffff811f4c75>] ima_file_free+0x2e/0x26d
    RSP: 0018:ffff88021d0bbe38 EFLAGS: 00010202
    RAX: ffff88022b550700 RBX: ffff88021ac4e8c0 RCX: ffff88021d776300
    RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88021ac4e8c0
    RBP: ffff88021d0bbe88 R08: ffff88021d0bbe18 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000000 R12: ffff88021ac4e8c0
    R13: 0000000000000000 R14: 00000000ffffffe8 R15: ffff88021d0bbf38
    FS: 00007ff0f45ed700(0000) GS:ffff88002fa00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000000000ae CR3: 000000021d7ff000 CR4: 00000000000406e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process pipe07 (pid: 1581, threadinfo ffff88021d0ba000, task ffff88021801a400)
    Stack:
    ffff88021d0bbe68 ffff88002fbd25b0 0000041c1d0bbe68 ffff88021ac4e8c0
    <0> ffff88021ac4ea00 ffff88021ac4e8c0 ffff88021ac4ea00 ffff88021ac4e8c0
    <0> 00000000ffffffe8 ffff88021d0bbf38 ffff88021d0bbea8 ffffffff811dc02d
    Call Trace:
    [<ffffffff811dc02d>] security_file_free+0x2d/0x31
    [<ffffffff81115dfe>] put_filp+0x22/0x36
    [<ffffffff8111baf8>] free_write_pipe+0x2f/0x33
    [<ffffffff8111c74d>] do_pipe_flags+0xdc/0xf6
    [<ffffffff8111c788>] sys_pipe2+0x21/0x63
    [<ffffffff8111c7da>] sys_pipe+0x10/0x12
    [<ffffffff81009bf2>] system_call_fastpath+0x16/0x1b
    Code: e5 41 57 41 56 41 55 41 54 53 48 83 ec 28 0f 1f 44 00 00 83 3d 94 0c 61 01 00 48 8b 47 18 49 89 fc 4c 8b 68 50 0f 84 2d 02 00 00 <41> 0f b7 85 ae 00 00 00 25 00 f0 00 00 3d 00 80 00 00 0f 85 15
    RIP [<ffffffff811f4c75>] ima_file_free+0x2e/0x26d
    RSP <ffff88021d0bbe38>
    CR2: 00000000000000ae

    With this patch, my system doesn't oops with ltp testcase pipe06/pipe07.

    Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
    Cc: Mimi Zohar <zohar@us.ibm.com>
    Cc: James Morris <jmorris@namei.org>
    Cc: Eric Paris <eparis@redhat.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Serge Hallyn <serue@us.ibm.com>
    ---
    security/integrity/ima/ima_main.c | 8 ++++----
    1 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
    index a89f44d..7ea9c22 100644
    --- a/security/integrity/ima/ima_main.c
    +++ b/security/integrity/ima/ima_main.c
    @@ -141,7 +141,7 @@ void ima_file_free(struct file *file)
    struct inode *inode = file->f_dentry->d_inode;
    struct ima_iint_cache *iint;

    - if (!ima_initialized || !S_ISREG(inode->i_mode))
    + if (!ima_initialized || !inode || !S_ISREG(inode->i_mode))
    return;
    iint = ima_iint_find_get(inode);
    if (!iint)
    @@ -221,7 +221,7 @@ int ima_path_check(struct path *path, int mask)
    struct file *file = NULL;
    int rc;

    - if (!ima_initialized || !S_ISREG(inode->i_mode))
    + if (!ima_initialized || !inode || !S_ISREG(inode->i_mode))
    return 0;
    iint = ima_iint_find_get(inode);
    if (!iint)
    @@ -277,7 +277,7 @@ static int process_measurement(struct file *file, const unsigned char *filename,
    struct ima_iint_cache *iint;
    int rc;

    - if (!ima_initialized || !S_ISREG(inode->i_mode))
    + if (!ima_initialized || !inode || !S_ISREG(inode->i_mode))
    return 0;
    iint = ima_iint_find_get(inode);
    if (!iint)
    @@ -311,7 +311,7 @@ void ima_counts_get(struct file *file)
    struct inode *inode = file->f_dentry->d_inode;
    struct ima_iint_cache *iint;

    - if (!ima_initialized || !S_ISREG(inode->i_mode))
    + if (!ima_initialized || !inode || !S_ISREG(inode->i_mode))
    return;
    iint = ima_iint_find_get(inode);
    if (!iint)
    --
    1.6.5.2


    \
     
     \ /
      Last update: 2010-02-05 11:17    [W:0.024 / U:1.796 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site