Messages in this thread Patch in this message | | | From | Matthew Ruffell <> | Subject | [PATCH 1/1] coredump: Fix null pointer dereference when kernel.core_pattern is "|" | Date | Thu, 20 Feb 2020 18:10:15 +1300 |
| |
Since 315c692, a null pointer dereference can be triggered when the kernel.core_pattern string is set to "|", and a user executes a program which crashes.
This is caused by a subtle change in parameters sent to call_usermodehelper_exec(), as sub_info->path will be set to cn.corename, which has not changed from its initial value of '\0'. call_usermodehelper_exec() will return 0 upon strlen() finding that sub_info->path has zero length.
The fix is to add a length check for cn.corename when we check the return code from call_usermodehelper_exec(). This restores the expected semantics as seen before 315c692, with the message "Core dump to | pipe failed" output to dmesg and the coredump being aborted.
Fixes: 315c692 ("coredump: split pipe command whitespace before expanding template") Signed-off-by: Matthew Ruffell <matthew.ruffell@canonical.com> --- fs/coredump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/coredump.c b/fs/coredump.c index b1ea7dfbd149..ca5976e81d8a 100644 --- a/fs/coredump.c +++ b/fs/coredump.c @@ -686,7 +686,7 @@ void do_coredump(const kernel_siginfo_t *siginfo) UMH_WAIT_EXEC); kfree(helper_argv); - if (retval) { + if (retval || strlen(cn.corename) == 0) { printk(KERN_INFO "Core dump to |%s pipe failed\n", cn.corename); goto close_fail; -- 2.20.1
| |