maxmustermann/linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
linux/net/9p
History
Will Deacon 50192abe02 fs/9p: avoid accessing utsname after namespace has been torn down 
During trinity fuzzing in a kvmtool guest, I stumbled across the
following:

Unable to handle kernel NULL pointer dereference at virtual address 00000004
PC is at v9fs_file_do_lock+0xc8/0x1a0
LR is at v9fs_file_do_lock+0x48/0x1a0
[<c01e2ed0>] (v9fs_file_do_lock+0xc8/0x1a0) from [<c0119154>] (locks_remove_flock+0x8c/0x124)
[<c0119154>] (locks_remove_flock+0x8c/0x124) from [<c00d9bf0>] (__fput+0x58/0x1e4)
[<c00d9bf0>] (__fput+0x58/0x1e4) from [<c0044340>] (task_work_run+0xac/0xe8)
[<c0044340>] (task_work_run+0xac/0xe8) from [<c002e36c>] (do_exit+0x6bc/0x8d8)
[<c002e36c>] (do_exit+0x6bc/0x8d8) from [<c002e674>] (do_group_exit+0x3c/0xb0)
[<c002e674>] (do_group_exit+0x3c/0xb0) from [<c002e6f8>] (__wake_up_parent+0x0/0x18)

I believe this is due to an attempt to access utsname()->nodename, after
exit_task_namespaces() has been called, leaving current->nsproxy->uts_ns
as NULL and causing the above dereference.

A similar issue was fixed for lockd in 9a1b6bf818 ("LOCKD: Don't call
utsname()->nodename from nlmclnt_setlockargs"), so this patch attempts
something similar for 9pfs.

Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Ron Minnich <rminnich@sandia.gov>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2013-08-26 10:28:46 -05:00
..
client.c fs/9p: avoid accessing utsname after namespace has been torn down 2013-08-26 10:28:46 -05:00
error.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
Kconfig net/9p: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:39:33 -08:00
Makefile [net/9p] Preparation and helper functions for zero copy 2011-03-15 09:57:34 -05:00
mod.c 9p: Reduce object size with CONFIG_NET_9P_DEBUG 2012-01-05 10:51:44 -06:00
protocol.c 9p: Modify the stat structures to use kuid_t and kgid_t 2013-02-12 03:19:31 -08:00
protocol.h net/9p: Convert net/9p protocol dumps to tracepoints 2011-10-24 11:13:12 -05:00
trans_common.c 9p: fix off by one causing access violations and memory corruption 2013-07-11 11:36:02 -07:00
trans_common.h fs/9p: Update zero-copy implementation in 9p 2011-10-24 11:13:11 -05:00
trans_fd.c net/9p: add privport option to 9p tcp transport 2013-07-07 21:59:54 -05:00
trans_rdma.c 9P: Add cancelled() to the transport functions. 2013-07-07 22:18:18 -05:00
trans_virtio.c 9p: send uevent after adding/removing mount_tag attribute 2013-08-26 10:28:22 -05:00
util.c net/9p: convert to idr_alloc() 2013-02-27 19:10:20 -08:00