All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, linux-mm@kvack.org,
	matthew.ruffell@canonical.com, mm-commits@vger.kernel.org,
	nhorman@tuxdriver.com, pabs3@bonedaddy.net,
	stable@vger.kernel.org, sudipm.mukherjee@gmail.com,
	torvalds@linux-foundation.org, viro@zeniv.linux.org.uk
Subject: [patch 14/15] coredump: fix null pointer dereference on coredump
Date: Mon, 20 Apr 2020 18:14:20 -0700	[thread overview]
Message-ID: <20200421011420.GnVj8rZfk%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200420181310.c18b3c0aa4dc5b3e5ec1be10@linux-foundation.org>

From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Subject: coredump: fix null pointer dereference on coredump

If the core_pattern is set to "|" and any process segfaults then we get
a null pointer derefernce while trying to coredump. The call stack shows:
[  108.212680] RIP: 0010:do_coredump+0x628/0x11c0

When the core_pattern has only "|" there is no use of trying the coredump
and we can check that while formating the corename and exit with an error.

After this change I get:
[   48.453756] format_corename failed
[   48.453758] Aborting core

Link: http://lkml.kernel.org/r/20200416194612.21418-1-sudipm.mukherjee@gmail.com
Fixes: 315c69261dd3 ("coredump: split pipe command whitespace before expanding template")
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Reported-by: Matthew Ruffell <matthew.ruffell@canonical.com>
Cc: Paul Wise <pabs3@bonedaddy.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/coredump.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/coredump.c~coredump-fix-null-pointer-dereference-on-coredump
+++ a/fs/coredump.c
@@ -211,6 +211,8 @@ static int format_corename(struct core_n
 			return -ENOMEM;
 		(*argv)[(*argc)++] = 0;
 		++pat_ptr;
+		if (!(*pat_ptr))
+			return -ENOMEM;
 	}
 
 	/* Repeat as long as we have more pattern to process and more output
_

  parent reply	other threads:[~2020-04-21  1:14 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-21  1:13 incoming Andrew Morton
2020-04-21  1:13 ` [patch 01/15] sh: fix build error in mm/init.c Andrew Morton
2020-04-21  1:13 ` [patch 02/15] slub: avoid redzone when choosing freepointer location Andrew Morton
2020-04-21  1:13 ` [patch 03/15] mm/userfaultfd: disable userfaultfd-wp on x86_32 Andrew Morton
2020-04-21  1:13 ` [patch 04/15] MAINTAINERS: add an entry for kfifo Andrew Morton
2020-04-21 12:31   ` Andy Shevchenko
2020-04-21  1:13 ` [patch 05/15] mm/hugetlb: fix a addressing exception caused by huge_pte_offset Andrew Morton
2020-04-21  1:13 ` [patch 06/15] mm, gup: return EINTR when gup is interrupted by fatal signals Andrew Morton
2020-04-21  1:13 ` [patch 07/15] checkpatch: fix a typo in the regex for $allocFunctions Andrew Morton
2020-04-21  1:14 ` [patch 08/15] tools/build: tweak unused value workaround Andrew Morton
2020-04-21  1:14 ` [patch 09/15] mm/ksm: fix NULL pointer dereference when KSM zero page is enabled Andrew Morton
2020-04-21  1:14 ` [patch 10/15] mm/shmem: fix build without THP Andrew Morton
2020-04-21  1:14 ` [patch 11/15] vmalloc: fix remap_vmalloc_range() bounds checks Andrew Morton
2020-04-21  1:14 ` [patch 12/15] shmem: fix possible deadlocks on shmlock_user_lock Andrew Morton
2020-04-21  1:14 ` [patch 13/15] mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path Andrew Morton
2020-04-21  1:14 ` Andrew Morton [this message]
2020-04-21  1:14 ` [patch 15/15] tools/vm: fix cross-compile build Andrew Morton
2020-04-21  2:00 ` + mm-memory_hotplug-refrain-from-adding-memory-into-an-impossible-node.patch added to -mm tree Andrew Morton
2020-04-21  2:48 ` + x86-mm-define-mm_p4d_folded.patch " Andrew Morton
2020-04-21  2:52 ` + mm-debug-add-tests-validating-architecture-page-table-helpers-v17.patch " Andrew Morton
2020-04-21  2:59 ` + mm-mmapc-add-more-sanity-checks-to-get_unmapped_area.patch " Andrew Morton
2020-04-21  2:59 ` + mm-mmapc-do-not-allow-mappings-outside-of-allowed-limits.patch " Andrew Morton
2020-04-21  3:07 ` + initrdmem=-option-to-specify-initrd-physical-address-checkpatch-fixes.patch " Andrew Morton
2020-04-21  3:58 ` + initrdmem=-option-to-specify-initrd-physical-address.patch " Andrew Morton
2020-04-21  5:43 ` mmotm 2020-04-20-22-43 uploaded Andrew Morton
2020-04-21  5:43 ` Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-found_free-could-be-represented-by-tmp-max.patch added to -mm tree Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-tmp-is-always-smaller-than-max.patch " Andrew Morton
2020-04-22  1:36 ` + mm-swapfilec-omit-a-duplicate-code-by-compare-tmp-and-max-first.patch " Andrew Morton
2020-04-23 22:36 ` + kasan-initialise-array-in-kasan_memcmp-test.patch " Andrew Morton
2020-04-23 22:38 ` + kvm-svm-change-flag-passed-to-gup-fast-in-sev_pin_memory.patch " Andrew Morton
2020-04-23 22:41 ` + mm-pass-task-and-mm-to-do_madvise-fix.patch " Andrew Morton
2020-04-23 22:44 ` + mm-support-vector-address-ranges-for-process_madvise.patch " Andrew Morton
2020-04-23 22:44 ` + mm-support-vector-address-ranges-for-process_madvise-fix.patch " Andrew Morton
2020-04-23 22:48 ` + kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source.patch " Andrew Morton
2020-04-23 22:48 ` + stringh-fix-incompatibility-between-fortify_source-and-kasan.patch " Andrew Morton
2020-04-23 23:03 ` + powerpc-add-support-for-folded-p4d-page-tables-fix.patch " Andrew Morton
2020-04-23 23:09 ` [folded-merged] memcg-optimize-memorynuma_stat-like-memorystat-fix.patch removed from " Andrew Morton
2020-04-23 23:32 ` + slub-remove-userspace-notifier-for-cache-add-remove.patch added to " Andrew Morton
2020-04-23 23:35 ` + ocfs2-mount-shared-volume-without-ha-stack.patch " Andrew Morton
2020-04-24  0:29 ` + mm-memory_hotplug-handle-memblocks-only-with-config_arch_keep_memblock.patch " Andrew Morton
2020-04-24  1:17 ` + mm-return-true-in-cpupid_pid_unset.patch " Andrew Morton
2020-04-24  1:20 ` + kernel-better-document-the-use_mm-unuse_mm-api-contract-v2-fix.patch " Andrew Morton
2020-04-24  1:40 ` + mm-thp-rename-pmd_mknotpresent-as-pmd_mkinvalid-v2.patch " Andrew Morton
2020-04-24  1:47 ` + ipc-convert-ipcs_idr-to-xarray-update.patch " Andrew Morton
2020-06-05 19:58   ` Qian Cai
2020-06-05 20:11     ` Matthew Wilcox
2020-06-05 21:20       ` Andrew Morton
2020-06-10  2:14         ` Matthew Wilcox
2020-12-30 15:44   ` Manfred Spraul
2020-04-24  2:06 ` + powerpc-spufs-simplify-spufs-core-dumping.patch " Andrew Morton
2020-04-24  2:06 ` + signal-factor-copy_siginfo_to_external32-from-copy_siginfo_to_user32.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf-femove-the-set_fs-in-fill_siginfo_note.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf-remove-the-set_fskernel_ds-in-elf_core_dump.patch " Andrew Morton
2020-04-24  2:06 ` + binfmt_elf_fdpic-remove-the-set_fskernel_ds-in-elf_fdpic_core_dump.patch " Andrew Morton
2020-04-24  2:06 ` + exec-simplify-the-copy_strings_kernel-calling-convention.patch " Andrew Morton
2020-04-24  2:06 ` + exec-open-code-copy_string_kernel.patch " Andrew Morton
2020-04-24  3:24 ` + add-kernel-config-option-for-twisting-kernel-behavior.patch " Andrew Morton
2020-04-24  3:24 ` + twist-allow-disabling-k_spec-function-in-drivers-tty-vt-keyboardc.patch " Andrew Morton
2020-04-24  3:24 ` + twist-add-option-for-selecting-twist-options-for-syzkallers-testing.patch " Andrew Morton
2020-04-24  3:32 ` + eventpoll-fix-missing-wakeup-for-ovflist-in-ep_poll_callback.patch " Andrew Morton
2020-04-24  3:49 ` [obsolete] linux-next-rejects.patch removed from " Andrew Morton
2020-04-24  3:51 ` + mips-mm-add-page-soft-dirty-tracking.patch added to " Andrew Morton
2020-04-24 23:36 ` + mm-memory_hotplug-set-node_start_pfn-of-hotadded-pgdat-to-0.patch " Andrew Morton
2020-04-26  0:09 ` + mm-switch-the-test_vmalloc-module-to-use-__vmalloc_node-fix-fix.patch " Andrew Morton
2020-04-26  0:17 ` + mm-hugetlb-avoid-unnecessary-check-on-pud-and-pmd-entry-in-huge_pte_offset.patch " Andrew Morton
2020-04-26  0:29 ` + eventpoll-fix-missing-wakeup-for-ovflist-in-ep_poll_callback-v2.patch " Andrew Morton
2020-04-26  0:41 ` [withdrawn] kasan-initialise-array-in-kasan_memcmp-test.patch removed from " Andrew Morton
2020-04-26  0:41 ` + kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source-v4.patch added to " Andrew Morton
2020-04-26  0:48 ` + checkpatch-test-git_dir-changes.patch " Andrew Morton
2020-04-26  1:06 ` + mm-add-debug_wx-support.patch " Andrew Morton
2020-04-26  1:06 ` + riscv-support-debug_wx.patch " Andrew Morton
2020-04-26  1:06 ` + riscv-support-debug_wx-fix.patch " Andrew Morton
2020-04-26  1:06 ` + x86-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch " Andrew Morton
2020-04-26  1:06 ` + arm64-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch " Andrew Morton
2020-04-26  1:09 ` [folded-merged] initrdmem=-option-to-specify-initrd-physical-address-checkpatch-fixes.patch removed from " Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200421011420.GnVj8rZfk%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=matthew.ruffell@canonical.com \
    --cc=mm-commits@vger.kernel.org \
    --cc=nhorman@tuxdriver.com \
    --cc=pabs3@bonedaddy.net \
    --cc=stable@vger.kernel.org \
    --cc=sudipm.mukherjee@gmail.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.