[PATCH] Fix a panic when core_pattern is set to "| prog..."

[PATCH] Fix a panic when core_pattern is set to "| prog..."

[Dietmar Hahn]

Hi,

if the /proc/sys/kernel/core_pattern is set with a space between '|' and the
program and later a core file should be written the kernel panics.
This happens because in format_corename() the first part of cn.corename
is set to '\0' and later call_usermodehelper_exec() exits because of an
empty command path but with return 0. But no pipe is created and thus
cprm.file == NULL.
This leads in file_start_write() to the panic because of dereferencing
file_inode(file)->i_mode.

Thanks,
Dietmar.

[  432.431005] BUG: kernel NULL pointer dereference, address: 0000000000000020
[  432.431006] #PF: supervisor read access in kernel mode
[  432.431006] #PF: error_code(0x0000) - not-present page
[  432.431007] PGD 102ad73067 P4D 102ad73067 PUD 105b898067 PMD 0 
[  432.431010] Oops: 0000 [#1] SMP NOPTI
[  432.431012] CPU: 0 PID: 20114 Comm: a Kdump: loaded Tainted: G            E     5.5.0-rc2-10.g62d06a0-default+ #15
[  432.431013] Hardware name: FUJITSU SE SERVER SU310 M1/D3753-C1, BIOS V5.0.0.14 R1.12.0 for D3753-C1x                    07/22/2019
[  432.431020] RIP: 0010:do_coredump+0x7b8/0x1128
[  432.431021] Code: 00 48 8b bd 18 ff ff ff 48 85 ff 74 05 e8 60 04 fa ff 65 48 8b 04 25 c0 ab 01 00 48 8b 00 48 8b 4d a0 a8 04 0f 85 16 01 00 00 <48> 8b 51 20 0f b7 02 66 25 00 f0 66 3d 00 80 75 13 48 8b 7a 28 be
[  432.431022] RSP: 0018:ffffab39081dfcc0 EFLAGS: 00010246
[  432.431023] RAX: 0000000000004008 RBX: ffff8e77df3e6e80 RCX: 0000000000000000
[  432.431024] RDX: 0000000000000000 RSI: ffffab39081dfc90 RDI: 0000000000000000
[  432.431024] RBP: ffffab39081dfdf8 R08: 0000000000000000 R09: ffffab39081dfc18
[  432.431025] R10: ffff8e6fd9020000 R11: 0000000000000000 R12: ffff8e6fb16eb080
[  432.431026] R13: 0000000000000000 R14: ffffffff8f878400 R15: ffffffff8ff21860
[  432.431027] FS:  00007f8ad3468700(0000) GS:ffff8e6fdfe00000(0000) knlGS:0000000000000000
[  432.431027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  432.431028] CR2: 0000000000000020 CR3: 000000105ef26002 CR4: 00000000007606f0
[  432.431028] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  432.431029] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  432.431029] PKRU: 55555554
[  432.431030] Call Trace:
[  432.431040]  get_signal+0x13c/0x860
[  432.431046]  ? __switch_to_asm+0x34/0x70
[  432.431047]  ? __switch_to_asm+0x40/0x70
[  432.431048]  ? __switch_to_asm+0x34/0x70
[  432.431055]  do_signal+0x36/0x630
[  432.431065]  ? finish_task_switch+0x7c/0x2a0
[  433.237753]  exit_to_usermode_loop+0x95/0x130
[  433.237755]  prepare_exit_to_usermode+0xa7/0xf0
[  433.237758]  ret_from_intr+0x2a/0x3a
[  433.237761] RIP: 0033:0x7f8ad2f05381
[  433.237763] Code: 4c 8b 85 28 fb ff ff 44 29 e8 48 98 49 39 c1 0f 87 a2 f7 ff ff 44 03 ad 20 fb ff ff e9 02 ec ff ff 31 c0 48 83 c9 ff 4c 89 d7 <f2> ae c7 85 28 fb ff ff 00 00 00 00 48 89 ce 48 f7 d6 4c 8d 4e ff
[  433.237763] RSP: 002b:00007fff72daa6a0 EFLAGS: 00010286
[  433.237764] RAX: 0000000000000000 RBX: 00007f8ad325b2a0 RCX: ffffffffffffffff
[  433.237765] RDX: 0000000000000010 RSI: 00007fff72daabf8 RDI: 0000000000000001
[  433.237765] RBP: 00007fff72daac30 R08: 00000000004005fa R09: 0000000000000073
[  433.237766] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000004005f4
[  433.237766] R13: 0000000000000006 R14: 0000000000000000 R15: 00007fff72daac48


Signed-off-by: Dietmar Hahn <dietmar.hahn@ts.fujitsu.com>

---
 fs/coredump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index b1ea7dfbd149..106c1c5f542a 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -628,7 +628,7 @@ void do_coredump(const kernel_siginfo_t *siginfo)
 		char **helper_argv;
 		struct subprocess_info *sub_info;
 
-		if (ispipe < 0) {
+		if (ispipe < 0 || !*cn.corename) {
 			printk(KERN_WARNING "format_corename failed\n");
 			printk(KERN_WARNING "Aborting core\n");
 			goto fail_unlock;
-- 
2.16.4

Re: [PATCH] Fix a panic when core_pattern is set to "| prog..."

[Andi Kleen]

Dietmar Hahn <dietmar.hahn@ts.fujitsu.com> writes:

> Hi,
>
> if the /proc/sys/kernel/core_pattern is set with a space between '|' and the
> program and later a core file should be written the kernel panics.
> This happens because in format_corename() the first part of cn.corename
> is set to '\0' and later call_usermodehelper_exec() exits because of an
> empty command path but with return 0. But no pipe is created and thus
> cprm.file == NULL.
> This leads in file_start_write() to the panic because of dereferencing
> file_inode(file)->i_mode.

It would seem better to just skip the spaces and DTRT?

Of course doing the error check properly is a good idea anyways.

-Andi

Re: [PATCH] Fix a panic when core_pattern is set to "| prog..."

[Dietmar Hahn]

Am Montag, 16. Dezember 2019, 19:37:07 CET schrieb Andi Kleen:
> Dietmar Hahn <dietmar.hahn@ts.fujitsu.com> writes:
> 
> > Hi,
> >
> > if the /proc/sys/kernel/core_pattern is set with a space between '|' and the
> > program and later a core file should be written the kernel panics.
> > This happens because in format_corename() the first part of cn.corename
> > is set to '\0' and later call_usermodehelper_exec() exits because of an
> > empty command path but with return 0. But no pipe is created and thus
> > cprm.file == NULL.
> > This leads in file_start_write() to the panic because of dereferencing
> > file_inode(file)->i_mode.
> 
> It would seem better to just skip the spaces and DTRT?

This would be the normal case but the mistake happened accidently. And I was
really surprised to see the system panic after the segfault of a user program.
And it took a little bit time to find the cause ...

Dietmar.
 
> Of course doing the error check properly is a good idea anyways.
> 
> -Andi