Bug 750247
| Summary: | [abrt] kernel: [342487.745059] BUG: unable to handle kernel NULL pointer dereference at 0000003c eip: cifs_fill_dirent | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Adam G. Metzler <adamgmetzler> | ||||
| Component: | kernel | Assignee: | Jeff Layton <jlayton> | ||||
| Status: | CLOSED UPSTREAM | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 16 | CC: | gansalmon, itamar, jlayton, jonathan, kernel-maint, madhu.chinakonda, steved | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | i686 | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | abrt_hash:db224877c737e3c4df052a073472238dd46252d2 | ||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-11-16 20:26:05 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Adam G. Metzler
2011-10-31 13:15:53 UTC
Hmm, I don't have a 32-bit machine handy...could you follow the directions here to get a listing of the spot where it oopsed?
http://wiki.samba.org/index.php/LinuxCIFS_troubleshooting#Oopses
Ahh, nm -- I needed to upgrade my i686 machine anyway:
(gdb) list *(cifs_fill_dirent+0xd6)
0x1cff0 is in cifs_fill_dirent (fs/cifs/readdir.c:361).
356
357 static void cifs_fill_dirent_dir(struct cifs_dirent *de,
358 const FILE_DIRECTORY_INFO *info)
359 {
360 de->name = &info->FileName[0];
361 de->namelen = le32_to_cpu(info->FileNameLength);
362 de->resume_key = info->FileIndex;
363 }
364
365 static void cifs_fill_dirent_full(struct cifs_dirent *de,
Disassembly shows this:
0x0001cff0 <+214>: mov 0x3c(%ebx),%eax
...and the oops message shows that %ebx is 0. 3c is the offset of FileNameLength in FILE_DIRECTORY_INFO, so "info" was NULL here.
Looking farther down the stack to figure out where cifs_save_resume_key got
called:
(gdb) list *(cifs_readdir+0x357)
0x1d912 is in cifs_readdir (fs/cifs/readdir.c:566).
561 (rc == 0) && !cifsFile->srch_inf.endOfSearch) {
562 cFYI(1, "calling findnext2");
563 rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
564 &cifsFile->srch_inf);
565 cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
566 if (rc)
567 return -ENOENT;
568 }
569 if (index_to_find < cifsFile->srch_inf.index_of_last_entry) {
570 /* we found the buffer that contains the entry */
CIFSFindNext has this condition:
if (CIFSMaxBufSize < lnoff) {
cERROR(1, "ignoring corrupt resume name");
psrch_inf->last_entry = NULL;
return rc;
...so we need to ensure that we can deal with a NULL return in the caller, or fix CIFSFindNext not to do that.
Created attachment 533744 [details]
patch -- readd NULL pointer check in cifs_save_resume_key
This patch should fix it. I've gone ahead and sent it upstream. If you're able to reproduce this though, then please test this and let me know if it helps.
The final patch is a bit different, but the upstream cifs maintainer has accepted it and should push it to Linus in the near future. I've also cc'ed stable too so this should make its way into stable kernels eventually. I'm going to go ahead and close this with a resolution of UPSTREAM. Please reopen if you wish to discuss it further. |