From: "Rafael J. Wysocki" <rjw@sisk•pl>
To: Jiri Kosina <jkosina@suse•cz>
Cc: Stephen Rothwell <sfr@canb•auug.org.au>,
kernel-testers@vger•kernel.org, linux-next@vger•kernel.org,
LKML <linux-kernel@vger•kernel.org>,
Andrew Morton <akpm@linux-foundation•org>,
Rusty Russell <rusty@rustcorp•com.au>
Subject: Re: linux-next: Tree for June 25
Date: Thu, 26 Jun 2008 12:49:23 +0200 [thread overview]
Message-ID: <200806261249.24340.rjw@sisk.pl> (raw)
In-Reply-To: <alpine.LRH.1.10.0806261201420.10290@twin.jikos.cz>
On Thursday, 26 of June 2008, Jiri Kosina wrote:
> On Thu, 26 Jun 2008, Rafael J. Wysocki wrote:
>
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> > IP: [<ffffffff80264230>] find_symbol+0x230/0x260
> > PGD 5c817067 PUD 5cccf067 PMD 0
> > Oops: 0002 [1] SMP DEBUG_PAGEALLOC
> > last sysfs file:
> > CPU 0
> > Modules linked in:
> > Pid: 912, comm: modprobe Not tainted 2.6.26-rc7-next #4
> > RIP: 0010:[<ffffffff80264230>] [<ffffffff80264230>] find_symbol+0x230/0x260
> > RSP: 0018:ffff81005cbddc68 EFLAGS: 00010202
> > RAX: 0000000000000000 RBX: 000000000000003d RCX: ffffffff805b8568
> > RDX: 0000000000000000 RSI: ffffffff80573e0f RDI: ffffffff805c0bcc
> > RBP: ffff81005cbddda8 R08: ffff81005cbddd48 R09: 0000000000000001
> > R10: 0000000000000000 R11: 000000000000003c R12: fffffffffffffff2
> > R13: 00000000000b2507 R14: 00000000006181e0 R15: ffffc20000689240
> > FS: 00007f5820fed6f0(0000) GS:ffffffff80613f40(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> > CR2: 0000000000000000 CR3: 000000005c87f000 CR4: 00000000000006e0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> > Process modprobe (pid: 912, threadinfo ffff81005cbdc000, task ffff81005c9f6840)
> > Stack: ffff81005c9f6840 0000000000000000 0000000000000000 00000000006180f8
> > ffff81005cbddf40 0000000000000000 ffff81005c9f6840 ffffffff8049728f
> > 00000000000b2507 00000000006181e0 ffff81005cbddcd8 ffffffff8025c70a
> > Call Trace:
> > [<ffffffff8049728f>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> > [<ffffffff8025c70a>] ? trace_hardirqs_on_caller+0xca/0x160
> > [<ffffffff8049728f>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> > [<ffffffff8020f167>] ? do_softirq+0x47/0xa0
> > [<ffffffff8020bc9f>] ? restore_args+0x0/0x30
> > [<ffffffff80263c80>] ? struct_module+0x0/0x10
> > [<ffffffff802648f3>] ? find_sec+0x53/0x70
> > [<ffffffff80265c04>] sys_init_module+0x6b4/0x1e00
> > [<ffffffff802afc11>] ? do_sync_read+0xf1/0x130
> > [<ffffffff802505e0>] ? autoremove_wake_function+0x0/0x40
> > [<ffffffff80323791>] ? security_file_permission+0x11/0x20
> > [<ffffffff8049728f>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> > [<ffffffff8025c70a>] ? trace_hardirqs_on_caller+0xca/0x160
> > [<ffffffff8049728f>] ? trace_hardirqs_on_thunk+0x3a/0x3f
> > [<ffffffff8020b65b>] system_call_after_swapgs+0x7b/0x80
> >
> >
> > Code: 49 8b 43 08 0f 18 08 49 8d 43 08 48 3d c0 a5 5d 80 0f 85 47 fe ff ff 48 c7 c0 fe ff ff ff eb 20 48 8b 45 b0 48 8b 95 e8 fe ff ff <48> 89 02 48
> > RIP [<ffffffff80264230>] find_symbol+0x230/0x260
> > RSP <ffff81005cbddc68>
> > CR2: 0000000000000000
> > ---[ end trace 81cec6311b0e1cee ]---
>
> I guess this got in through Rusty's tree, right?
>
> Does the patch below fix it please?
Yes, it does.
Thanks,
Rafael
> From: Jiri Kosina <jkosina@suse•cz>
> Subject: [PATCH] module: fix NULL pointer dereference in find_symbol()
>
> The patch that introduces each_symbol() iterator forgets to
> test the NULL value of the output parameters (which the original
> code did).
>
> This patch restores the correct checks.
>
> Signed-off-by: Jiri Kosina <jkosina@suse•cz>
> ---
> kernel/module.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index 880409f..a3354ca 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -304,8 +304,10 @@ static unsigned long find_symbol(const char *name,
> fsa.warn = warn;
>
> if (each_symbol(find_symbol_in_section, &fsa)) {
> - *owner = fsa.owner;
> - *crc = fsa.crc;
> + if (owner)
> + *owner = fsa.owner;
> + if (crc)
> + *crc = fsa.crc;
> return fsa.value;
> }
>
next prev parent reply other threads:[~2008-06-26 10:48 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-06-25 14:35 linux-next: Tree for June 25 Stephen Rothwell
[not found] ` <20080626003554.b2623aba.sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org>
2008-06-26 0:28 ` Rafael J. Wysocki
2008-06-26 2:02 ` Stephen Rothwell
[not found] ` <20080626120212.c8caa005.sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org>
2008-06-26 6:01 ` Rafael J. Wysocki
2008-06-26 6:59 ` Rafael J. Wysocki
2008-06-26 10:03 ` Jiri Kosina
2008-06-26 10:49 ` Rafael J. Wysocki [this message]
[not found] ` <200806261249.24340.rjw-KKrjLPT3xs0@public.gmane.org>
2008-06-26 14:21 ` Stephen Rothwell
2008-06-26 18:23 ` Rafael J. Wysocki
[not found] ` <alpine.LRH.1.10.0806261201420.10290-1ReQVI26iDCaZKY3DrU6dA@public.gmane.org>
2008-06-27 3:01 ` Rusty Russell
-- strict thread matches above, loose matches on Subject: below --
2009-06-25 5:38 Stephen Rothwell
2010-06-25 3:40 Stephen Rothwell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200806261249.24340.rjw@sisk.pl \
--to=rjw@sisk$(echo .)pl \
--cc=akpm@linux-foundation$(echo .)org \
--cc=jkosina@suse$(echo .)cz \
--cc=kernel-testers@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=rusty@rustcorp$(echo .)com.au \
--cc=sfr@canb$(echo .)auug.org.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox