From: Leon Ma <xindong.ma@intel.com>
To: viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: Leon Ma <xindong.ma@intel.com>
Subject: [PATCH] Validate pointer when copying mount namespace.
Date: Wed, 29 Apr 2015 09:56:43 +0800 [thread overview]
Message-ID: <1430272604-6701-1-git-send-email-xindong.ma@intel.com> (raw)
In-Reply-To: <y>
We encountered following panic. Validate the pointer to avoid this.
[35046.276380] BUG: unable to handle kernel NULL pointer
dereference at 00000010
[35046.283316] IP: [<8095dc91>] copy_mnt_ns+0x111/0x260
[35046.288225] *pdpt = 000000001b883001 *pde = 0000000000000000
[35046.293901] Oops: 0000 [#1] PREEMPT SMP
[35046.307342] CPU: 2 PID: 6761 Comm: main Tainted: G W O
[35046.315345] task: a7f06f80 ti: 82e16000 task.ti: 82e16000
[35046.320673] EIP: 0060:[<8095dc91>] EFLAGS: 00210246 CPU: 2
[35046.326106] EIP is at copy_mnt_ns+0x111/0x260
[35046.330397] EAX: 3436362e EBX: b1026880 ECX: 96822f80 EDX: 828314a8
[35046.336590] ESI: 00000000 EDI: b0dde300 EBP: 82e17f50 ESP: 82e17f24
[35046.342789] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[35046.348124] CR0: 8005003b CR2: 00000010 CR3: 033c6000 CR4: 00102720
[35046.354397] DR0: 00000000 DR1: 00000001 DR2: 00000002 DR3: 00000003
[35046.360525] DR6: 00000006 DR7: 00000007
[35046.364299] Stack:
[35046.366278] 828314a8 96822f80 82831490 82831490 82831490 a3161780
82831480 00000018
[35046.373932] a7f06f80 a4c130d8 00020200 82e17f6c 8085f98d b1026880
8134b920 00020200
[35046.381593] 8134b920 82e17f9c 82e17f84 8085fbcf b1026880 00020200
ffffffea 00000000
[35046.389259] Call Trace:
[35046.391693] [<8085f98d>] create_new_namespaces+0x4d/0x160
[35046.397106] [<8085fbcf>] unshare_nsproxy_namespaces+0x5f/0xa0
[35046.402870] [<8083c7c4>] SyS_unshare+0x104/0x240
[35046.407518] [<80fe1700>] syscall_call+0x7/0xb
Signed-off-by: Leon Ma <xindong.ma@intel.com>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 1f4f9da..1c61c92 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2788,7 +2788,7 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
q = next_mnt(q, new);
if (!q)
break;
- while (p->mnt.mnt_root != q->mnt.mnt_root)
+ while (p && p->mnt.mnt_root != q->mnt.mnt_root)
p = next_mnt(p, old);
}
namespace_unlock();
--
1.7.9.5
next reply other threads:[~2015-04-29 1:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-29 1:56 Leon Ma [this message]
2015-04-29 2:36 ` Al Viro
2015-04-29 3:21 ` Ma, Xindong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1430272604-6701-1-git-send-email-xindong.ma@intel.com \
--to=xindong.ma@intel.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome