Skip to contentSkip to conversation

proc: check vma->vm_file before dereferencing

PATCH In review Stanislav Kinsbursky 3 participants 6 messages Oct 15, 2012 – Oct 16, 2012 Proc filesystem

lore
Share & tools
lore

Stanislav Kinsbursky

author
#0 lore raw

PATCH 1/1 proc: check vma->vm_file before dereferencing

It can be equal to NULL.

Signed-off-by Stanislav Kinsbursky <[email protected]>
---
 fs/proc/base.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
fs/proc/base.c +3 -2
index 144a967..74fc562 100644
@@ -1770,8 +1770,9 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
 	if (!vma)
 		goto out_no_vma;
 
-	result = proc_map_files_instantiate(dir, dentry, task,
-			(void *)(unsigned long)vma->vm_file->f_mode);
+	if (vma->vm_file)
+		result = proc_map_files_instantiate(dir, dentry, task,
+				(void *)(unsigned long)vma->vm_file->f_mode);
 
 out_no_vma:
 	up_read(&mm->mmap_sem);
#2 lore raw
In reply to Stanislav Kinsbursky
Quoted 2 lines · On Mon, 15 Oct 2012 19:30:03 +0400 Stanislav Kinsbursky…

It can be equal to NULL.

Please write better changelogs, so people do not have to ask questions such as:

- Under what conditions does this bug trigger?

- In which kernel version(s)?

- Is it a post-3.6 regression?

Thanks.

#3 lore raw
Quoted 6 lines · Andrew Morton
Quoted 2 lines · On Mon, 15 Oct 2012 19:30:03 +0400 Stanislav Kinsbursky…

It can be equal to NULL.

Quoted 8 lines

Please write better changelogs, so people do not have to ask questions such as:

- Under what conditions does this bug trigger?

- In which kernel version(s)?

- Is it a post-3.6 regression?

Andrew, would the following changelog be enough?

The commit 7b540d0646ce122f0ba4520412be91e530719742 switched proc_map_files_readdir to use @f_mode directly instead of grabbing @file reference, but same time the test for @vm_file presence was lost leading to nil dereference. The patch brings the test back.

The all proc_map_files feature is CONFIG_CHECKPOINT_RESTORE wrapped (which is set to 'n' by default) so the bug doesn't affect regular kernels.

The regression is 3.7-rc1 only as far as I can tell.

#4 lore raw
Quoted 23 lines · On Tue, 16 Oct 2012 01:52:30 +0400 Cyrill Gorcunov <[email protected]> wrote:
Quoted 6 lines · Andrew Morton
Quoted 2 lines · On Mon, 15 Oct 2012 19:30:03 +0400 Stanislav Kinsbursky…

It can be equal to NULL.

Quoted 8 lines

Please write better changelogs, so people do not have to ask questions such as:

- Under what conditions does this bug trigger?

- In which kernel version(s)?

- Is it a post-3.6 regression?

Andrew, would the following changelog be enough?

The commit 7b540d0646ce122f0ba4520412be91e530719742 switched proc_map_files_readdir to use @f_mode directly instead of grabbing @file reference, but same time the test for @vm_file presence was lost leading to nil dereference. The patch brings the test back.

Quoted 5 lines

The all proc_map_files feature is CONFIG_CHECKPOINT_RESTORE wrapped (which is set to 'n' by default) so the bug doesn't affect regular kernels.

The regression is 3.7-rc1 only as far as I can tell.

Ah, I see, great, thanks.

author
#5 lore raw
In reply to Andrew Morton

16.10.2012 01:40, Andrew Morton пишет:

Quoted 6 lines
Quoted 2 lines · On Mon, 15 Oct 2012 19:30:03 +0400 Stanislav Kinsbursky…

It can be equal to NULL.

Quoted 9 lines

Please write better changelogs, so people do not have to ask questions such as:

- Under what conditions does this bug trigger?

- In which kernel version(s)?

- Is it a post-3.6 regression?

Sure. Sorry.

Quoted 2 lines

Thanks.

Signature · 2 lines
Best regards,
Stanislav Kinsbursky