From patchwork Wed Apr 29 01:56:43 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leon Ma X-Patchwork-Id: 6293391 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 7D36E9F326 for ; Wed, 29 Apr 2015 01:59:11 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A00B720375 for ; Wed, 29 Apr 2015 01:59:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9B9EA20155 for ; Wed, 29 Apr 2015 01:59:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1031377AbbD2B7H (ORCPT ); Tue, 28 Apr 2015 21:59:07 -0400 Received: from mga14.intel.com ([192.55.52.115]:40689 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1031266AbbD2B7G (ORCPT ); Tue, 28 Apr 2015 21:59:06 -0400 Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga103.fm.intel.com with ESMTP; 28 Apr 2015 18:59:05 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.11,668,1422950400"; d="scan'208";a="563403333" Received: from leonma-sh.sh.intel.com ([10.239.154.75]) by orsmga003.jf.intel.com with ESMTP; 28 Apr 2015 18:59:04 -0700 From: Leon Ma To: viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Leon Ma Subject: [PATCH] Validate pointer when copying mount namespace. Date: Wed, 29 Apr 2015 09:56:43 +0800 Message-Id: <1430272604-6701-1-git-send-email-xindong.ma@intel.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: References: Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We encountered following panic. Validate the pointer to avoid this. [35046.276380] BUG: unable to handle kernel NULL pointer dereference at 00000010 [35046.283316] IP: [<8095dc91>] copy_mnt_ns+0x111/0x260 [35046.288225] *pdpt = 000000001b883001 *pde = 0000000000000000 [35046.293901] Oops: 0000 [#1] PREEMPT SMP [35046.307342] CPU: 2 PID: 6761 Comm: main Tainted: G W O [35046.315345] task: a7f06f80 ti: 82e16000 task.ti: 82e16000 [35046.320673] EIP: 0060:[<8095dc91>] EFLAGS: 00210246 CPU: 2 [35046.326106] EIP is at copy_mnt_ns+0x111/0x260 [35046.330397] EAX: 3436362e EBX: b1026880 ECX: 96822f80 EDX: 828314a8 [35046.336590] ESI: 00000000 EDI: b0dde300 EBP: 82e17f50 ESP: 82e17f24 [35046.342789] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [35046.348124] CR0: 8005003b CR2: 00000010 CR3: 033c6000 CR4: 00102720 [35046.354397] DR0: 00000000 DR1: 00000001 DR2: 00000002 DR3: 00000003 [35046.360525] DR6: 00000006 DR7: 00000007 [35046.364299] Stack: [35046.366278] 828314a8 96822f80 82831490 82831490 82831490 a3161780 82831480 00000018 [35046.373932] a7f06f80 a4c130d8 00020200 82e17f6c 8085f98d b1026880 8134b920 00020200 [35046.381593] 8134b920 82e17f9c 82e17f84 8085fbcf b1026880 00020200 ffffffea 00000000 [35046.389259] Call Trace: [35046.391693] [<8085f98d>] create_new_namespaces+0x4d/0x160 [35046.397106] [<8085fbcf>] unshare_nsproxy_namespaces+0x5f/0xa0 [35046.402870] [<8083c7c4>] SyS_unshare+0x104/0x240 [35046.407518] [<80fe1700>] syscall_call+0x7/0xb Signed-off-by: Leon Ma --- fs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namespace.c b/fs/namespace.c index 1f4f9da..1c61c92 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2788,7 +2788,7 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, q = next_mnt(q, new); if (!q) break; - while (p->mnt.mnt_root != q->mnt.mnt_root) + while (p && p->mnt.mnt_root != q->mnt.mnt_root) p = next_mnt(p, old); } namespace_unlock();