null dereference in binfmt misc
From: Tycho Andersen
Date: Mon Oct 09 2017 - 17:20:05 EST
Hi,
It looks like eb23aa031 ("exec: binfmt_misc: remove the confusing
e->interp_file != NULL checks") uncovered a bug for me (see the trace below,
which I'm afraid isn't very helpful).
I have a fairly reliable reproducer, but before I dig in, I figured I'd ping
and see if anyone has any pointers on where to look.
Cheers,
Tycho
Oct 9 20:46:06 criu kernel: [ 35.418432] BUG: unable to handle kernel NULL pointer dereference at 0000000000000013
Oct 9 20:46:06 criu kernel: [ 35.419751] IP: bm_evict_inode+0x11/0x40
Oct 9 20:46:06 criu kernel: [ 35.420361] PGD 0 P4D 0
Oct 9 20:46:06 criu kernel: [ 35.420763] Oops: 0000 [#1] SMP
Oct 9 20:46:06 criu kernel: [ 35.421258] Modules linked in: xt_mark fuse
Oct 9 20:46:06 criu kernel: [ 35.421957] CPU: 3 PID: 1902 Comm: zdtm_ct Not tainted 4.14.0-rc4+ #35
Oct 9 20:46:06 criu kernel: [ 35.422963] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1 04/01/2014
Oct 9 20:46:06 criu kernel: [ 35.424356] task: ffff880133093200 task.stack: ffffc90000abc000
Oct 9 20:46:06 criu kernel: [ 35.425312] RIP: 0010:bm_evict_inode+0x11/0x40
Oct 9 20:46:06 criu kernel: [ 35.426003] RSP: 0018:ffffc90000abfc58 EFLAGS: 00010282
Oct 9 20:46:06 criu kernel: [ 35.426813] RAX: ffffffff81211740 RBX: 0000000000000000 RCX: 0000000000000000
Oct 9 20:46:06 criu kernel: [ 35.427916] RDX: 0000000000000001 RSI: 000000000000006b RDI: ffff880129955240
Oct 9 20:46:06 criu kernel: [ 35.429012] RBP: ffffc90000abfc68 R08: ffff8801344ba330 R09: 00000001820001c5
Oct 9 20:46:06 criu kernel: [ 35.430147] R10: ffffc90000abfdd0 R11: 0000000000001300 R12: ffff880129955240
Oct 9 20:46:06 criu kernel: [ 35.431242] R13: ffffffff81820fa0 R14: ffff8801299552c8 R15: ffff8801299e6958
Oct 9 20:46:06 criu kernel: [ 35.432345] FS: 00007f69f2b03700(0000) GS:ffff880139d80000(0000) knlGS:0000000000000000
Oct 9 20:46:06 criu kernel: [ 35.433621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Oct 9 20:46:06 criu kernel: [ 35.434505] CR2: 0000000000000013 CR3: 0000000129220000 CR4: 00000000000006e0
Oct 9 20:46:06 criu kernel: [ 35.435619] Call Trace:
Oct 9 20:46:06 criu kernel: [ 35.435998] evict+0xc2/0x190
Oct 9 20:46:06 criu kernel: [ 35.436450] iput+0x1de/0x230
Oct 9 20:46:06 criu kernel: [ 35.436901] dentry_unlink_inode+0xbd/0x160
Oct 9 20:46:06 criu kernel: [ 35.437562] __dentry_kill+0xba/0x160
Oct 9 20:46:06 criu kernel: [ 35.438114] shrink_dentry_list+0x114/0x2f0
Oct 9 20:46:06 criu kernel: [ 35.438739] shrink_dcache_parent+0x25/0x80
Oct 9 20:46:06 criu kernel: [ 35.439365] do_one_tree+0xd/0x50
Oct 9 20:46:06 criu kernel: [ 35.439874] shrink_dcache_for_umount+0x28/0x80
Oct 9 20:46:06 criu kernel: [ 35.440551] generic_shutdown_super+0x1a/0x110
Oct 9 20:46:06 criu kernel: [ 35.441252] kill_litter_super+0x24/0x40
Oct 9 20:46:06 criu kernel: [ 35.441867] deactivate_locked_super+0x39/0x70
Oct 9 20:46:06 criu kernel: [ 35.442531] deactivate_super+0x49/0x50
Oct 9 20:46:06 criu kernel: [ 35.443105] cleanup_mnt+0x3a/0x70
Oct 9 20:46:06 criu kernel: [ 35.443626] __cleanup_mnt+0xd/0x10
Oct 9 20:46:06 criu kernel: [ 35.444151] task_work_run+0x9a/0xd0
Oct 9 20:46:06 criu kernel: [ 35.444690] do_exit+0x313/0xc10
Oct 9 20:46:06 criu kernel: [ 35.445215] do_group_exit+0x42/0xc0
Oct 9 20:46:06 criu kernel: [ 35.445751] SyS_exit_group+0xf/0x10
Oct 9 20:46:06 criu kernel: [ 35.446289] entry_SYSCALL_64_fastpath+0x1a/0xa5
Oct 9 20:46:06 criu kernel: [ 35.446979] RIP: 0033:0x7f69f25ed748
Oct 9 20:46:06 criu kernel: [ 35.447530] RSP: 002b:00007fffc9953b08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
Oct 9 20:46:06 criu kernel: [ 35.448611] RAX: ffffffffffffffda RBX: 00007f69f28e6540 RCX: 00007f69f25ed748
Oct 9 20:46:06 criu kernel: [ 35.449667] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
Oct 9 20:46:06 criu kernel: [ 35.450678] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff98
Oct 9 20:46:06 criu kernel: [ 35.451696] R10: 00007fffc9953a58 R11: 0000000000000246 R12: 00007f69f2b03700
Oct 9 20:46:06 criu kernel: [ 35.452745] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Oct 9 20:46:06 criu kernel: [ 35.453761] Code: 2f fd ff 85 c0 75 08 48 c7 43 30 a0 0f 82 81 5b 5d c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 53 48 8b 9f 38 02 00 00 49 89 fc <f6> 43 13 10 74 0b 48 8b 7b 48 31 f6 e8 9e 58 fa ff 4c 89 e7 e8
Oct 9 20:46:06 criu kernel: [ 35.456484] RIP: bm_evict_inode+0x11/0x40 RSP: ffffc90000abfc58
Oct 9 20:46:06 criu kernel: [ 35.457326] CR2: 0000000000000013
Oct 9 20:46:06 criu kernel: [ 35.457807] ---[ end trace 773951adf548e79e ]---