Luis Chamberlain 3740d93e37 coredump: fix crash when umh is disabled ... Commit 64e90a8acb ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()") added the optiont to disable all call_usermodehelper() calls by setting STATIC_USERMODEHELPER_PATH to an empty string. When this is done, and crashdump is triggered, it will crash on null pointer dereference, since we make assumptions over what call_usermodehelper_exec() did. This has been reported by Sergey when one triggers a a coredump with the following configuration: ``` CONFIG_STATIC_USERMODEHELPER=y CONFIG_STATIC_USERMODEHELPER_PATH="" kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e ``` The way disabling the umh was designed was that call_usermodehelper_exec() would just return early, without an error. But coredump assumes certain variables are set up for us when this happens, and calls ile_start_write(cprm.file) with a NULL file. [ 2.819676] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 2.819859] #PF: supervisor read access in kernel mode [ 2.820035] #PF: error_code(0x0000) - not-present page [ 2.820188] PGD 0 P4D 0 [ 2.820305] Oops: 0000 [#1] SMP PTI [ 2.820436] CPU: 2 PID: 89 Comm: a Not tainted 5.7.0-rc1+ #7 [ 2.820680] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014 [ 2.821150] RIP: 0010:do_coredump+0xd80/0x1060 [ 2.821385] Code: e8 95 11 ed ff 48 c7 c6 cc a7 b4 81 48 8d bd 28 ff ff ff 89 c2 e8 70 f1 ff ff 41 89 c2 85 c0 0f 84 72 f7 ff ff e9 b4 fe ff ff <48> 8b 57 20 0f b7 02 66 25 00 f0 66 3d 00 8 0 0f 84 9c 01 00 00 44 [ 2.822014] RSP: 0000:ffffc9000029bcb8 EFLAGS: 00010246 [ 2.822339] RAX: 0000000000000000 RBX: ffff88803f860000 RCX: 000000000000000a [ 2.822746] RDX: 0000000000000009 RSI: 0000000000000282 RDI: 0000000000000000 [ 2.823141] RBP: ffffc9000029bde8 R08: 0000000000000000 R09: ffffc9000029bc00 [ 2.823508] R10: 0000000000000001 R11: ffff88803dec90be R12: ffffffff81c39da0 [ 2.823902] R13: ffff88803de84400 R14: 0000000000000000 R15: 0000000000000000 [ 2.824285] FS: 00007fee08183540(0000) GS:ffff88803e480000(0000) knlGS:0000000000000000 [ 2.824767] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.825111] CR2: 0000000000000020 CR3: 000000003f856005 CR4: 0000000000060ea0 [ 2.825479] Call Trace: [ 2.825790] get_signal+0x11e/0x720 [ 2.826087] do_signal+0x1d/0x670 [ 2.826361] ? force_sig_info_to_task+0xc1/0xf0 [ 2.826691] ? force_sig_fault+0x3c/0x40 [ 2.826996] ? do_trap+0xc9/0x100 [ 2.827179] exit_to_usermode_loop+0x49/0x90 [ 2.827359] prepare_exit_to_usermode+0x77/0xb0 [ 2.827559] ? invalid_op+0xa/0x30 [ 2.827747] ret_from_intr+0x20/0x20 [ 2.827921] RIP: 0033:0x55e2c76d2129 [ 2.828107] Code: 2d ff ff ff e8 68 ff ff ff 5d c6 05 18 2f 00 00 01 c3 0f 1f 80 00 00 00 00 c3 0f 1f 80 00 00 00 00 e9 7b ff ff ff 55 48 89 e5 <0f> 0b b8 00 00 00 00 5d c3 66 2e 0f 1f 84 0 0 00 00 00 00 0f 1f 40 [ 2.828603] RSP: 002b:00007fffeba5e080 EFLAGS: 00010246 [ 2.828801] RAX: 000055e2c76d2125 RBX: 0000000000000000 RCX: 00007fee0817c718 [ 2.829034] RDX: 00007fffeba5e188 RSI: 00007fffeba5e178 RDI: 0000000000000001 [ 2.829257] RBP: 00007fffeba5e080 R08: 0000000000000000 R09: 00007fee08193c00 [ 2.829482] R10: 0000000000000009 R11: 0000000000000000 R12: 000055e2c76d2040 [ 2.829727] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2.829964] CR2: 0000000000000020 [ 2.830149] ---[ end trace ceed83d8c68a1bf1 ]--- ``` Cc: <stable@vger.kernel.org> # v4.11+ Fixes: 64e90a8acb ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=199795 Reported-by: Tony Vroon <chainsaw@gentoo.org> Reported-by: Sergey Kvachonok <ravenexp@gmail.com> Tested-by: Sergei Trofimovich <slyfox@gentoo.org> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Link: https://lore.kernel.org/r/20200416162859.26518-1-mcgrof@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-04-28 17:54:13 +02:00
..
9p	9p: read only once on O_NONBLOCK	2020-03-27 09:29:56 +00:00
adfs
affs
afs	afs: Make record checking use TASK_UNINTERRUPTIBLE when appropriate	2020-04-24 16:33:32 +01:00
autofs	LOOKUP_MOUNTPOINT: fold path_mountpointat() into path_lookupat()	2020-03-13 21:08:17 -04:00
befs
bfs
btrfs	btrfs: fix setting last_trans for reloc roots	2020-04-17 15:20:08 +02:00
cachefiles
ceph	ceph: fix potential bad pointer deref in async dirops cb's	2020-04-13 19:33:47 +02:00
cifs	cifs: fix uninitialised lease_key in open_shroot()	2020-04-22 20:29:11 -05:00
coda
configfs
cramfs
crypto	fscrypt updates for 5.7	2020-03-31 12:58:36 -07:00
debugfs	debugfs: remove return value of debugfs_create_u32()	2020-04-17 17:08:50 +02:00
devpts
dlm
ecryptfs
efivarfs
efs
erofs
exfat	exfat: truncate atimes to 2s granularity	2020-04-22 20:14:06 +09:00
exportfs
ext2	ext2: fix empty body warnings when -Wextra is used	2020-03-23 13:01:37 +01:00
ext4	ext4: convert BUG_ON's to WARN_ON's in mballoc.c	2020-04-15 23:58:49 -04:00
f2fs	f2fs-for-5.7-rc1	2020-04-07 13:48:26 -07:00
fat
freevxfs
fscache
fuse
gfs2	We've got a lot of patches (39) for this merge window. Most of these patches	2020-03-31 14:16:03 -07:00
hfs
hfsplus	hfsplus: fix crash and filesystem corruption when deleting files	2020-04-10 15:36:20 -07:00
hostfs	hostfs: Use kasprintf() instead of fixed buffer formatting	2020-03-29 23:23:00 +02:00
hpfs
hugetlbfs	hugetlbfs: Use i_mmap_rwsem to address page fault/truncate race	2020-04-02 09:35:32 -07:00
iomap	Bug fixes for 5.7:	2020-04-08 21:37:18 -07:00
isofs
jbd2
jffs2
jfs
kernfs	kernfs: Add option to enable user xattrs	2020-03-16 15:53:47 -04:00
lockd
minix
nfs	NFS: Fix an ABBA spinlock issue in pnfs_update_layout()	2020-04-13 15:55:21 -04:00
nfs_common
nfsd	SUNRPC: Fix backchannel RPC soft lockups	2020-04-17 12:40:31 -04:00
nilfs2
nls
notify	fanotify: Fix the checks in fanotify_fsid_equal	2020-03-30 12:40:53 +02:00
ntfs	fs/buffer: Make BH_Uptodate_Lock bit_spin_lock a regular spinlock_t	2020-03-28 13:21:08 +01:00
ocfs2	ocfs2: no need try to truncate file beyond i_size	2020-04-10 15:36:21 -07:00
omfs
openpromfs
orangefs	orangefs: don't mess with I_DIRTY_TIMES in orangefs_flush	2020-04-08 09:39:11 -04:00
overlayfs	ovl: enable xino automatically in more cases	2020-03-27 16:51:02 +01:00
proc	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-04-25 12:25:32 -07:00
pstore
qnx4
qnx6
quota
ramfs
reiserfs	reiserfs: clean up several indentation issues	2020-04-07 10:43:44 -07:00
romfs
squashfs
sysfs	sysfs: remove redundant __compat_only_sysfs_link_entry_to_kobj fn	2020-04-05 11:34:35 -07:00
sysv
tracefs
ubifs	This pull request contains fixes for UBI and UBIFS:	2020-04-07 12:40:56 -07:00
udf	change email address for Pali Rohár	2020-04-10 15:36:22 -07:00
ufs
unicode	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
vboxsf
verity
xfs	xfs: move inode flush to the sync workqueue	2020-04-16 09:07:42 -07:00
zonefs	zonfs: Fix handling of read-only zones	2020-03-25 11:28:26 +09:00
aio.c
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	fs/binfmt_elf.c: don't free interpreter's ELF pheaders on common path	2020-04-07 10:43:44 -07:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	block: remove unused header	2020-04-21 09:51:10 -06:00
buffer.c	block-5.7-2020-04-24	2020-04-24 12:44:19 -07:00
char_dev.c
compat_binfmt_elf.c
compat.c
coredump.c	coredump: fix crash when umh is disabled	2020-04-28 17:54:13 +02:00
d_path.c
dax.c	dax,iomap: Add helper dax_iomap_zero() to zero a range	2020-04-02 19:15:03 -07:00
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	fs/epoll: make nesting accounting safe for -rt kernel	2020-04-07 10:43:44 -07:00
exec.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-04-02 11:22:17 -07:00
fcntl.c
fhandle.c
file_table.c
file.c	io_uring: make sure openat/openat2 honor rlimit nofile	2020-03-20 08:47:27 -06:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-10 15:36:22 -07:00
fs_context.c
fs_parser.c	fs_parse: remove pr_notice() about each validation	2020-04-02 09:35:26 -07:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c
fsopen.c
inode.c
internal.h	Merge branch 'work.dotdot1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-02 12:30:08 -07:00
io_uring.c	io_uring: only restore req->work for req that needs do completion	2020-04-19 13:55:27 -06:00
io-wq.c	io_uring: use io-wq manager as backup task if task is exiting	2020-04-03 11:35:57 -06:00
io-wq.h	io_uring: use io-wq manager as backup task if task is exiting	2020-04-03 11:35:57 -06:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix infoleak in simple_attr_read()	2020-03-24 13:27:16 +01:00
locks.c	locks: reinstate locks_delete_block optimization	2020-03-18 13:03:38 -07:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	fix a braino in legitimize_path()	2020-04-06 10:38:59 -04:00
namespace.c	LOOKUP_MOUNTPOINT: fold path_mountpointat() into path_lookupat()	2020-03-13 21:08:17 -04:00
no-block.c
nsfs.c	fs/nsfs.c: Added ns_match	2020-03-12 17:33:11 -07:00
open.c	Merge branch 'work.dotdot1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-02 12:30:08 -07:00
pipe.c	mm: kmem: rename memcg_kmem_(un)charge() into memcg_kmem_(un)charge_page()	2020-04-02 09:35:28 -07:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	powerpc: Add back __ARCH_WANT_SYS_LLSEEK macro	2020-04-03 00:09:59 +11:00
readdir.c
select.c
seq_file.c	fs/seq_file.c: seq_read(): add info message about buggy .next functions	2020-04-10 15:36:22 -07:00
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
userfaultfd.c	userfaultfd: wp: declare _UFFDIO_WRITEPROTECT conditionally	2020-04-07 10:43:40 -07:00
utimes.c
xattr.c	kernfs: Add removed_size out param for simple_xattr_set	2020-03-16 15:53:47 -04:00