• Eric Dumazet's avatar
    coredump: fix va_list corruption · 404ca80e
    Eric Dumazet authored
    A va_list needs to be copied in case it needs to be used twice.
    
    Thanks to Hugh for debugging this issue, leading to various panics.
    
    Tested:
    
      lpq84:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern
    
    'produce_core' is simply : main() { *(int *)0 = 1;}
    
      lpq84:~# ./produce_core
      Segmentation fault (core dumped)
      lpq84:~# dmesg | tail -1
      [  614.352947] Core dump to |/foobar12345 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 (null) pipe failed
    
    Notice the last argument was replaced by a NULL (we were lucky enough to
    not crash, but do not try this on your production machine !)
    
    After fix :
    
      lpq83:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern
      lpq83:~# ./produce_core
      Segmentation fault
      lpq83:~# dmesg | tail -1
      [  740.800441] Core dump to |/foobar12345 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 pipe failed
    
    Fixes: 5fe9d8ca ("coredump: cn_vprintf() has no reason to call vsnprintf() twice")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Diagnosed-by: default avatarHugh Dickins <hughd@google.com>
    Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: stable@vger.kernel.org # 3.11+
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    404ca80e
coredump.c 17.9 KB