Re: [OOPS] 3.0-rc1 cifs

[Martijn Uffing]

On Fri, 10 Jun 2011, Jeff Layton wrote:

> On Fri, 10 Jun 2011 02:57:21 +0200 (CEST)
> Uffing <mp3project@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> > <snip>
> > > call in get_dfs_path()
> > > rc = CIFSTCon(xid, pSesInfo, temp_unc, NULL, nls_codepage);
> > >
> > > function header for CIFSTCon
> > > int  CIFSTCon(unsigned int xid, struct cifs_ses *ses,
> > >          const char *tree, struct cifs_tcon *tcon,
> > >          const struct nls_table *nls_codepage)
> > >
> > > get_dfs_path() is passing struct cifs_tcon *tcon as NULL
> > >
> > > from config:  CONFIG_CIFS_WEAK_PW_HASH=y
> > >
> > > in CIFSTCon
> > >
> > > #ifdef CONFIG_CIFS_WEAK_PW_HASH
> > > 3222                 if ((global_secflags & CIFSSEC_MAY_LANMAN) &&
> > > 3223                     (ses->server->secType == LANMAN))
> > > 3224                         calc_lanman_hash(tcon->password,
> > > ses->server->cryptkey,
> > >
> > > in calc_lanman_hash tcon is dereferenced(tcon->password) without being
> > > checked if null
> > >
> > > 3225                                          ses->server->sec_mode &
> > > 3226                                             SECMODE_PW_ENCRYPT ?
> > > true : false,
> > > 3227                                          bcc_ptr);
> > > 3228                 else
> > > 3229 #endif /* CIFS_WEAK_PW_HASH */
> > >
> > > Connor
> >
> >
> > Ave all
> >
> > I recompiled  kernel 3.0-rc1 (hadn't enabled CONFIG_DEBUG_INFO=y) and put
> > the oops (with the new adresses) through gdb per instruction of Jeff. And
> > Connor was spot on!
> >
> > <qoute oops>
> > BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
> > IP: [<ffffffffa041e286>] CIFSTCon+0xf6/0x4d0 [cifs]
> > </qoute oops>
> >
> > <qoute gdb>
> > This GDB was configured as "x86_64-linux-gnu".
> > For bug reporting instructions, please see:
> > <http://www.gnu.org/software/gdb/bugs/>...
> > Reading symbols from
> > /lib/modules/3.0.0-rc1-debug/kernel/fs/cifs/cifs.ko...done.
> > (gdb) list *(CIFSTCon+0xf6)
> > 0xc2b6 is in CIFSTCon (fs/cifs/connect.c:3230).
> > 3225                                             ses->server->sec_mode &
> > 3226                                                SECMODE_PW_ENCRYPT ?
> > true : false,
> > 3227                                             bcc_ptr);
> > 3228                    else
> > 3229    #endif /* CIFS_WEAK_PW_HASH */
> > 3230                    rc = SMBNTencrypt(tcon->password,
> > ses->server->cryptkey,
> > 3231                                            bcc_ptr);
> > 3232
> > 3233                    bcc_ptr += CIFS_AUTH_RESP_SIZE;
> > 3234                    if (ses->capabilities & CAP_UNICODE) {
> > (gdb)
> > </qoute gdb>
>
> (cc'ing Sean F. since I suspect this regression is due to his changes)
>
> Thanks for the analysis, Martijn and Connor...
>
> What sort of server are you mounting here? It looks like it's using
> share-level security, so it's either very old or is a samba server
> configured that way.

To be honest ... both :)
a)server is Debian Etch (samba 3.0.24-6etch10)
  (yeah i know old, but no time at the moment to upgrade/reinstall the
  whole system)
b)share security. (security=share) in smb.conf
  This is on purpose. (all access is shielded based on hostnames)

Mu

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/