From behlert at suse.com Wed May 13 06:27:04 2015 From: behlert at suse.com (Stefan Behlert) Date: Wed, 13 May 2015 14:27:04 +0200 Subject: [sles-beta] SLES11 SP4 RC1 bug/crash In-Reply-To: References: Message-ID: <20150513122704.GA27777@suse.de> Hi, be so kind to open a Service Request. I've relayed this to our kernel developers, but in case there are questions it would be good to have a bugreport where collaboration can happen. Stefan On May 13, 15 11:23:31 +0000, Jelen, Petr (EXT) wrote: > Dear all, > > We localized a bug in SLES11 SP4 RC1 x86_64 kernel. Description follows: > > ---- SLES11 SP4 RC1 x86_64 kernel crash ---------------------------------------------- > > The kernel oops happens when accessing a symlink in a directory, which has sticky bit set and has another owner, than the symlink itself: > In our case, there is a /opt/bin > > linux-SLES11-SP4-RC1:/ # ls -ld /opt/bin > drwxrwxrwt 2 root root 4096 May 12 14:21 /opt/bin > > The problem is triggered, when a root process tries to access the symlink which has non-root ownership (bin:bin). > > linux-SLES11-SP4-RC1:/opt/bin # l cryco_* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_cleanup -> cryco_cmd* > -r-xr-x--- 1 bin bin 255880 Apr 28 14:16 cryco_cmd* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_new -> cryco_cmd* > > If I try to read the file through the symlink, I get ?No such file or directory? error: > linux-SLES11-SP4-RC1:/opt/bin # ldd /opt/bin/cryco_new > ldd: /opt/bin/cryco_new: No such file or directory > > If I try to execute it, kernel crashes ?Oops? > BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 > > When I change the symlink ownership to root:root, then it works normally: > linux-SLES11-SP4-RC1:/opt/bin # l cryco_* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_cleanup -> cryco_cmd* > -r-xr-x--- 1 bin bin 255880 Apr 28 14:16 cryco_cmd* > lrwxrwxrwx 1 root root 9 May 12 09:36 cryco_new -> cryco_cmd* > > linux-SLES11-SP4-RC1:/opt/bin # ldd /opt/bin/cryco_new > linux-vdso.so.1 => (0x00007ffcfa48b000) > libc.so.6 => /lib64/libc.so.6 (0x00007f31e619d000) > /lib64/ld-linux-x86-64.so.2 (0x00007f31e654e000) > > Steps to reproduce the bug on SLES11 SP4 RC1: > > 1. mkdir /root/dir_sticky > > 2. chmod 777 /root/dir_sticky > > 3. chmod +t /root/dir_sticky > > 4. chown root:root /root/dir_sticky > > 5. ln -s /bin/true /root/dir_sticky/true_link > > 6. chown -h bin:bin /root/dir_sticky/true_link > > 7. ls -H /root/dir_sticky/true_link > ls: cannot access /root/dir_sticky/true_link: Permission denied > > 8. /root/dir_sticky/true_link --> will cause kernel crash and reboot > > > > If possible, deliver us the fixed kernel rpm before rc2, to confirm, that the bug is fixed. > > Thank you in advance, > Petr Jelen > +420266061220 > -- Stefan Behlert, SUSE LINUX Release Manager Enterprise Server Maxfeldstr. 5, D-90409 Nuernberg, Germany Phone +49-911-74053-173 SUSE LINUX GmbH, Nuernberg; GF: Felix Imendoerffer, Jane Smithard, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nuernberg) From birgit.bammesreiter at unify.com Wed May 13 06:45:27 2015 From: birgit.bammesreiter at unify.com (Bammesreiter, Birgit) Date: Wed, 13 May 2015 12:45:27 +0000 Subject: [sles-beta] SLES11 SP4 RC1 bug/crash / SR10952520461 In-Reply-To: <20150513122704.GA27777@suse.de> References: <20150513122704.GA27777@suse.de> Message-ID: Hi. Service request was opened: SR10952520461 Regards, Birgit -----Urspr?ngliche Nachricht----- Von: Stefan Behlert [mailto:behlert at suse.com] Gesendet: Mittwoch, 13. Mai 2015 14:27 An: Jelen, Petr (EXT) Cc: sles-beta at lists.suse.com; Huenteler, Thomas; Bammesreiter, Birgit Betreff: Re: SLES11 SP4 RC1 bug/crash Hi, be so kind to open a Service Request. I've relayed this to our kernel developers, but in case there are questions it would be good to have a bugreport where collaboration can happen. Stefan On May 13, 15 11:23:31 +0000, Jelen, Petr (EXT) wrote: > Dear all, > > We localized a bug in SLES11 SP4 RC1 x86_64 kernel. Description follows: > > ---- SLES11 SP4 RC1 x86_64 kernel crash ---------------------------------------------- > > The kernel oops happens when accessing a symlink in a directory, which has sticky bit set and has another owner, than the symlink itself: > In our case, there is a /opt/bin > > linux-SLES11-SP4-RC1:/ # ls -ld /opt/bin > drwxrwxrwt 2 root root 4096 May 12 14:21 /opt/bin > > The problem is triggered, when a root process tries to access the symlink which has non-root ownership (bin:bin). > > linux-SLES11-SP4-RC1:/opt/bin # l cryco_* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_cleanup -> cryco_cmd* > -r-xr-x--- 1 bin bin 255880 Apr 28 14:16 cryco_cmd* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_new -> cryco_cmd* > > If I try to read the file through the symlink, I get ?No such file or directory? error: > linux-SLES11-SP4-RC1:/opt/bin # ldd /opt/bin/cryco_new > ldd: /opt/bin/cryco_new: No such file or directory > > If I try to execute it, kernel crashes ?Oops? > BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 > > When I change the symlink ownership to root:root, then it works normally: > linux-SLES11-SP4-RC1:/opt/bin # l cryco_* > lrwxrwxrwx 1 bin bin 9 May 12 09:36 cryco_cleanup -> cryco_cmd* > -r-xr-x--- 1 bin bin 255880 Apr 28 14:16 cryco_cmd* > lrwxrwxrwx 1 root root 9 May 12 09:36 cryco_new -> cryco_cmd* > > linux-SLES11-SP4-RC1:/opt/bin # ldd /opt/bin/cryco_new > linux-vdso.so.1 => (0x00007ffcfa48b000) > libc.so.6 => /lib64/libc.so.6 (0x00007f31e619d000) > /lib64/ld-linux-x86-64.so.2 (0x00007f31e654e000) > > Steps to reproduce the bug on SLES11 SP4 RC1: > > 1. mkdir /root/dir_sticky > > 2. chmod 777 /root/dir_sticky > > 3. chmod +t /root/dir_sticky > > 4. chown root:root /root/dir_sticky > > 5. ln -s /bin/true /root/dir_sticky/true_link > > 6. chown -h bin:bin /root/dir_sticky/true_link > > 7. ls -H /root/dir_sticky/true_link > ls: cannot access /root/dir_sticky/true_link: Permission denied > > 8. /root/dir_sticky/true_link --> will cause kernel crash and reboot > > > > If possible, deliver us the fixed kernel rpm before rc2, to confirm, that the bug is fixed. > > Thank you in advance, > Petr Jelen > +420266061220 > -- Stefan Behlert, SUSE LINUX Release Manager Enterprise Server Maxfeldstr. 5, D-90409 Nuernberg, Germany Phone +49-911-74053-173 SUSE LINUX GmbH, Nuernberg; GF: Felix Imendoerffer, Jane Smithard, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nuernberg) -------------- next part -------------- An embedded message was scrubbed... From: "Bammesreiter, Birgit" Subject: AW: SR10952520461 +EO - kernel crash SLES11 SP4 RC1 Date: Wed, 13 May 2015 11:55:31 +0000 Size: 16535 URL: