[PATCH 1/2] Fix NULL pointer dereference while loading initramfs

[P J P]

  Hello,

While building the 3.11 kernel recently, I bumped into this issue.

Menuconfig allows one to choose compression format of an initial ramdisk 
image. If we select any compression other than the default gzip(1), it leads 
to a NULL pointer dereference while loading the initramfs image, at boot up.

Because - $ make install - does not pass on the selected compression format to 
dracut(8) tool, it generates the initramfs file compressed with the default 
gzip(1) format. But the kernel knows only to decompress the chosen format.

The attached patch herein, replaces the crash by an explicit panic() call with 
an appropriate error message. It keeps the kernel from eventually panicking in 
init/do_mounts.c: mount_root_block() with an inaccurate error message and 
which also looses the earlier printk output that hints about the missing 
gzip(1) decompression support.
  -> panic("VFS: Unable to mount root fs on %s", b);

Could someone please review this patch?

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602BFrom 4ff1ddae358dff002080d753e45721a89d07b3af Mon Sep 17 00:00:00 2001
From: P J P <prasad@xxxxxxxxxx>
Date: Sun, 15 Sep 2013 13:03:17 +0530
Subject: [PATCH 1/2] NULL pointer dereference while loading initramfs

Make menuconfig allows one to choose compression format of an
initial ramdisk image. But this choice does not result in duly
compressed initial ramdisk image. Because - $ make install - does
not pass on the selected compression choice to the dracut(8) tool,
which creates the initramfs file. dracut(8) generates the image
with the default compression, ie. gzip(1).

If a user chose any other compression instead of gzip(1), it leads
to a crash due to NULL pointer dereference in crd_load(), caused by
a NULL function pointer returned by the 'decompress_method()' routine.
Because the initramfs image is gzip(1) compressed, whereas the kernel
knows how decompress the chosen format and not gzip(1).

This patch replaces the crash by an explicit panic() call with an
appropriate error message. This shall prevent the kernel from
eventually panicking in: init/do_mounts.c: mount_block_root() with
  -> panic("VFS: Unable to mount root fs on %s", b);

Signed-off-by: P J P <prasad@xxxxxxxxxx>

diff --git a/init/do_mounts_rd.c b/init/do_mounts_rd.c
index 6be2879..76faec1 100644
--- a/init/do_mounts_rd.c
+++ b/init/do_mounts_rd.c
@@ -342,6 +342,13 @@ static int __init crd_load(int in_fd, int out_fd, decompress_fn deco)
 	int result;
 	crd_infd = in_fd;
 	crd_outfd = out_fd;
+
+    if (!deco)
+    {
+        printk(KERN_EMERG "Invalid decompression routine address: %p\n", deco);
+        panic("Could not decompress initial ramdisk image.");
+    }
+
 	result = deco(NULL, 0, compr_fill, compr_flush, NULL, NULL, error);
 	if (decompress_error)
 		result = 1;
-- 
1.8.3.1