[Bug 195767] New: [unionfs] unionfs_relookup_for_delete passing null pointer to strlen

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195767

            Bug ID: 195767
           Summary: [unionfs] unionfs_relookup_for_delete passing null
                    pointer to strlen
           Product: Base System
           Version: 10.1-RELEASE
          Hardware: i386
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: mqudsi at neosmart.net

Created attachment 150294
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=150294&action=edit
backtrace screenshot

This is a bug that may have been present in earlier versions of FreeBSD, but
since upgrading to FreeBSD 10.1-RELEASE I can regularly reproduce.

The environment is a custom live CD, configured with a preloaded ufs.gz base
bootstrap image that mounts a ufs.uzip file as the new root, creates a
malloc-based virtual disk, and overlays it over the existing RO ufs.uzip image
via unionfs.

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address= 0x0
fault code= supervisor read, page not present
...
current process= 2626 (rmdir)

[ thread pid 2626 tid 100065 ]
Stopped at strlen+0xd: movl 0(%ecx),%eax

db> bt
tracing pid 2626 tid 100065 td 0xc8dfe620
strlen(0,....
unionfs_rerelookup_for_delete
unionfs_rmdir
VOP_RMDIR_APV
kern_rmdirat
sys_rmdir
syscall
Xinit0x80_syscall()
--- syscall (137, FreeBSD ELF32, sys_rmdir)

-- 
You are receiving this mail because:
You are the assignee for the bug.