>Number:         17438
>Category:       kern
>Synopsis:       null pointer dereference in systrace
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jun 30 04:49:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     xs@kittenz.org
>Release:        NetBSD 1.6B
>Organization:
>Environment:
/sys/kern/kern_systrace.c:
     $NetBSD: kern_systrace.c,v 1.2 2002/06/18 01:24:15 thorpej Exp $
System: NetBSD stasis 1.6B NetBSD 1.6B (STASIS) #13: Sat Jun 29 19:10:55 BST 2002 xs@stasis:/usr/src/sys/arch/i386/compile/STASIS i386
Architecture: i386
Machine: i386
>Description:

	systrace_enter() permits strp to become NULL at function exit, but
	the emulation handling code does not account for this.

>How-To-Repeat:

#include <sys/types.h>
#include <dev/systrace.h>

#include <unistd.h>
#include <fcntl.h>
#include <err.h>
#include <stdio.h>


#define X(x)	if ((x) < 0) err(1, "failure: %s", ""#x);

int
main()
{
	int fd;
	pid_t pid;

	X(pid = fork());
	if (pid == 0) {
		for (;;)
			sleep(600);
		_exit(1);
	}

	/* parent */
	X(fd = open("/dev/systrace", O_RDONLY, 0));
	X(ioctl(fd, STRIOCATTACH, &pid));
	X(fork());
	X(ioctl(fd, STRIOCDETACH, &pid));
	X(ioctl(fd, STRIOCATTACH, &pid));
	X(ioctl(fd, STRIOCDETACH, &pid));
	X(ioctl(fd, STRIOCATTACH, &pid));
	exit(0);
}

>Fix:

Index: kern_systrace.c
===================================================================
RCS file: /cvsroot/syssrc/sys/kern/kern_systrace.c,v
retrieving revision 1.2
diff -u -r1.2 kern_systrace.c
--- kern_systrace.c	2002/06/18 01:24:15	1.2
+++ kern_systrace.c	2002/06/29 18:35:37
@@ -689,10 +690,13 @@
 	if (fst) {
 		SYSTRACE_UNLOCK(fst, p);
 	}
-	if (error == 0)
-		strp->oldemul = p->p_emul;
-	else
-		strp->oldemul = NULL;
+	if (strp != NULL) {
+		if (error == 0)
+			strp->oldemul = p->p_emul;
+		else
+			strp->oldemul = NULL;
+	}
+
 	return error;
 }
 
>Release-Note:
>Audit-Trail:
>Unformatted: