LPE for Life

Null pointer dereference -_-
affected version: <3.5 linux kernel

[ 2674.778679] Pid: 715, comm: Not tainted 3.5.0-18-generic
[ 2674.779165] EIP: 0060:[<f837f3d5>] EFLAGS: 00010286 CPU: 0
[ 2674.779673] EIP is at 0xf837f3d5+0x215/*** [******]
[ 2674.779977] EAX: f6088cc0 EBX: f63a7e14 ECX: f6088cd8 EDX: 00000000
[ 2674.780284] ESI: 00000000 EDI: f63a6000 EBP: f63a7d20 ESP: f63a7c84
[ 2674.780634]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 2674.780957] Process ebana-qaşqaldağ (pid: 715, ti=f63a6000 task=f58b58d0 task.ti=f63a6000)
[ 2674.781380] Stack:
[ 2674.781849]  f63a7cf8 00000080 f635e000 f63a7cec 00000008 f635e000 00000080 f63a7cf4
[ 2674.782996] <0> 00000080 00000000 f63a7ccc f63a7e14 f63a7f1c 00092cd8 f6263600 00000000
[ 2674.784357] <0> f63a6000 00000088 f63a7c90 c02193b6 00000002 00000000 00000000 f63a7cec


[ 2674.773316] BUG: unable to handle kernel NULL pointer dereference at 00000008
[ 2674.800483] EIP: [<f837f3d5>] 0xf837f3d5+0x215/*** [*****] SS:ESP 0068:f63a7c84

root@ubuntu:~# gdb -c /proc/kcore
[New <main task>]
Core was generated by `BOOT_IMAGE=/boot/vmlinuz-2.6.35-22-generic root=UUID=2165eadf-1277-4482-98e0-5fb'.
#0  0x00000000 in ?? ()

   0xf837f3d5:	mov    edx,DWORD PTR [esi+0x8] <======= null pointer dereference
   0xf837f3d8:	mov    DWORD PTR [ecx+0x18],0x4e2
   0xf837f3df:	mov    DWORD PTR [ecx+0xc],edx
   0xf837f3e2:	mov    edx,DWORD PTR ds:0xc07c5a40
   0xf837f3e8:	mov    DWORD PTR [ecx+0x1c],edx
   0xf837f3eb:	mov    edx,DWORD PTR ds:0xf8380cc4
   0xf837f3f1:	mov    DWORD PTR [ebp-0x30],edx
   0xf837f3f4:	mov    DWORD PTR [ecx+0x14],edx
   0xf837f3f7:	add    edx,0x1
   0xf837f3fa:	mov    DWORD PTR ds:0xf8380cc4,edx
   0xf837f400:	mov    edx,DWORD PTR [esi]
   0xf837f402:	mov    DWORD PTR [eax+0x18],edx
   0xf837f405:	mov    edx,DWORD PTR [esi+0x4]
   0xf837f408:	mov    DWORD PTR [ecx+0x4],edx
   0xf837f40b:	mov    edx,DWORD PTR [esi+0x8]
   0xf837f40e:	mov    DWORD PTR [ecx+0x8],edx
   0xf837f411:	mov    edx,eax
   0xf837f413:	mov    eax,0xf8380cc8
   0xf837f418:	call   0xc04ec3c0
   0xf837f41d:	mov    edi,DWORD PTR [ebp-0x54]