linux-kernel - Re: [PATCH] Fix check after use in kernel/exit.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080310.162351.21322673.xiyou.wangcong@gmail.com>
Date:	Mon, 10 Mar 2008 16:23:51 +0800 (CST)
From:	WANG Cong <xiyou.wangcong@...il.com>
To:	mingo@...e.hu
Cc:	linux-kernel@...r.kernel.org, gvaughan@....nasa.gov, akpm@...l.org,
	jeremy@...p.org
Subject: Re: [PATCH] Fix check after use in kernel/exit.c

From: Ingo Molnar <mingo@...e.hu>
Date: Sun, 9 Mar 2008 12:48:44 +0100

> 
> * WANG Cong <xiyou.wangcong@...il.com> wrote:
> 
> > > actually, i unapplied it again because the patch is wrong: 
> > > mm_release() has side-effects for kernel threads such as the 
> > > deactivate_mm() [which is important even if the user-mm is NULL]. If 
> > > the NULL mm dereference can really trigger then it should be avoided 
> > > within mm_release().
> > 
> > Do you mean that the NULL check should be moved into mm_release()?
> 
> yes - we need to run deactivate_mm() for kernel threads.


Thank you for your kind hints.

Here is an updated version. Please check.

---->

From: WANG Cong <xiyou.wangcong@...il.com>
Subject: [PATCH] Fix check after use in kernel/exit.c

As suggested by Ingo, the NULL deference check should be moved
into mm_release().

Cc: Ingo Molnar <mingo@...e.hu>
Signed-off-by: WANG Cong <xiyou.wangcong@...il.com>

---
 kernel/exit.c |    2 --
 kernel/fork.c |    2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 53872bf..b88244a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -583,8 +583,6 @@ static void exit_mm(struct task_struct * tsk)
 	struct mm_struct *mm = tsk->mm;
 
 	mm_release(tsk, mm);
-	if (!mm)
-		return;
 	/*
 	 * Serialize with any possible pending coredump.
 	 * We must hold mmap_sem around checking core_waiters
diff --git a/kernel/fork.c b/kernel/fork.c
index dd249c3..7683c5f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -464,6 +464,8 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
 	struct completion *vfork_done = tsk->vfork_done;
 
+	if (!mm)
+		return;
 	/* Get rid of any cached register state */
 	deactivate_mm(tsk, mm);
 
-- 
1.5.2.4


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/