linux-kernel - [RFC PATCH v5 22/28] dyndbg: fix NULL deref after deleting sites

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 11 May 2021 12:50:51 -0600
From:   Jim Cromie <jim.cromie@...il.com>
To:     Jason Baron <jbaron@...mai.com>, linux-kernel@...r.kernel.org
Cc:     linux-mm@...ck.org, Jim Cromie <jim.cromie@...il.com>
Subject: [RFC PATCH v5 22/28] dyndbg: fix NULL deref after deleting sites

After `echo module main +D > control` zeros the site pointer for
main's callsites, `cat control` causes a NULL deref in
ddebug_site_get().  Fix this with:

- in vpr_infos, avoid dp->site->module, use dh->sites[dp->_index]
- qualify WARN_ONs that test against dp->site.

Also return dp->site, which may be null.  This restores the
abbreviated control output of deleted sites, rather than pretending it
wasnt deleted.

Deleting sites isn't an important feature, and its current form will
be obsolete when the site pointer gets dropped.  Its also pointless if
the site data is in compressed blocks.  But its still worthwhile to
maintain !site robustness for a bit.

Signed-off-by: Jim Cromie <jim.cromie@...il.com>
---
 lib/dynamic_debug.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index af9791258f8f..d0477450ec0c 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -154,8 +154,8 @@ static struct _ddebug_site *ddebug_site_get(struct _ddebug *dp)
 
 	if (dp >= __start___dyndbg && dp < __stop___dyndbg) {
 
-		v5pr_info("get: %s is builtin: %d %d %s:%s:%d\n",
-			  dp->site->modname, dp->_index, (int)(dp - dh),
+		v5pr_info("get: %s is builtin: %d %s:%s:%d\n",
+			  dh->site[dp->_index].modname, dp->_index,
 			  dh->site[dp->_index].filename,
 			  dh->site[dp->_index].function, dp->lineno);
 
@@ -165,15 +165,16 @@ static struct _ddebug_site *ddebug_site_get(struct _ddebug *dp)
 			 dp->_index == (dp - __start___dyndbg) &&
 			 dp->_index == (&__start___dyndbg_sites[dp->_index]
 					- &__start___dyndbg_sites[0])));
-
-		WARN_ON(&__start___dyndbg_sites[dp->_index] != dp->site);
+		if (dp->site)
+			WARN_ON(&__start___dyndbg_sites[dp->_index] != dp->site);
 	} else {
 		v4pr_info("get: %s is loaded: %d %s:%s:%d\n",
-			  dp->site->modname, dp->_index,
+			  dh->site[dp->_index].modname, dp->_index,
 			  dh->site[dp->_index].filename,
 			  dh->site[dp->_index].function, dp->lineno);
 	}
-	WARN_ON(&dh->site[dp->_index] != dp->site);
+	if (dp->site)
+		WARN_ON(&dh->site[dp->_index] != dp->site);
 
 	return dp->site;
 }
-- 
2.31.1