linux-kernel - [POSSIBLE BUG] Dereferencing of NULL pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6228a437bb9d7f677f5e97973518bcd555bc2a07.camel@ispras.ru>
Date:   Sat, 20 Aug 2022 20:30:56 +0300
From:   Rustam Subkhankulov <subkhankulov@...ras.ru>
To:     Juergen Gross <jgross@...e.com>
Cc:     Stefano Stabellini <sstabellini@...nel.org>,
        Oleksandr Tyshchenko <oleksandr_tyshchenko@...m.com>,
        xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        ldv-project@...uxtesting.org
Subject: [POSSIBLE BUG] Dereferencing of NULL pointer

Version: 6.0-rc1

Description: 

In function 'privcmd_ioctl_dm_op' (drivers/xen/privcmd.c: 615)return
value of 'kcalloc' with GFP_KERNEL flag is assigned to "pages"
variable. GFP_KERNEL flag does not guarantee, that the return value
will not be NULL. In that case, there is a jump to the "out" label. 

---------------------------------------------------------------------
667	pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
668	if (!pages) {
669		rc = -ENOMEM;
670		goto out;
671	}
---------------------------------------------------------------------

Variable 'pages' is passed to function 'unpin_user_pages_dirty_lock' as
1st parameter at [drivers/xen/privcmd.c: 695].

---------------------------------------------------------------------
694	out:
695		unlock_pages(pages, nr_pages);
---------------------------------------------------------------------

Then, variable 'pages' is passed to function
'unpin_user_pages_dirty_lock' as 1st parameter at
[drivers/xen/privcmd.c: 612].

---------------------------------------------------------------------
610	static void unlock_pages(struct page *pages[], unsigned int
nr_pages)
611	{
612		unpin_user_pages_dirty_lock(pages, nr_pages, true);
613	}
---------------------------------------------------------------------

'pages' and 'npages' are passed as parameters to function
'sanity_check_pinned_pages' at [mm/gup.c: 311].

---------------------------------------------------------------------
299	void unpin_user_pages_dirty_lock(struct page **pages, unsigned
long npages,
300					 bool make_dirty)
301	{
302		unsigned long i;
303     struct folio *folio;
304     unsigned int nr;
305		
306		if (!make_dirty) {
307			unpin_user_pages(pages, npages);
308			return;
309		}
310
311		sanity_check_pinned_pages(pages, npages);
---------------------------------------------------------------------

In function 'sanity_check_pinned_pages', if
(IS_ENABLED(CONFIG_DEBUG_VM)) and (npages > 0), NULL pointer 'pages' is
dereferenced at [mm/gup.c: 51].

---------------------------------------------------------------------
32	static inline void sanity_check_pinned_pages(struct page
**pages,
33						     unsigned long
npages)
34	{
35		if (!IS_ENABLED(CONFIG_DEBUG_VM))
36			return;
..
50		for (; npages; npages--, pages++) {
51			struct page *page = *pages;
								^^^^^^
^
---------------------------------------------------------------------

Else if (!IS_ENABLED(CONFIG_DEBUG_VM)) and (npages > 0) function
'gup_folio_next' is called with 'pages' and 'npages' as parameters at
[mm/gup.c: 311].

---------------------------------------------------------------------
312		for (i = 0; i < npages; i += nr) {
313			folio = gup_folio_next(pages, npages, i, &nr);
---------------------------------------------------------------------

In function 'gup_folio_next' NULL pointer 'list' is dereferenced at
[mm/gup.c: 263].

---------------------------------------------------------------------
262	static inline struct folio *gup_folio_next(struct page **list,
263			unsigned long npages, unsigned long i,
unsigned int *ntails)
264	{
265		struct folio *folio = page_folio(list[i]);
								
		^^^^^^^^^
---------------------------------------------------------------------