linux-kernel - Re: [BUG] NULL pointer dereference probably caused by kernel/trace/ring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221101153135.5345c748@rorschach.local.home>
Date:   Tue, 1 Nov 2022 15:31:35 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Roland Ruckerbauer <roland.rucky@...il.com>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        linux-kernel@...r.kernel.org, Takashi Iwai <tiwai@...e.de>,
        regressions@...ts.linux.dev,
        Steven Noonan <steven.noonan@...il.com>
Subject: Re: [BUG] NULL pointer dereference probably caused by
 kernel/trace/ring_buffer.c

On Mon, 31 Oct 2022 21:20:33 +0100
Roland Ruckerbauer <roland.rucky@...il.com> wrote:

> Unfortunately the same thing is still happening.

Can you try this?

If it stops the crash, it should trigger the warning, which hopefully
will shed more light onto the issue.

Thanks!

-- Steve

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 199759c73519..8dd793833b51 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -937,6 +937,9 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 	struct ring_buffer_per_cpu *cpu_buffer;
 	struct rb_irq_work *rbwork;
 
+	if (!buffer)
+		return;
+
 	if (cpu == RING_BUFFER_ALL_CPUS) {
 
 		/* Wake up individual ones too. One level recursion */
@@ -945,6 +948,10 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 
 		rbwork = &buffer->irq_work;
 	} else {
+		if (WARN_ON_ONCE(!buffer->buffers))
+			return;
+		if (WARN_ON_ONCE(cpu >= nr_cpu_ids))
+			return;
 		cpu_buffer = buffer->buffers[cpu];
 		rbwork = &cpu_buffer->irq_work;
 	}