linux-kernel - Re: [BUG] NULL pointer dereference probably caused by kernel/trace/ring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221101184347.2ecce20c@rorschach.local.home>
Date:   Tue, 1 Nov 2022 18:43:47 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Roland Ruckerbauer <roland.rucky@...il.com>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        linux-kernel@...r.kernel.org, Takashi Iwai <tiwai@...e.de>,
        regressions@...ts.linux.dev,
        Steven Noonan <steven.noonan@...il.com>
Subject: Re: [BUG] NULL pointer dereference probably caused by
 kernel/trace/ring_buffer.c

On Tue, 1 Nov 2022 18:35:12 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> OK, this is a great clue. I'll dig deeper.

One more NULL check. And this one is legit, and I'm betting is the fix.

The buffer->buffers is allocated to nr_cpu_ids, but are only
initialized for online CPUs. If you have a CPU that is not yet
initialized (or may never be), then the cpu_buffer will be NULL.

-- Steve

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 199759c73519..4ffcc6e33258 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -937,6 +937,9 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 	struct ring_buffer_per_cpu *cpu_buffer;
 	struct rb_irq_work *rbwork;
 
+	if (!buffer)
+		return;
+
 	if (cpu == RING_BUFFER_ALL_CPUS) {
 
 		/* Wake up individual ones too. One level recursion */
@@ -945,7 +948,14 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 
 		rbwork = &buffer->irq_work;
 	} else {
+		if (WARN_ON_ONCE(!buffer->buffers))
+			return;
+		if (WARN_ON_ONCE(cpu >= nr_cpu_ids))
+			return;
 		cpu_buffer = buffer->buffers[cpu];
+		/* The CPU buffer may not have been initialized yet */
+		if (!cpu_buffer)
+			return;
 		rbwork = &cpu_buffer->irq_work;
 	}