linux-kernel - [PATCH] tracing/net_sched: NULL pointer dereference in perf_trace_qdisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240702180146.5126-2-yskelg@gmail.com>
Date: Wed,  3 Jul 2024 03:01:47 +0900
From: Yunseong Kim <yskelg@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	stable@...r.kernel.org,
	Paolo Abeni <pabeni@...hat.com>,
	Sasha Levin <sashal@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>
Cc: Taehee Yoo <ap420073@...il.com>,
	Pedro Tammela <pctammela@...atatu.com>,
	Austin Kim <austindh.kim@...il.com>,
	MichelleJin <shjy180909@...il.com>,
	linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	netdev@...r.kernel.org,
	ppbuk5246@...il.com,
	Yeoreum Yun <yeoreum.yun@....com>
Subject: [PATCH] tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()

Support backports for stable version. There are two places where null
deref could happen before
commit 2c92ca849fcc ("tracing/treewide: Remove second parameter of __assign_str()")
Link: https://lore.kernel.org/linux-trace-kernel/20240516133454.681ba6a0@rorschach.local.home/

I've checked +v6.1.82 +v6.6.22 +v6.7.10, +v6.8, +6.9, this version need
to be applied, So, I applied the patch, tested it again, and confirmed
working fine.

Fixes: 51270d573a8d ("tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string")
Link: https://lore.kernel.org/lkml/20240229143432.273b4871@gandalf.local.home/t/
Cc: netdev@...r.kernel.org
Cc: stable@...r.kernel.org # +v6.1.82 +v6.6.22 +v6.7.10, +v6.8, +6.9
Tested-by: Yunseong Kim <yskelg@...il.com>
Reviewed-by: Pedro Tammela <pctammela@...atatu.com>
Signed-off-by: Yunseong Kim <yskelg@...il.com>
Signed-off-by: Yeoreum Yun <yeoreum.yun@....com>
Link: https://lore.kernel.org/r/20240624173320.24945-4-yskelg@gmail.com
Signed-off-by: Paolo Abeni <pabeni@...hat.com>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
 include/trace/events/qdisc.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/trace/events/qdisc.h b/include/trace/events/qdisc.h
index 1f4258308b96..061fd4960303 100644
--- a/include/trace/events/qdisc.h
+++ b/include/trace/events/qdisc.h
@@ -81,14 +81,14 @@ TRACE_EVENT(qdisc_reset,
 	TP_ARGS(q),
 
 	TP_STRUCT__entry(
-		__string(	dev,		qdisc_dev(q)->name	)
+		__string(	dev,		qdisc_dev(q) ? qdisc_dev(q)->name : "(null)"	)
 		__string(	kind,		q->ops->id		)
 		__field(	u32,		parent			)
 		__field(	u32,		handle			)
 	),
 
 	TP_fast_assign(
-		__assign_str(dev, qdisc_dev(q)->name);
+		__assign_str(dev, qdisc_dev(q) ? qdisc_dev(q)->name : "(null)");
 		__assign_str(kind, q->ops->id);
 		__entry->parent = q->parent;
 		__entry->handle = q->handle;
-- 
2.45.2