linux-kernel - Re: [PATCH 1/3] rcu: Return early if callback is not specified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <0caf7054-140e-4b6c-abd4-2ec2ebe79b2c@app.fastmail.com>
Date: Thu, 12 Jun 2025 10:30:38 -0700
From: "Boqun Feng" <boqun@...me.name>
To: "Joel Fernandes" <joelagnelf@...dia.com>,
 "Uladzislau Rezki (Sony)" <urezki@...il.com>,
 "Paul E. McKenney" <paulmck@...nel.org>,
 "Joel Fernandes" <joel@...lfernandes.org>,
 "Neeraj Upadhyay" <Neeraj.Upadhyay@....com>
Cc: RCU <rcu@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
 "Frederic Weisbecker" <frederic@...nel.org>,
 "Oleksiy Avramchenko" <oleksiy.avramchenko@...y.com>
Subject: Re: [PATCH 1/3] rcu: Return early if callback is not specified



On Tue, Jun 10, 2025, at 12:33 PM, Joel Fernandes wrote:
> On 6/10/2025 1:34 PM, Uladzislau Rezki (Sony) wrote:
>> Currently the call_rcu() API does not check whether a callback
>> pointer is NULL. If NULL is passed, rcu_core() will try to invoke
>> it, resulting in NULL pointer dereference and a kernel crash.
>> 
>> To prevent this and improve debuggability, this patch adds a check
>> for NULL and emits a kernel stack trace to help identify a faulty
>> caller.
>> 
>> Signed-off-by: Uladzislau Rezki (Sony) <urezki@...il.com>
>
> Reviewed-by: Joel Fernandes <joelagnelf@...dia.com>
>

Reviewed-by: Boqun Feng <boqun.feng@...il.com>

> I will add this first one (only this one since we're discussing the others) to a
> new rcu/fixes-for-6.16 branch, but let me know if any objections.
>

Not sure it’s urgent enough given the current evidence.

Regards,
Boqun

> Will push that branch out during -rc2 or -rc3 after sufficient testing.
>
> thanks,
>
>  - Joel
>
>> ---
>>  kernel/rcu/tree.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>> 
>> diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
>> index e8a4b720d7d2..14d4499c6fc3 100644
>> --- a/kernel/rcu/tree.c
>> +++ b/kernel/rcu/tree.c
>> @@ -3072,6 +3072,10 @@ __call_rcu_common(struct rcu_head *head, rcu_callback_t func, bool lazy_in)
>>  	/* Misaligned rcu_head! */
>>  	WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
>>  
>> +	/* Avoid NULL dereference if callback is NULL. */
>> +	if (WARN_ON_ONCE(!func))
>> +		return;
>> +
>>  	if (debug_rcu_head_queue(head)) {
>>  		/*
>>  		 * Probable double call_rcu(), so leak the callback.