linux-kernel - Re: [PATCH] debug: Fix a NULL vs IS_ERR() bug in __debug_object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aRHrGOKBi5UrlyGf@google.com>
Date: Mon, 10 Nov 2025 21:39:36 +0800
From: Kuan-Wei Chiu <visitorckw@...il.com>
To: Haotian Zhang <vulab@...as.ac.cn>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] debug: Fix a NULL vs IS_ERR() bug in
 __debug_object_init()

Hi Haotian,

On Mon, Nov 10, 2025 at 03:57:46PM +0800, Haotian Zhang wrote:
> The lookup_object_or_alloc() returns error pointers on failure, but the
> code only checks for NULL. This leads to dereferencing an invalid error
> pointer and causes a kernel crash.
> 
> Use IS_ERR_OR_NULL() instead of a NULL check to properly handle both
> error pointers and NULL returns.
> 
> Fixes: 63a759694eed ("debugobject: Prevent init race with static objects")
> Signed-off-by: Haotian Zhang <vulab@...as.ac.cn>
> ---
>  lib/debugobjects.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/debugobjects.c b/lib/debugobjects.c
> index 7f50c4480a4e..9587ef619054 100644
> --- a/lib/debugobjects.c
> +++ b/lib/debugobjects.c
> @@ -741,9 +741,10 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
>  	raw_spin_lock_irqsave(&db->lock, flags);
>  
>  	obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
> -	if (unlikely(!obj)) {
> +	if (IS_ERR_OR_NULL(obj)) {

Ideally, an API should either return error pointers to indicate errors
or solely return a NULL pointer to represent a failed operation. Mixing
error pointers and NULL pointers can easily lead to confusion about
what each represents.

In this case, it seems that lookup_object_or_alloc() only returns NULL
when alloc_object() fails due to being out of memory. Perhaps a better
approach would be to return -ENOMEM in this situation, then change the
check in __debug_object_init() to use IS_ERR(), and call
debug_objects_oom() when obj == ERR_PTR(-ENOMEM). I think this might
make the code clearer.

Regards,
Kuan-Wei

>  		raw_spin_unlock_irqrestore(&db->lock, flags);
> -		debug_objects_oom();
> +		if (!obj)
> +			debug_objects_oom();
>  		return;
>  	}
>  
> -- 
> 2.50.1.windows.1
> 
>