Messages in this thread | | | Date | Mon, 29 Jun 2020 16:53:51 +0200 | From | Petr Mladek <> | Subject | Re: [PATCH] kdb: prevent possible null deref in kdb_msg_write |
| |
On Mon 2020-06-29 16:50:20, Petr Mladek wrote: > On Mon 2020-06-29 16:59:24, Cengiz Can wrote: > > `kdb_msg_write` operates on a global `struct kgdb_io *` called > > `dbg_io_ops`. > > > > Although it is initialized in `debug_core.c`, there's a null check in > > `kdb_msg_write` which implies that it can be null whenever we dereference > > it in this function call. > > > > Coverity scanner caught this as CID 1465042. > > > > I have modified the function to bail out if `dbg_io_ops` is not properly > > initialized. > > > > Signed-off-by: Cengiz Can <cengiz@kernel.wtf> > > --- > > kernel/debug/kdb/kdb_io.c | 15 ++++++++------- > > 1 file changed, 8 insertions(+), 7 deletions(-) > > > > diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c > > index 683a799618ad..85e579812458 100644 > > --- a/kernel/debug/kdb/kdb_io.c > > +++ b/kernel/debug/kdb/kdb_io.c > > @@ -549,14 +549,15 @@ static void kdb_msg_write(const char *msg, int msg_len) > > if (msg_len == 0) > > return; > > > > - if (dbg_io_ops) { > > - const char *cp = msg; > > - int len = msg_len; > > + if (!dbg_io_ops) > > + return; > > This looks wrong. The message should be printed to the consoles > even when dbg_io_ops is NULL. I mean that the for_each_console(c) > cycle should always get called.
Please, forget this mail. Daniel explained that dbg_io_ops must have been set when this function gets called.
I am sorry for the noise.
Best Regards, Petr
| |