lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] kdb: prevent possible null deref in kdb_msg_write
    On Mon 2020-06-29 16:50:20, Petr Mladek wrote:
    > On Mon 2020-06-29 16:59:24, Cengiz Can wrote:
    > > `kdb_msg_write` operates on a global `struct kgdb_io *` called
    > > `dbg_io_ops`.
    > >
    > > Although it is initialized in `debug_core.c`, there's a null check in
    > > `kdb_msg_write` which implies that it can be null whenever we dereference
    > > it in this function call.
    > >
    > > Coverity scanner caught this as CID 1465042.
    > >
    > > I have modified the function to bail out if `dbg_io_ops` is not properly
    > > initialized.
    > >
    > > Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
    > > ---
    > > kernel/debug/kdb/kdb_io.c | 15 ++++++++-------
    > > 1 file changed, 8 insertions(+), 7 deletions(-)
    > >
    > > diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
    > > index 683a799618ad..85e579812458 100644
    > > --- a/kernel/debug/kdb/kdb_io.c
    > > +++ b/kernel/debug/kdb/kdb_io.c
    > > @@ -549,14 +549,15 @@ static void kdb_msg_write(const char *msg, int msg_len)
    > > if (msg_len == 0)
    > > return;
    > >
    > > - if (dbg_io_ops) {
    > > - const char *cp = msg;
    > > - int len = msg_len;
    > > + if (!dbg_io_ops)
    > > + return;
    >
    > This looks wrong. The message should be printed to the consoles
    > even when dbg_io_ops is NULL. I mean that the for_each_console(c)
    > cycle should always get called.

    Please, forget this mail. Daniel explained that dbg_io_ops must have
    been set when this function gets called.

    I am sorry for the noise.

    Best Regards,
    Petr

    \
     
     \ /
      Last update: 2020-06-29 21:11    [W:3.566 / U:0.668 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site