Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1676106

Re: [PATCH v2] kref: Avoid null pointer dereference after WARN

Show all headers | View raw

On Tue, Jun 27, 2017 at 12:26 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> On Tue, Jun 27, 2017 at 9:22 PM, Andi Kleen <ak@linux.intel.com> wrote:
>> Who would actually set mman_min_addr incorrectly?
>
> Historically there have been quite a few bypasses of mmap_min_addr,
> actually. This is well-trodden ground.

Targeting things in /proc/sys via confused privileged helpers is
extremely common. See Chrome OS pwn2own exploits (targetting modprobe
sysctl), and plenty of others. Modern attack methodology is rarely a
single-bug attack, but rather a chain of bugs, which may include
producing or exploiting weak userspace configurations to soften the
kernel.

Regardless, it's a fair point that checking this unconditionally is
wasteful. Strangely this doesn't help:

-               BUG_ON(release == NULL);
+               if (!__builtin_constant_p(release))
+                       BUG_ON(release == NULL);

When nearly all callers pass a function directly:

...
drivers/block/rbd.c:            kref_put(&spec->kref, rbd_spec_free);
drivers/char/hw_random/core.c:          kref_put(&rng->ref, cleanup_rng);
drivers/char/ipmi/ipmi_msghandler.c:
kref_put(&e->intf->refcount, intf_free);
...

Hmmm

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] kref: Avoid null pointer dereference after WARN Kees Cook <keescook@chromium.org> - 2017-06-27 21:10 +0200
  Re: [PATCH v2] kref: Avoid null pointer dereference after WARN "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-27 21:20 +0200
  Re: [PATCH v2] kref: Avoid null pointer dereference after WARN Andi Kleen <ak@linux.intel.com> - 2017-06-27 21:30 +0200
    Re: [PATCH v2] kref: Avoid null pointer dereference after WARN "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-27 21:30 +0200
      Re: [PATCH v2] kref: Avoid null pointer dereference after WARN Kees Cook <keescook@chromium.org> - 2017-06-27 21:40 +0200
        Re: [PATCH v2] kref: Avoid null pointer dereference after WARN Andi Kleen <ak@linux.intel.com> - 2017-06-27 21:50 +0200
        Re: [PATCH v2] kref: Avoid null pointer dereference after WARN Daniel Micay <danielmicay@gmail.com> - 2017-06-27 22:20 +0200

csiph-web