Skip to contentSkip to conversation

kprobe_exceptions_notify(): fix NULL dereference

PATCH In review Adrian Bunk 2 participants 2 messages Oct 27, 2007 – Oct 29, 2007

Subsystems (2)
x86 PowerPC
lore
Share & tools
lore

Adrian Bunk

author
#0 lore raw

PATCH 1/1 kprobe_exceptions_notify(): fix NULL dereference

This patch fixes later NULL dereferences spotted by the Coverity checker.

Signed-off-by Adrian Bunk <[email protected]>

---

BTW: The avr32 and s390 versions of kprobe_exceptions_notify() are
not touched since they don't contain this check.

 arch/ia64/kernel/kprobes.c    |    2 +-
 arch/powerpc/kernel/kprobes.c |    2 +-
 arch/sparc64/kernel/kprobes.c |    2 +-
 arch/x86/kernel/kprobes_32.c  |    2 +-
 arch/x86/kernel/kprobes_64.c  |    2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

b6f1241ee20dd22210f48b4100bc5055315f3808

arch/ia64/kernel/kprobes.c +1 -1
index 5fd65d8..3663dfb 100644
@@ -886,11 +886,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode(args->regs))
+	if (args->regs || user_mode(args->regs))
 		return ret;
 
 	switch(val) {
 	case DIE_BREAK:
 		/* err is break number from ia64_bad_break() */
arch/powerpc/kernel/kprobes.c +1 -1
index 5338e48..913f9cd 100644
@@ -474,11 +474,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode(args->regs))
+	if (args->regs || user_mode(args->regs))
 		return ret;
 
 	switch (val) {
 	case DIE_BPT:
 		if (kprobe_handler(args->regs))
arch/sparc64/kernel/kprobes.c +1 -1
index d94f901..73372b2 100644
@@ -391,11 +391,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode(args->regs))
+	if (args->regs || user_mode(args->regs))
 		return ret;
 
 	switch (val) {
 	case DIE_DEBUG:
 		if (kprobe_handler(args->regs))
arch/x86/kernel/kprobes_32.c +1 -1
index 90f778c..fb5145e 100644
@@ -658,11 +658,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode_vm(args->regs))
+	if (args->regs || user_mode_vm(args->regs))
 		return ret;
 
 	switch (val) {
 	case DIE_INT3:
 		if (kprobe_handler(args->regs))
arch/x86/kernel/kprobes_64.c +1 -1
index 681b801..67b0585 100644
@@ -649,11 +649,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode(args->regs))
+	if (args->regs || user_mode(args->regs))
 		return ret;
 
 	switch (val) {
 	case DIE_INT3:
 		if (kprobe_handler(args->regs))
#1 lore raw
Quoted 4 lines · Adrian Bunk

This patch fixes later NULL dereferences spotted by the Coverity checker.

Signed-off-by Adrian Bunk <[email protected]>

NACK... see below

Quoted 18 lines

---

BTW: The avr32 and s390 versions of kprobe_exceptions_notify() are
not touched since they don't contain this check.

 arch/ia64/kernel/kprobes.c    |    2 +-
 arch/powerpc/kernel/kprobes.c |    2 +-
 arch/sparc64/kernel/kprobes.c |    2 +-
 arch/x86/kernel/kprobes_32.c  |    2 +-
 arch/x86/kernel/kprobes_64.c  |    2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

b6f1241ee20dd22210f48b4100bc5055315f3808

arch/ia64/kernel/kprobes.c +0 -0
index 5fd65d8..3663dfb 100644

arch/ia64/kernel/kprobes.c int __kprobes kprobe_exceptions_notify(struct notifier_block *self, · line 891

Quoted 7 lines
arch/ia64/kernel/kprobes.c +1 -1
@@ -886,11 +886,11 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
 				       unsigned long val, void *data)
 {
 	struct die_args *args = (struct die_args *)data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode(args->regs))
+	if (args->regs || user_mode(args->regs))

This change is incorrect as you return if args->regs != NULL leading to a sure system crash.

Ananth