potential null dereference in sysfs_override_clocksource()

potential null dereference in sysfs_override_clocksource()

[Dan Carpenter]

Hello,

I am testing a source checker (http://repo.or.cz/w/smatch.git).

It found an issue in sysfs_override_clocksource() from 
kernel/time/clocksource.c.  If "len" is zero then "ovr" is null and 
checking ovr->flags will oops on line 517.

kernel/time/clocksource.c
   516          if (tick_oneshot_mode_active() &&
   517              !(ovr->flags & CLOCK_SOURCE_VALID_FOR_HRES)) {
   518                  printk(KERN_WARNING "%s clocksource is not HRT compatible. "

regards,
dan carpenter

Re: potential null dereference in sysfs_override_clocksource()

[Thomas Gleixner]

Dan,

On Sun, 19 Jul 2009, Dan Carpenter wrote:

> Hello,
> 
> I am testing a source checker (http://repo.or.cz/w/smatch.git).
> 
> It found an issue in sysfs_override_clocksource() from 
> kernel/time/clocksource.c.  If "len" is zero then "ovr" is null and 
> checking ovr->flags will oops on line 517.
> 
> kernel/time/clocksource.c
>    516          if (tick_oneshot_mode_active() &&
>    517              !(ovr->flags & CLOCK_SOURCE_VALID_FOR_HRES)) {
>    518                  printk(KERN_WARNING "%s clocksource is not HRT compatible. "

Indeed. I queued a fix.

Thanks for pointing it out,


       tglx

[tip:timers/urgent] clocksource: Prevent NULL pointer dereference

[tip-bot for Thomas Gleixner]

Commit-ID:  79ef2bb01445400def20c7993b27fbcad27ca95f
Gitweb:     http://git.kernel.org/tip/79ef2bb01445400def20c7993b27fbcad27ca95f
Author:     Thomas Gleixner <tglx@linutronix.de>
AuthorDate: Sun, 19 Jul 2009 17:09:12 +0200
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Sun, 19 Jul 2009 17:15:54 +0200

clocksource: Prevent NULL pointer dereference

Writing a zero length string to sys/.../current_clocksource will cause
a NULL pointer dereference if the clock events system is in one shot
(highres or nohz) mode.

Pointed-out-by: Dan Carpenter <error27@gmail.com>
LKML-Reference: <alpine.DEB.2.00.0907191545580.12306@bicker>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>


---
 kernel/time/clocksource.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 592bf58..7466cb8 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -513,7 +513,7 @@ static ssize_t sysfs_override_clocksource(struct sys_device *dev,
 	 * Check to make sure we don't switch to a non-highres capable
 	 * clocksource if the tick code is in oneshot mode (highres or nohz)
 	 */
-	if (tick_oneshot_mode_active() &&
+	if (tick_oneshot_mode_active() && ovr &&
 	    !(ovr->flags & CLOCK_SOURCE_VALID_FOR_HRES)) {
 		printk(KERN_WARNING "%s clocksource is not HRT compatible. "
 			"Cannot switch while in HRT/NOHZ mode\n", ovr->name);