public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Cengiz Can <cengiz@kernel.wtf>
To: Jason Wessel <jason.wessel@windriver.com>,
	Daniel Thompson <daniel.thompson@linaro.org>,
	Douglas Anderson <dianders@chromium.org>
Cc: kgdb-bugreport@lists.sourceforge.net,
	linux-kernel@vger.kernel.org, Sumit Garg <sumit.garg@linaro.org>,
	Petr Mladek <pmladek@suse.com>,
	Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
	Cengiz Can <cengiz@kernel.wtf>
Subject: [PATCH] kdb: prevent possible null deref in kdb_msg_write
Date: Mon, 29 Jun 2020 16:59:24 +0300	[thread overview]
Message-ID: <20200629135923.14912-1-cengiz@kernel.wtf> (raw)

`kdb_msg_write` operates on a global `struct kgdb_io *` called
`dbg_io_ops`.

Although it is initialized in `debug_core.c`, there's a null check in
`kdb_msg_write` which implies that it can be null whenever we dereference
it in this function call.

Coverity scanner caught this as CID 1465042.

I have modified the function to bail out if `dbg_io_ops` is not properly
initialized.

Signed-off-by: Cengiz Can <cengiz@kernel.wtf>
---
 kernel/debug/kdb/kdb_io.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index 683a799618ad..85e579812458 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -549,14 +549,15 @@ static void kdb_msg_write(const char *msg, int msg_len)
 	if (msg_len == 0)
 		return;
 
-	if (dbg_io_ops) {
-		const char *cp = msg;
-		int len = msg_len;
+	if (!dbg_io_ops)
+		return;
 
-		while (len--) {
-			dbg_io_ops->write_char(*cp);
-			cp++;
-		}
+	const char *cp = msg;
+	int len = msg_len;
+
+	while (len--) {
+		dbg_io_ops->write_char(*cp);
+		cp++;
 	}
 
 	for_each_console(c) {
-- 
2.27.0


             reply	other threads:[~2020-06-29 19:12 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-29 13:59 Cengiz Can [this message]
2020-06-29 14:27 ` [PATCH] kdb: prevent possible null deref in kdb_msg_write Daniel Thompson
2020-06-29 14:50 ` Petr Mladek
2020-06-29 14:53   ` Petr Mladek
2020-06-29 15:37   ` Daniel Thompson
2020-06-29 20:50     ` [PATCH v2] kdb: remove unnecessary null check of dbg_io_ops Cengiz Can
2020-06-29 21:16       ` Doug Anderson
2020-06-29 22:10         ` Cengiz Can
2020-06-30  5:55     ` [PATCH] kdb: prevent possible null deref in kdb_msg_write Sumit Garg
2020-06-30  8:29       ` [PATCH v3] kdb: remove unnecessary null check of dbg_io_ops Cengiz Can
2020-06-30 11:36         ` Sumit Garg
2020-06-30 11:48           ` Andy Shevchenko
2020-06-30 22:32         ` Doug Anderson
2020-07-10 12:15           ` Cengiz Can
2020-07-10 13:41             ` Daniel Thompson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200629135923.14912-1-cengiz@kernel.wtf \
    --to=cengiz@kernel.wtf \
    --cc=andriy.shevchenko@linux.intel.com \
    --cc=daniel.thompson@linaro.org \
    --cc=dianders@chromium.org \
    --cc=jason.wessel@windriver.com \
    --cc=kgdb-bugreport@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pmladek@suse.com \
    --cc=sumit.garg@linaro.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox