Re: 6.5.13 regression: BUG: kernel NULL pointer dereference, address: 0000000000000020

Re: 6.5.13 regression: BUG: kernel NULL pointer dereference, address: 0000000000000020

[dan]

I'm seeing this too, but on 6.6.3 (6.6.2 is fine).

Bisected it down to commit 2e8b4e0992e16 ("gcc-plugins: randstruct:
Only warn about true flexible arrays"). Reverting that commit on top
of v6.6.3 makes it go away.

I do wonder if content such as that (which *looks* like it's purely
preparing for future changes) is appropriate for the stable trees.

Cheers,

-- Dan

Re: 6.5.13 regression: BUG: kernel NULL pointer dereference, address: 0000000000000020

[Sam James]

I suspect this is https://lore.kernel.org/linux-hardening/20231124102458.GB1503258@e124191.cambridge.arm.com/
and the patch at
https://lore.kernel.org/linux-hardening/170117162434.28731.12930304842635897908.git-patchwork-notify@kernel.org/T/#t
may help.

Re: 6.5.13 regression: BUG: kernel NULL pointer dereference, address: 0000000000000020

[Dan Moulding]

Thanks, Sam. Yes it does look like that's the same issue.

I applied that patch to v6.6.3 instead of reverting the change to the
randomize_layout plugin and the problem also goes away with the patch
applied.

In that thread with the patch, Gustavo does mention that many other
zero-length arrays, besides this one in struct neighbor, were found in
the kernel source. But a quick (and possibly imperfect) grepping seems
to show that struct neighbor was the only one used with
__randomize_layout. So, I *think* it might be the only one that could
cause a problem with the recent change to the randomize_layout plugin.

-- Dan

Re: 6.5.13 regression: BUG: kernel NULL pointer dereference, address: 0000000000000020

[Gustavo A. R. Silva]

> the kernel source. But a quick (and possibly imperfect) grepping seems
> to show that struct neighbor was the only one used with
> __randomize_layout. So, I *think* it might be the only one that could
> cause a problem with the recent change to the randomize_layout plugin.

Yeah, I can confirm we don't currently have any other fake flex array
in a struct with __randomize_layout. :)

--
Gustavo