2016-04-07 16:06:31

by Jiri Kosina

Subject: [PATCH] livepatch: robustify klp_register_patch() API error checking

From: Jiri Kosina <[email protected]>

Commit 425595a7fc20 ("livepatch: reuse module loader code to write
relocations") adds a possibility of dereferncing pointers supplied by the
consumer of the livepatch API before sanity (NULL) checking them (patch
and patch->mod).

Spotted by smatch tool.

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
---
kernel/livepatch/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index eb5db6e..28c37fa 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -876,6 +876,9 @@ int klp_register_patch(struct klp_patch *patch)
{
int ret;

+ if (!patch || !patch->mod)
+ return -EINVAL;
+
if (!is_livepatch_module(patch->mod)) {
pr_err("module %s is not marked as a livepatch module",
patch->mod->name);
@@ -885,9 +888,6 @@ int klp_register_patch(struct klp_patch *patch)
if (!klp_initialized())
return -ENODEV;

- if (!patch || !patch->mod)
- return -EINVAL;
-
/*
* A reference is taken on the patch module to prevent it from being
* unloaded. Right now, we don't allow patch modules to unload since

--
Jiri Kosina
SUSE Labs

2016-04-07 18:04:05

by Josh Poimboeuf

Subject: Re: [PATCH] livepatch: robustify klp_register_patch() API error checking

On Thu, Apr 07, 2016 at 06:06:25PM +0200, Jiri Kosina wrote:
> From: Jiri Kosina <[email protected]>
>
> Commit 425595a7fc20 ("livepatch: reuse module loader code to write
> relocations") adds a possibility of dereferncing pointers supplied by the
> consumer of the livepatch API before sanity (NULL) checking them (patch
> and patch->mod).
>
> Spotted by smatch tool.
>
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Jiri Kosina <[email protected]>

Acked-by: Josh Poimboeuf <[email protected]>


--
Josh

2016-04-07 18:20:37

by Jessica Yu

Subject: Re: livepatch: robustify klp_register_patch() API error checking

+++ Jiri Kosina [07/04/16 18:06 +0200]:
>From: Jiri Kosina <[email protected]>
>
>Commit 425595a7fc20 ("livepatch: reuse module loader code to write
>relocations") adds a possibility of dereferncing pointers supplied by the
>consumer of the livepatch API before sanity (NULL) checking them (patch
>and patch->mod).
>
>Spotted by smatch tool.
>
>Reported-by: Dan Carpenter <[email protected]>
>Signed-off-by: Jiri Kosina <[email protected]>

Acked-by: Jessica Yu <[email protected]>

Thank you Jiri!

2016-04-07 20:33:17

by Jiri Kosina

Subject: Re: [PATCH] livepatch: robustify klp_register_patch() API error checking

On Thu, 7 Apr 2016, Jiri Kosina wrote:

> From: Jiri Kosina <[email protected]>
>
> Commit 425595a7fc20 ("livepatch: reuse module loader code to write
> relocations") adds a possibility of dereferncing pointers supplied by the
> consumer of the livepatch API before sanity (NULL) checking them (patch
> and patch->mod).
>
> Spotted by smatch tool.
>
> Reported-by: Dan Carpenter <[email protected]>

Acked-by: Josh Poimboeuf <[email protected]>
Acked-by: Jessica Yu <[email protected]>

Pushed out. Thanks,

--
Jiri Kosina
SUSE Labs