Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752112AbdFUWbX (ORCPT ); Wed, 21 Jun 2017 18:31:23 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:55247 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751755AbdFUWbV (ORCPT ); Wed, 21 Jun 2017 18:31:21 -0400 From: Jay Vosburgh To: David Miller cc: michael.j.dilmore@gmail.com, vfalico@gmail.com, andy@greyhouse.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, joe@perches.com Subject: Re: [PATCH] Convert BUG_ON to WARN_ON in bond_options.c In-reply-to: <20170621.175651.854625612625047729.davem@davemloft.net> References: <20170621.173655.1945994342723484710.davem@davemloft.net> <20170621.175651.854625612625047729.davem@davemloft.net> Comments: In-reply-to David Miller message dated "Wed, 21 Jun 2017 17:56:51 -0400." X-Mailer: MH-E 8.6+git-jv; nmh 1.6; GNU Emacs 25.1.50 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <24538.1498084275.1@famine> Date: Wed, 21 Jun 2017 15:31:15 -0700 Message-ID: <24539.1498084275@famine> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1049 Lines: 31 David Miller wrote: >From: Michael D >Date: Wed, 21 Jun 2017 22:41:07 +0100 > >> I don't think you can stop it being dereferenced... you just need to >> prevent an attacker from exploiting the null pointer dereference >> vulnerability right? And this is done by returning the function right >> away? > >What's all of this about an "attacker"? > >If there is a bug, we dererence a NULL pointer, and we should >fix that bug. > >The BUG_ON() helps us see where the problem is while at the >same time stopping the kernel before the NULL deref happens. Looking at the code more carefully than I did earlier, the only way the BUG_ON will hit is if the rx_handler_data is NULL for a bonding slave when this code executes. This should be impossible, as there doesn't appear to be any way to get into bond_option_active_slave_set for a slave prior to bond_enslave registering the rx_handler for that slave, as these operations are mutexed by RTNL. -J --- -Jay Vosburgh, jay.vosburgh@canonical.com