Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753455AbdF0TeK (ORCPT ); Tue, 27 Jun 2017 15:34:10 -0400 Received: from mail-io0-f181.google.com ([209.85.223.181]:36673 "EHLO mail-io0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753249AbdF0TeC (ORCPT ); Tue, 27 Jun 2017 15:34:02 -0400 MIME-Version: 1.0 In-Reply-To: References: <20170627190001.GA7811@beast> <20170627192242.GI23705@tassilo.jf.intel.com> From: Kees Cook Date: Tue, 27 Jun 2017 12:34:01 -0700 X-Google-Sender-Auth: sm7ZXcuXXzu9gA1x999Rp7WwHRk Message-ID: Subject: Re: [PATCH v2] kref: Avoid null pointer dereference after WARN To: "Jason A. Donenfeld" Cc: Andi Kleen , Greg Kroah-Hartman , Ingo Molnar , Peter Zijlstra , Thomas Hellstrom , Daniel Micay , LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1240 Lines: 37 On Tue, Jun 27, 2017 at 12:26 PM, Jason A. Donenfeld wrote: > On Tue, Jun 27, 2017 at 9:22 PM, Andi Kleen wrote: >> Who would actually set mman_min_addr incorrectly? > > Historically there have been quite a few bypasses of mmap_min_addr, > actually. This is well-trodden ground. Targeting things in /proc/sys via confused privileged helpers is extremely common. See Chrome OS pwn2own exploits (targetting modprobe sysctl), and plenty of others. Modern attack methodology is rarely a single-bug attack, but rather a chain of bugs, which may include producing or exploiting weak userspace configurations to soften the kernel. Regardless, it's a fair point that checking this unconditionally is wasteful. Strangely this doesn't help: - BUG_ON(release == NULL); + if (!__builtin_constant_p(release)) + BUG_ON(release == NULL); When nearly all callers pass a function directly: ... drivers/block/rbd.c: kref_put(&spec->kref, rbd_spec_free); drivers/char/hw_random/core.c: kref_put(&rng->ref, cleanup_rng); drivers/char/ipmi/ipmi_msghandler.c: kref_put(&e->intf->refcount, intf_free); ... Hmmm -Kees -- Kees Cook Pixel Security