From patchwork Mon Oct 1 08:13:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 147873 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp3614318lji; Mon, 1 Oct 2018 01:13:51 -0700 (PDT) X-Google-Smtp-Source: ACcGV62fWY25cmiLBGei9rL3QLFm2XPJhvcMsMfoaaF9TJfKALVi0T2M9JQGpHXi2Sp4PORpw3c9 X-Received: by 2002:a65:498b:: with SMTP id r11-v6mr9429640pgs.153.1538381631774; Mon, 01 Oct 2018 01:13:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1538381631; cv=none; d=google.com; s=arc-20160816; b=zEaBNuu2RcRU4pccmE0i9R+0NkrKcrW8uQzBlTMUwSLj6Er+6CR6cv2tMSfQBAzXpD EnQpRchxTvTVaxyG7BQYhsD0524lEVVJ9JLl/g4EVm6QrCUKW4hpKyNnj6xcUuRJhaw3 k34GZtmZulylZnIMT23n1iy8vOwgjxVbpkhQNGOSIRpFKEghm0d4gN34CZOlbGI0vjv5 M/VHOkezvQnWTCimNcAmTEsplNmw2h8a3kfhA/ijUiZluFpCA+x5hF6DmVGixcBAFbVB f3vDowaRwnx7IWUAcx4Aq8OCRXE38Sz6+7syv6kVJF9f9vB+GYy2cB9MxGLTfY3ol0Kn T/mQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :dkim-signature; bh=V34KedFUl0dNpmZRY9XQEWcKkcvRF5BVwWbyCmrm3k8=; b=IoOrWOZtm1Pm55CtSRNqUCkDiwJky9/DgVHaSKT7DV2kJfMdyKox6aNWXdrzZeLjP3 yaMtGFiGGUNBWjA+KQbyy2NQahgBcJAFqnIPCLxGJNIiEbavdD9ZaOO0kppwTnhHqSml tRnbGWubwUMOSNTBHvtRnTWRmOA8FGEJsJdJz88EE7rkgsrdOH6VnPegPH8JHeiq3+V0 cypihbh4JQYXD4L93GYje+gMSE6JSpnrtlL8N6pHh93neqs74ekLzvtfYmzHn8DSRCWT 23Q8YxIQA3obNtzuL0EudviRNGEg0ei0/L9L9E+7a+TzDe/JoRJ33+atsl+H9Zc8JWEs mMpw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=J7U+X8EM; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w10-v6si12646734pfk.162.2018.10.01.01.13.51; Mon, 01 Oct 2018 01:13:51 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=J7U+X8EM; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728884AbeJAOuU (ORCPT + 32 others); Mon, 1 Oct 2018 10:50:20 -0400 Received: from mail-wm1-f68.google.com ([209.85.128.68]:33365 "EHLO mail-wm1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727333AbeJAOuU (ORCPT ); Mon, 1 Oct 2018 10:50:20 -0400 Received: by mail-wm1-f68.google.com with SMTP id y140-v6so1985475wmd.0 for ; Mon, 01 Oct 2018 01:13:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=V34KedFUl0dNpmZRY9XQEWcKkcvRF5BVwWbyCmrm3k8=; b=J7U+X8EMFfYFPLD72nlnRuWW0ikSxmXnmQTbHa6+CNxQq/dOnO6sVGuwBZN9c6oYE+ GmhmBylOPTUvL/oVWCapcDYNRaQ+vY80xIyjuDJkWfdjePGwfxh7E5YyEEbNN4NIZBAl 8plWoxh9x7IUfqF20oyQJO2cxTH1lt41jXVOY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=V34KedFUl0dNpmZRY9XQEWcKkcvRF5BVwWbyCmrm3k8=; b=LS819shyVeZ+LF8U9sVMsUwh8aDVTh5NB/8ngO7Y1LnyxVxrMsEmtsLtyBWxaNvFBo LIuKSrW+2SdO4cKpyq3JMxqrUpSfDsMLepepWRd9Wgh/uQz06+Aa3rqhqddQq0z/uVg+ oaKJMYLkt8jUvRA8ZJ1oWdh9WzzPMa7n87yjp/g7NSAj5jsSaoExfJGBcq189koTpLtl R9pOQexnEQTfDvhXIzSxgqDb6Pfv5SsC32jAndueD490bRYGonkyzW6jE2qtdfkVPXhS TeveKovtXl4jWKgCGoUMuXcscFC8NFsrXF4wnlslb8fBm2HBwhMtu0AACXqoO+/v9fWm fS7w== X-Gm-Message-State: ABuFfojPmt2wRYl13qBrZxJOfnXba+1GHsGJMFfpR6UBpcqm28hkytGn lkm8lBuZ0rkw1uts94co4meMcD99N7k= X-Received: by 2002:a1c:1812:: with SMTP id 18-v6mr3341213wmy.34.1538381627210; Mon, 01 Oct 2018 01:13:47 -0700 (PDT) Received: from dogfood.home ([2a01:cb1d:112:6f00:6d26:fb49:4a42:a358]) by smtp.gmail.com with ESMTPSA id s1-v6sm2592130wrw.35.2018.10.01.01.13.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 01 Oct 2018 01:13:46 -0700 (PDT) From: Ard Biesheuvel To: linux-kernel@vger.kernel.org Cc: Ard Biesheuvel , Kees Cook , Thomas Gleixner , Ingo Molnar , Jessica Yu , Peter Zijlstra Subject: [PATCH] kernel: jump_label: fix NULL dereference bug in __jump_label_mod_update() Date: Mon, 1 Oct 2018 10:13:24 +0200 Message-Id: <20181001081324.11553-1-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.17.1 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit 19483677684b ("jump_label: Annotate entries that operate on __init code earlier") refactored the code that manages runtime patching of jump labels in modules that are tied to static keys defined in other modules or in the core kernel. In the latter case, we may iterate over the static_key_mod linked list until we hit the entry for the core kernel, whose 'mod' field will be NULL, and attempt to dereference it to get at its 'state' member. So let's add a non-NULL check: this forces the 'init' argument of __jump_label_update() to false for static keys that are defined in the core kernel, which is appropriate given that __init annotated jump_label entries in the core kernel should no longer be active at this point (i.e., when loading modules). Fixes: 19483677684b ("jump_label: Annotate entries that operate on ...") Reported-by: Dan Carpenter Cc: Kees Cook Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Jessica Yu Cc: Peter Zijlstra Signed-off-by: Ard Biesheuvel --- kernel/jump_label.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.17.1 Reviewed-by: Kees Cook diff --git a/kernel/jump_label.c b/kernel/jump_label.c index e8cf3ff3149c..14a7f9881745 100644 --- a/kernel/jump_label.c +++ b/kernel/jump_label.c @@ -516,7 +516,7 @@ static void __jump_label_mod_update(struct static_key *key) else stop = m->jump_entries + m->num_jump_entries; __jump_label_update(key, mod->entries, stop, - m->state == MODULE_STATE_COMING); + m && m->state == MODULE_STATE_COMING); } }