From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
To: Matthias Kaehlcke <mka@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jiri Slaby <jslaby@suse.com>
Cc: linux-kernel@vger.kernel.org, Evan Green <evgreen@chromium.org>,
Douglas Anderson <dianders@chromium.org>,
Stephen Boyd <swboyd@chromium.org>,
Manoj Gupta <manojgupta@chromium.org>,
Nick Desaulniers <ndesaulniers@google.com>
Subject: Re: [PATCH] tty/sysrq: Make local variable 'killer' in sysrq_handle_crash() global
Date: Tue, 18 Sep 2018 11:39:20 +0530 [thread overview]
Message-ID: <98e5a46b-d7db-14c2-320e-f8f6c3c063bf@codeaurora.org> (raw)
In-Reply-To: <20180917213304.44476-1-mka@chromium.org>
On 9/18/2018 3:03 AM, Matthias Kaehlcke wrote:
> sysrq_handle_crash() dereferences a NULL pointer on purpose to force
> an exception, the local variable 'killer' is assigned to NULL and
> dereferenced later. Clang detects the NULL pointer dereference at compile
> time and emits a BRK instruction (on arm64) instead of the expected NULL
> pointer exception. Change 'killer' to a global variable (and rename it
> to 'sysrq_killer' to avoid possible clashes) to prevent Clang from
> detecting the condition. By default global variables are initialized
> with zero/NULL in C, therefore an explicit initialization is not needed.
>
> Reported-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
> Suggested-by: Evan Green <evgreen@chromium.org>
> Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
> ---
> drivers/tty/sysrq.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
> index 06ed20dd01ba..49fa8e758690 100644
> --- a/drivers/tty/sysrq.c
> +++ b/drivers/tty/sysrq.c
> @@ -132,10 +132,10 @@ static struct sysrq_key_op sysrq_unraw_op = {
> #define sysrq_unraw_op (*(struct sysrq_key_op *)NULL)
> #endif /* CONFIG_VT */
>
> +char *sysrq_killer;
> +
> static void sysrq_handle_crash(int key)
> {
> - char *killer = NULL;
> -
> /* we need to release the RCU read lock here,
> * otherwise we get an annoying
> * 'BUG: sleeping function called from invalid context'
> @@ -144,7 +144,7 @@ static void sysrq_handle_crash(int key)
> rcu_read_unlock();
> panic_on_oops = 1; /* force panic */
> wmb();
> - *killer = 1;
> + *sysrq_killer = 1;
> }
> static struct sysrq_key_op sysrq_crash_op = {
> .handler = sysrq_handle_crash,
>
Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
next prev parent reply other threads:[~2018-09-18 6:09 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-17 21:33 [PATCH] tty/sysrq: Make local variable 'killer' in sysrq_handle_crash() global Matthias Kaehlcke
2018-09-18 6:09 ` Sai Prakash Ranjan [this message]
2018-09-18 6:11 ` Jiri Slaby
2018-09-18 6:58 ` Sai Prakash Ranjan
2018-09-18 7:20 ` Greg Kroah-Hartman
2018-09-18 9:05 ` Sai Prakash Ranjan
2018-09-18 9:17 ` Greg Kroah-Hartman
2018-09-18 9:53 ` Sai Prakash Ranjan
[not found] ` <32bf1760-4967-a37a-6a17-3f7d5f6e071e@suse.cz>
2018-09-18 17:32 ` Matthias Kaehlcke
2018-09-18 17:24 ` Matthias Kaehlcke
2018-09-18 11:46 ` David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=98e5a46b-d7db-14c2-320e-f8f6c3c063bf@codeaurora.org \
--to=saiprakash.ranjan@codeaurora.org \
--cc=dianders@chromium.org \
--cc=evgreen@chromium.org \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=manojgupta@chromium.org \
--cc=mka@chromium.org \
--cc=ndesaulniers@google.com \
--cc=swboyd@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).