[PATCH] kernel: jump_label: fix NULL dereference bug in __jump_label_mod_update()

[PATCH] kernel: jump_label: fix NULL dereference bug in __jump_label_mod_update()

[Ard Biesheuvel]

Commit 19483677684b ("jump_label: Annotate entries that operate on
__init code earlier") refactored the code that manages runtime
patching of jump labels in modules that are tied to static keys
defined in other modules or in the core kernel.

In the latter case, we may iterate over the static_key_mod linked
list until we hit the entry for the core kernel, whose 'mod' field
will be NULL, and attempt to dereference it to get at its 'state'
member.

So let's add a non-NULL check: this forces the 'init' argument of
__jump_label_update() to false for static keys that are defined in
the core kernel, which is appropriate given that __init annotated
jump_label entries in the core kernel should no longer be active
at this point (i.e., when loading modules).

Fixes: 19483677684b ("jump_label: Annotate entries that operate on ...")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 kernel/jump_label.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index e8cf3ff3149c..14a7f9881745 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -516,7 +516,7 @@ static void __jump_label_mod_update(struct static_key *key)
 		else
 			stop = m->jump_entries + m->num_jump_entries;
 		__jump_label_update(key, mod->entries, stop,
-				    m->state == MODULE_STATE_COMING);
+				    m && m->state == MODULE_STATE_COMING);
 	}
 }
 
-- 
2.17.1

Re: [PATCH] kernel: jump_label: fix NULL dereference bug in __jump_label_mod_update()

[Kees Cook]

On Mon, Oct 1, 2018 at 1:13 AM, Ard Biesheuvel
<ard.biesheuvel@linaro.org> wrote:
> Commit 19483677684b ("jump_label: Annotate entries that operate on
> __init code earlier") refactored the code that manages runtime
> patching of jump labels in modules that are tied to static keys
> defined in other modules or in the core kernel.
>
> In the latter case, we may iterate over the static_key_mod linked
> list until we hit the entry for the core kernel, whose 'mod' field
> will be NULL, and attempt to dereference it to get at its 'state'
> member.
>
> So let's add a non-NULL check: this forces the 'init' argument of
> __jump_label_update() to false for static keys that are defined in
> the core kernel, which is appropriate given that __init annotated
> jump_label entries in the core kernel should no longer be active
> at this point (i.e., when loading modules).
>
> Fixes: 19483677684b ("jump_label: Annotate entries that operate on ...")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Jessica Yu <jeyu@kernel.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>  kernel/jump_label.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/jump_label.c b/kernel/jump_label.c
> index e8cf3ff3149c..14a7f9881745 100644
> --- a/kernel/jump_label.c
> +++ b/kernel/jump_label.c
> @@ -516,7 +516,7 @@ static void __jump_label_mod_update(struct static_key *key)
>                 else
>                         stop = m->jump_entries + m->num_jump_entries;
>                 __jump_label_update(key, mod->entries, stop,
> -                                   m->state == MODULE_STATE_COMING);
> +                                   m && m->state == MODULE_STATE_COMING);
>         }
>  }
>
> --
> 2.17.1
>



-- 
Kees Cook
Pixel Security

[tip:core/core] jump_label: Fix NULL dereference bug in __jump_label_mod_update()

[tip-bot for Ard Biesheuvel]

Commit-ID:  77ac1c02d9f20a0d72fa992c88b98c15d087dbca
Gitweb:     https://git.kernel.org/tip/77ac1c02d9f20a0d72fa992c88b98c15d087dbca
Author:     Ard Biesheuvel <ard.biesheuvel@linaro.org>
AuthorDate: Mon, 1 Oct 2018 10:13:24 +0200
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Tue, 2 Oct 2018 08:08:18 +0200

jump_label: Fix NULL dereference bug in __jump_label_mod_update()

Commit 19483677684b ("jump_label: Annotate entries that operate on
__init code earlier") refactored the code that manages runtime
patching of jump labels in modules that are tied to static keys
defined in other modules or in the core kernel.

In the latter case, we may iterate over the static_key_mod linked
list until we hit the entry for the core kernel, whose 'mod' field
will be NULL, and attempt to dereference it to get at its 'state'
member.

So let's add a non-NULL check: this forces the 'init' argument of
__jump_label_update() to false for static keys that are defined in
the core kernel, which is appropriate given that __init annotated
jump_label entries in the core kernel should no longer be active
at this point (i.e., when loading modules).

Fixes: 19483677684b ("jump_label: Annotate entries that operate on ...")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20181001081324.11553-1-ard.biesheuvel@linaro.org
---
 kernel/jump_label.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index e8cf3ff3149c..14a7f9881745 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -516,7 +516,7 @@ static void __jump_label_mod_update(struct static_key *key)
 		else
 			stop = m->jump_entries + m->num_jump_entries;
 		__jump_label_update(key, mod->entries, stop,
-				    m->state == MODULE_STATE_COMING);
+				    m && m->state == MODULE_STATE_COMING);
 	}
 }