From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751855AbdF0Dw0 (ORCPT ); Mon, 26 Jun 2017 23:52:26 -0400 Received: from mail-pg0-f54.google.com ([74.125.83.54]:36316 "EHLO mail-pg0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751460AbdF0DwS (ORCPT ); Mon, 26 Jun 2017 23:52:18 -0400 Date: Mon, 26 Jun 2017 20:52:15 -0700 From: Kees Cook To: Greg Kroah-Hartman Cc: Ingo Molnar , Peter Zijlstra , "Jason A. Donenfeld" , Thomas Hellstrom , Andi Kleen , Daniel Micay , linux-kernel@vger.kernel.org Subject: [PATCH] kref: Avoid null pointer dereference after WARN Message-ID: <20170627035215.GA132342@beast> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniel Micay The WARN_ON() checking for a NULL release pointer should be a BUG() since continuing with a NULL release pointer will lead to a NULL pointer dereference anyway. The kref_put() case is extracted from PaX, and Kees Cook noted it should be extended to the other two cases. Signed-off-by: Daniel Micay [kees: clarify commit log] Signed-off-by: Kees Cook --- include/linux/kref.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/kref.h b/include/linux/kref.h index f4156f88f557..82a2c225eae3 100644 --- a/include/linux/kref.h +++ b/include/linux/kref.h @@ -66,7 +66,7 @@ static inline void kref_get(struct kref *kref) */ static inline int kref_put(struct kref *kref, void (*release)(struct kref *kref)) { - WARN_ON(release == NULL); + BUG_ON(release == NULL); if (refcount_dec_and_test(&kref->refcount)) { release(kref); @@ -79,7 +79,7 @@ static inline int kref_put_mutex(struct kref *kref, void (*release)(struct kref *kref), struct mutex *lock) { - WARN_ON(release == NULL); + BUG_ON(release == NULL); if (refcount_dec_and_mutex_lock(&kref->refcount, lock)) { release(kref); @@ -92,7 +92,7 @@ static inline int kref_put_lock(struct kref *kref, void (*release)(struct kref *kref), spinlock_t *lock) { - WARN_ON(release == NULL); + BUG_ON(release == NULL); if (refcount_dec_and_lock(&kref->refcount, lock)) { release(kref); -- Kees Cook Pixel Security