Re: [PATCH] kprobes: Fix NULL pointer dereference in unregister_kretprobes()
JP Kobryn <[email protected]>
| Newsgroups | gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On 8/5/2026 9:12 AM, Luigi Rizzo wrote:
> In unregister_kretprobes(), rps[i]->rph can be NULL e.g. when called
> after kretprobe failed registration. Under !CONFIG_KRETPROBE_ON_RETHOOK,
> the unconditional access to rps[i]->rph->rp, causes a kernel panic due
> to NULL pointer dereference.
>
> Add a NULL check for rps[i]->rph before invoking rcu_assign_pointer().
>
> Fixes: d839a656d0f3 ("kprobes: consistent rcu api usage for kretprobe holder")
The bug was not introduced in this commit. It goes further back to:
d741bf41d7c7 ("kprobes: Remove kretprobe hash")
> Signed-off-by: Luigi Rizzo <[email protected]>
> ---
> kernel/kprobes.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index bfc89083daa93..5dd4786c455de 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -2359,7 +2359,8 @@ void unregister_kretprobes(struct kretprobe **rps, int num)
> #ifdef CONFIG_KRETPROBE_ON_RETHOOK
> rethook_free(rps[i]->rh);
> #else
> - rcu_assign_pointer(rps[i]->rph->rp, NULL);
> + if (rps[i]->rph)
> + rcu_assign_pointer(rps[i]->rph->rp, NULL);
> #endif
> }
>