lkml.org 
[lkml]   [2010]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [PATCH] module param_call: fix potential NULL pointer dereference
From
On Sun, Feb 21, 2010 at 3:24 PM, Dongdong Deng
<dongdong.deng@windriver.com> wrote:
> The param_set_fn() function will get a parameter which is a NULL
> pointer when insmod module with params via following method:
>
> $insmod module.ko module_params
>
> BTW: the normal method usually as following format:
> $insmod module.ko module_params=example
>
> If the param_set_fn() function didn't check that parameter and used
> it directly, it could caused an OOPS due to NULL pointer dereference.
>
> The solution is simple:
> Just checking the parameter before using in param_set_fn().
>
> Example:
> int set_module_params(const char *val, struct kernel_param *kp)
> {
>        /*Checking the val parameter before using */
>        if (!val)
>                return -EINVAL;
>        ...
> }
> module_param_call(module_params, set_module_params, NULL, NULL, 0644);
>

Why not just checking all of them in the generic code?
How about my _untested_ patch below?

Thanks.

-----------

When a module parameter "foo" is not bool, we shouldn't accept arguments
like this "insmod ./foo.ko foo". However, currently only standard
->set functions
check this, several non-standard ->set functions ignore this, thus could cause
NULL def oops.

Reported-by: Dongdong Deng <dongdong.deng@windriver.com>
Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com>

---
diff --git a/kernel/params.c b/kernel/params.c
index cf1b691..84a1466 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -59,6 +59,8 @@ static int parse_one(char *param,
/* Find parameter */
for (i = 0; i < num_params; i++) {
if (parameq(param, params[i].name)) {
+ if ((!params[i].flags & KPARAM_ISBOOL) && !val)
+ return -EINVAL;
DEBUGP("They are equal! Calling %p\n",
params[i].set);
return params[i].set(val, &params[i]);
\
 
 \ /
  Last update: 2010-02-21 09:45    [W:0.048 / U:1.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site