Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Removing NULL checks

Posted Jul 18, 2009 19:09 UTC (Sat) by darwish07 (subscriber, #49520)
In reply to: Removing NULL checks by corbet
Parent article: Linux 2.6.30 exploit posted

You have a nice memory: I remember being advised to strip a BUG_ON line since the kernel OOPS mechanism will handle it - http://lkml.org/lkml/2008/2/13/71

I'm not sure if (or how) can this be exploited though ...

(Log in to post comments)

Posted Jul 20, 2009 10:03 UTC (Mon) by makomk (guest, #51493) [Link]

Hopefully, that shouldn't be exploitable. I'm pretty sure the kernel
policy is that userspace shouldn't be able to trigger BUG_ONs
deliberately, so removing one in favour of just dereferencing the null
pointer ought to be safe assuming there isn't a bug elsewhere. (Of course,
if there is, it could turn it into a security vulnerability.)

Removing NULL checks

Posted Jul 20, 2009 12:46 UTC (Mon) by spender (subscriber, #23067) [Link]

Andrew Morton is wrong, a BUG_ON is in no way equivalent to just dereferencing a null. What if I have my page mapped at NULL?
If that author adds one more call to smack_netlabel and forgets to check for sock->sk == NULL before calling it, instead of just causing an OOPS he's now potentially created a vulnerability which can result in arbitrary code execution.

-Brad