Removing NULL checks [LWN.net]

Removing NULL checks

Posted Jul 20, 2009 10:03 UTC (Mon) by makomk (guest, #51493)
In reply to: Removing NULL checks by darwish07
Parent article: Linux 2.6.30 exploit posted

Hopefully, that shouldn't be exploitable. I'm pretty sure the kernel
policy is that userspace shouldn't be able to trigger BUG_ONs
deliberately, so removing one in favour of just dereferencing the null
pointer ought to be safe assuming there isn't a bug elsewhere. (Of course,
if there is, it could turn it into a security vulnerability.)

(Log in to post comments)

Removing NULL checks

Posted Jul 20, 2009 12:46 UTC (Mon) by spender (subscriber, #23067) [Link]

Andrew Morton is wrong, a BUG_ON is in no way equivalent to just dereferencing a null. What if I have my page mapped at NULL?
If that author adds one more call to smack_netlabel and forgets to check for sock->sk == NULL before calling it, instead of just causing an OOPS he's now potentially created a vulnerability which can result in arbitrary code execution.

-Brad