[PATCH] tracepoints: prevents null probe from being added

[kpark3469]

From: Sahara <keun-o.park@xxxxxxxxxxxxx>

Somehow tracepoint_entry_add/remove_probe functions allow a null probe
function. Especially on getting a null probe in remove function, it seems
to be used to remove all probe functions in the entry.
But, the code is not handled as expected. Since the tracepoint_entry
maintains funcs array's last func as NULL in order to mark it as the end
of the array. Also NULL func is used in for-loop to check out the end of
the loop. So if there's NULL func in the entry's funcs, the for-loop
will be abruptly ended in the middle of operation.
Also checking out if probe is null in for-loop is not efficient.

Signed-off-by: Sahara <keun-o.park@xxxxxxxxxxxxx>
---
 kernel/tracepoint.c |   18 ++++++++++++------
 1 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 0c05a45..30f427e 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -112,7 +112,10 @@ tracepoint_entry_add_probe(struct tracepoint_entry *entry,
 	int nr_probes = 0;
 	struct tracepoint_func *old, *new;
 
-	WARN_ON(!probe);
+	if (unlikely(!probe)) {
+		WARN_ON(!probe);
+		return ERR_PTR(-EINVAL);
+	}
 
 	debug_print_probes(entry);
 	old = entry->funcs;
@@ -147,15 +150,19 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
 
 	old = entry->funcs;
 
+	if (unlikely(!probe)) {
+		WARN_ON(!probe);
+		return ERR_PTR(-EINVAL);
+	}
+
 	if (!old)
 		return ERR_PTR(-ENOENT);
 
 	debug_print_probes(entry);
 	/* (N -> M), (N > 1, M >= 0) probes */
 	for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
-		if (!probe ||
-		    (old[nr_probes].func == probe &&
-		     old[nr_probes].data == data))
+		if (old[nr_probes].func == probe &&
+		     old[nr_probes].data == data)
 			nr_del++;
 	}
 
@@ -173,8 +180,7 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry,
 		if (new == NULL)
 			return ERR_PTR(-ENOMEM);
 		for (i = 0; old[i].func; i++)
-			if (probe &&
-			    (old[i].func != probe || old[i].data != data))
+			if (old[i].func != probe || old[i].data != data)
 				new[j++] = old[i];
 		new[nr_probes - nr_del].func = NULL;
 		entry->refcount = nr_probes - nr_del;
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/