diff options
author | Frederic Weisbecker <fweisbec@gmail.com> | 2008-10-22 13:14:55 -0400 |
---|---|---|
committer | Ingo Molnar <mingo@elte.hu> | 2008-10-27 11:45:46 -0400 |
commit | f66af459a931f25807e1df7915b2b66bb5978d82 (patch) | |
tree | bb88917429fe1ea4f6d6e088ead040b25d205a86 | |
parent | 5209f08dc8e5f520ca81b87fa9a7142f58a109f4 (diff) |
tracepoint: check if the probe has been registered
Impact: fix kernel crash that can trigger during tracing
If we try to remove a probe that has not been already registered,
the tracepoint_entry_remove_probe() function will dereference a NULL
pointer.
Check the probe before removing it to avoid crashes.
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Acked-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Acked-by: Steven Rostedt <srostedt@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
-rw-r--r-- | kernel/tracepoint.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index f2b7c28a4708..af8c85664882 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c | |||
@@ -131,6 +131,9 @@ tracepoint_entry_remove_probe(struct tracepoint_entry *entry, void *probe) | |||
131 | 131 | ||
132 | old = entry->funcs; | 132 | old = entry->funcs; |
133 | 133 | ||
134 | if (!old) | ||
135 | return NULL; | ||
136 | |||
134 | debug_print_probes(entry); | 137 | debug_print_probes(entry); |
135 | /* (N -> M), (N > 1, M >= 0) probes */ | 138 | /* (N -> M), (N > 1, M >= 0) probes */ |
136 | for (nr_probes = 0; old[nr_probes]; nr_probes++) { | 139 | for (nr_probes = 0; old[nr_probes]; nr_probes++) { |
@@ -388,6 +391,11 @@ int tracepoint_probe_unregister(const char *name, void *probe) | |||
388 | if (entry->rcu_pending) | 391 | if (entry->rcu_pending) |
389 | rcu_barrier_sched(); | 392 | rcu_barrier_sched(); |
390 | old = tracepoint_entry_remove_probe(entry, probe); | 393 | old = tracepoint_entry_remove_probe(entry, probe); |
394 | if (!old) { | ||
395 | printk(KERN_WARNING "Warning: Trying to unregister a probe" | ||
396 | "that doesn't exist\n"); | ||
397 | goto end; | ||
398 | } | ||
391 | mutex_unlock(&tracepoints_mutex); | 399 | mutex_unlock(&tracepoints_mutex); |
392 | tracepoint_update_probes(); /* may update entry */ | 400 | tracepoint_update_probes(); /* may update entry */ |
393 | mutex_lock(&tracepoints_mutex); | 401 | mutex_lock(&tracepoints_mutex); |