On Tue, Jun 10, 2025, at 12:33 PM, Joel Fernandes wrote:
> On 6/10/2025 1:34 PM, Uladzislau Rezki (Sony) wrote:
>> Currently the call_rcu() API does not check whether a callback
>> pointer is NULL. If NULL is passed, rcu_core() will try to invoke
>> it, resulting in NULL pointer dereference and a kernel crash.
>>
>> To prevent this and improve debuggability, this patch adds a check
>> for NULL and emits a kernel stack trace to help identify a faulty
>> caller.
>>
>> Signed-off-by: Uladzislau Rezki (Sony) <ure...@gmail.com>
>
> Reviewed-by: Joel Fernandes <joelagn...@nvidia.com>
>
Reviewed-by: Boqun Feng <boqun.f...@gmail.com>
> I will add this first one (only this one since we're discussing the others)
> to a
> new rcu/fixes-for-6.16 branch, but let me know if any objections.
>
Not sure it’s urgent enough given the current evidence.
Regards,
Boqun
> Will push that branch out during -rc2 or -rc3 after sufficient testing.
>
> thanks,
>
> - Joel
>
>> ---
>> kernel/rcu/tree.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
>> index e8a4b720d7d2..14d4499c6fc3 100644
>> --- a/kernel/rcu/tree.c
>> +++ b/kernel/rcu/tree.c
>> @@ -3072,6 +3072,10 @@ __call_rcu_common(struct rcu_head *head,
>> rcu_callback_t func, bool lazy_in)
>> /* Misaligned rcu_head! */
>> WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
>>
>> + /* Avoid NULL dereference if callback is NULL. */
>> + if (WARN_ON_ONCE(!func))
>> + return;
>> +
>> if (debug_rcu_head_queue(head)) {
>> /*
>> * Probable double call_rcu(), so leak the callback.
