Skip to content
  • Masami Hiramatsu's avatar
    x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception · 285a54ef
    Masami Hiramatsu authored
    ftracetest testcase hits the following NULL pointer
     BUG: kernel NULL pointer dereference, address: 0000000000000000
     PGD 800000007bf60067 P4D 800000007bf60067 PUD 7bf5f067 PMD 0
     Oops: 0000 [#1] PREEMPT SMP PTI
     RIP: 0010:poke_int3_handler+0x39/0x100
     Call Trace:
      RIP: 0010:sched_clock+0x6/0x10
    poke_int3_handler+0x39 was alternatives:958:
      static inline void *text_poke_addr(struct text_poke_loc *tp)
              return _stext + tp->rel_addr; <------ Here is line #958
    This seems to be caused by tp (bp_patching.vec) being NULL but
    bp_patching.nr_entries != 0. There is a small chance for this
    to happen, because we have no synchronization between the zeroing
    of bp_patching.nr_entries and before clearing bp_patching.vec.
    Steve suggested we could fix this by adding sync_core(), because int3
    is done with interrupts disabled, and the on_each_cpu() requires
    all CPUs to have had their interrupts enabled.
     [ mingo: Edited the comments and the changelog. ]
    Suggested-by: default avatarSteven Rostedt (VMware) <>
    Tested-by: default avatarAlexei Starovoitov <>
    Signed-off-by: default avatarMasami Hiramatsu <>
    Cc: Andy Lutomirski <>
    Cc: Borislav Petkov <>
    Cc: Linus Torvalds <>
    Cc: Peter Zijlstra <>
    Cc: Thomas Gleixner <>
    Fixes: c0213b0a ("x86/alternative: Batch of patch operations")
    Signed-off-by: default avatarIngo Molnar <>