From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BBDF2C4332F for ; Tue, 8 Nov 2022 19:09:46 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1osTyI-0002JU-6Z; Tue, 08 Nov 2022 14:09:18 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1osTyG-0002HH-Jj; Tue, 08 Nov 2022 14:09:16 -0500 Received: from forwardcorp1b.mail.yandex.net ([178.154.239.136]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1osTyE-0003uv-Tw; Tue, 08 Nov 2022 14:09:16 -0500 Received: from sas1-c73b4b4f4b95.qloud-c.yandex.net (sas1-c73b4b4f4b95.qloud-c.yandex.net [IPv6:2a02:6b8:c08:12a9:0:640:c73b:4b4f]) by forwardcorp1b.mail.yandex.net (Yandex) with ESMTP id 20BA95DC24; Tue, 8 Nov 2022 22:08:53 +0300 (MSK) Received: from [IPV6:2a02:6b8:b081:b535::1:28] (unknown [2a02:6b8:b081:b535::1:28]) by sas1-c73b4b4f4b95.qloud-c.yandex.net (smtpcorp/Yandex) with ESMTPSA id BVLZF4HDCB-8nOO3UWH; Tue, 08 Nov 2022 22:08:52 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1667934532; bh=6bYyNMKD76SEKwEV9OFQWnabfGqL5+o5DH83VU7IYOM=; h=From:In-Reply-To:Cc:Date:References:To:Subject:Message-ID; b=wamXqSBKX9LB6UvPIqp8IafZUsh/zkWjGDbwqtbTp3II9enzmy/+ufRI9EJkLomxR XcTWyrDF9Ij9jom0F/Wbo839/FhXHJwiI/yoi+n/zkchpOYo0SKcgK8kfMg26A4Tqh 8ZHp0Wp5klnUoWbPZcjDiO0qGiehRzSX7oh5AdRg= Authentication-Results: sas1-c73b4b4f4b95.qloud-c.yandex.net; dkim=pass header.i=@yandex-team.ru Message-ID: <1d2774c6-3108-c236-d31c-8aa58ffdf427@yandex-team.ru> Date: Tue, 8 Nov 2022 22:08:49 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2 Subject: Re: [PATCH v3 06/17] vfio/migration: Fix NULL pointer dereference bug Content-Language: en-US To: Avihai Horon , qemu-devel@nongnu.org Cc: Alex Williamson , Halil Pasic , Christian Borntraeger , Eric Farman , Richard Henderson , David Hildenbrand , Ilya Leoshkevich , Thomas Huth , Juan Quintela , "Dr. David Alan Gilbert" , "Michael S. Tsirkin" , Cornelia Huck , Paolo Bonzini , Stefan Hajnoczi , Fam Zheng , Eric Blake , John Snow , qemu-s390x@nongnu.org, qemu-block@nongnu.org, Kunkun Jiang , "Zhang, Chen" , Yishai Hadas , Jason Gunthorpe , Maor Gottlieb , Shay Drory , Kirti Wankhede , Tarun Gupta , Joao Martins References: <20221103161620.13120-1-avihaih@nvidia.com> <20221103161620.13120-7-avihaih@nvidia.com> From: Vladimir Sementsov-Ogievskiy In-Reply-To: <20221103161620.13120-7-avihaih@nvidia.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Received-SPF: pass client-ip=178.154.239.136; envelope-from=vsementsov@yandex-team.ru; helo=forwardcorp1b.mail.yandex.net X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org On 11/3/22 19:16, Avihai Horon wrote: > As part of its error flow, vfio_vmstate_change() accesses > MigrationState->to_dst_file without any checks. This can cause a NULL > pointer dereference if the error flow is taken and > MigrationState->to_dst_file is not set. > > For example, this can happen if VM is started or stopped not during > migration and vfio_vmstate_change() error flow is taken, as > MigrationState->to_dst_file is not set at that time. > > Fix it by checking that MigrationState->to_dst_file is set before using > it. > > Fixes: 02a7e71b1e5b ("vfio: Add VM state change handler to know state of VM") > Signed-off-by: Avihai Horon > Reviewed-by: Juan Quintela Reviewed-by: Vladimir Sementsov-Ogievskiy -- Best regards, Vladimir