* potential null pointer dereference in setup_cpuid_table
@ 2023-07-27 14:22 Colin King (gmail)
2023-08-07 20:57 ` Borislav Petkov
0 siblings, 1 reply; 2+ messages in thread
From: Colin King (gmail) @ 2023-07-27 14:22 UTC (permalink / raw)
To: Michael Roth; +Cc: Brijesh Singh, Borislav Petkov, x86, linux-kernel
Hi,
Static analysis with cppcheck found a potential null pointer dereference
in function setup_cpuid_table in arch/x86/kernel/sev-shared.c as follows:
if (!cc_info || !cc_info->cpuid_phys || cc_info->cpuid_len <
PAGE_SIZE)
sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_CPUID);
cpuid_table_fw = (const struct snp_cpuid_table
*)cc_info->cpuid_phys;
cc_info is being null checked, so it's potentially null, however, the
assignment to cpuid_table_fw is dereferencing cc_info. Either cc_info is
never null and the null check is redundant, or there is a potential null
pointer dereference.
Colin
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: potential null pointer dereference in setup_cpuid_table
2023-07-27 14:22 potential null pointer dereference in setup_cpuid_table Colin King (gmail)
@ 2023-08-07 20:57 ` Borislav Petkov
0 siblings, 0 replies; 2+ messages in thread
From: Borislav Petkov @ 2023-08-07 20:57 UTC (permalink / raw)
To: Colin King (gmail)
Cc: Michael Roth, Brijesh Singh, Borislav Petkov, x86, linux-kernel
On Thu, Jul 27, 2023 at 03:22:42PM +0100, Colin King (gmail) wrote:
> Hi,
>
> Static analysis with cppcheck found a potential null pointer dereference in
> function setup_cpuid_table in arch/x86/kernel/sev-shared.c as follows:
>
> if (!cc_info || !cc_info->cpuid_phys || cc_info->cpuid_len <
> PAGE_SIZE)
> sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_CPUID);
>
> cpuid_table_fw = (const struct snp_cpuid_table
> *)cc_info->cpuid_phys;
>
>
> cc_info is being null checked, so it's potentially null,
You mean, it is not null if the check passes?
> however, the assignment to cpuid_table_fw is dereferencing cc_info.
> Either cc_info is never null and the null check is redundant, or there
> is a potential null pointer dereference.
I'm not sure what you're asking. It is checked for !NULL in the if
clause.
Or are you missing the fact that sev_es_terminate() actually terminates
the guest so that if it is NULL, it won't ever be dereferenced?
Or am I missing something?
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-08-07 20:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-27 14:22 potential null pointer dereference in setup_cpuid_table Colin King (gmail)
2023-08-07 20:57 ` Borislav Petkov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.