* [PATCH] virtiofsd: Fix potential NULL pointer dereference in virtio_send_msg()
@ 2020-12-10 15:14 Alex Chen
2020-12-10 18:00 ` Dr. David Alan Gilbert
0 siblings, 1 reply; 3+ messages in thread
From: Alex Chen @ 2020-12-10 15:14 UTC (permalink / raw)
To: dgilbert, stefanha
Cc: alex.chen, qemu-trivial, qemu-devel, zhang.zhanghailiang
The 'ch' will be NULL in the following stack:
send_notify_iov()->fuse_send_msg()->virtio_send_msg(),
so we should check 'ch' is valid before dereferencing it
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
tools/virtiofsd/fuse_virtio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
index 623812c432..31b2187a15 100644
--- a/tools/virtiofsd/fuse_virtio.c
+++ b/tools/virtiofsd/fuse_virtio.c
@@ -205,6 +205,8 @@ static void copy_iov(struct iovec *src_iov, int src_count,
int virtio_send_msg(struct fuse_session *se, struct fuse_chan *ch,
struct iovec *iov, int count)
{
+ assert(ch);
+
FVRequest *req = container_of(ch, FVRequest, ch);
struct fv_QueueInfo *qi = ch->qi;
VuDev *dev = &se->virtio_dev->dev;
--
2.19.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] virtiofsd: Fix potential NULL pointer dereference in virtio_send_msg()
2020-12-10 15:14 [PATCH] virtiofsd: Fix potential NULL pointer dereference in virtio_send_msg() Alex Chen
@ 2020-12-10 18:00 ` Dr. David Alan Gilbert
2020-12-11 10:16 ` Alex Chen
0 siblings, 1 reply; 3+ messages in thread
From: Dr. David Alan Gilbert @ 2020-12-10 18:00 UTC (permalink / raw)
To: Alex Chen; +Cc: qemu-trivial, qemu-devel, stefanha, zhang.zhanghailiang
* Alex Chen (alex.chen@huawei.com) wrote:
> The 'ch' will be NULL in the following stack:
> send_notify_iov()->fuse_send_msg()->virtio_send_msg(),
> so we should check 'ch' is valid before dereferencing it
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Alex Chen <alex.chen@huawei.com>
Please check, but I don't think we can currently hit this because
we never call send_notify_iov - it's currently called by
fuse_lowlevel_notify_inval_entry, inval_inode, and
fuse_lowlevel_notify_poll -
but I don't think those are called anywhere.
In that case, probably the best fix is to remove those until we
put notify back in.
Dave
> ---
> tools/virtiofsd/fuse_virtio.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
> index 623812c432..31b2187a15 100644
> --- a/tools/virtiofsd/fuse_virtio.c
> +++ b/tools/virtiofsd/fuse_virtio.c
> @@ -205,6 +205,8 @@ static void copy_iov(struct iovec *src_iov, int src_count,
> int virtio_send_msg(struct fuse_session *se, struct fuse_chan *ch,
> struct iovec *iov, int count)
> {
> + assert(ch);
> +
> FVRequest *req = container_of(ch, FVRequest, ch);
> struct fv_QueueInfo *qi = ch->qi;
> VuDev *dev = &se->virtio_dev->dev;
> --
> 2.19.1
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] virtiofsd: Fix potential NULL pointer dereference in virtio_send_msg()
2020-12-10 18:00 ` Dr. David Alan Gilbert
@ 2020-12-11 10:16 ` Alex Chen
0 siblings, 0 replies; 3+ messages in thread
From: Alex Chen @ 2020-12-11 10:16 UTC (permalink / raw)
To: Dr. David Alan Gilbert
Cc: qemu-trivial, qemu-devel, stefanha, zhang.zhanghailiang
Hi Dave,
On 2020/12/11 2:00, Dr. David Alan Gilbert wrote:
> * Alex Chen (alex.chen@huawei.com) wrote:
>> The 'ch' will be NULL in the following stack:
>> send_notify_iov()->fuse_send_msg()->virtio_send_msg(),
>> so we should check 'ch' is valid before dereferencing it
>>
>> Reported-by: Euler Robot <euler.robot@huawei.com>
>> Signed-off-by: Alex Chen <alex.chen@huawei.com>
>
> Please check, but I don't think we can currently hit this because
> we never call send_notify_iov - it's currently called by
> fuse_lowlevel_notify_inval_entry, inval_inode, and
> fuse_lowlevel_notify_poll -
> but I don't think those are called anywhere.
>
Thanks for your review.
The send_notify_iov() is really not being called.
> In that case, probably the best fix is to remove those until we
> put notify back in.
>
OK, I will remove those temporarily useless code and send patch v2 to fix this problem.
Thanks,
Alex
> Dave
>
>> ---
>> tools/virtiofsd/fuse_virtio.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
>> index 623812c432..31b2187a15 100644
>> --- a/tools/virtiofsd/fuse_virtio.c
>> +++ b/tools/virtiofsd/fuse_virtio.c
>> @@ -205,6 +205,8 @@ static void copy_iov(struct iovec *src_iov, int src_count,
>> int virtio_send_msg(struct fuse_session *se, struct fuse_chan *ch,
>> struct iovec *iov, int count)
>> {
>> + assert(ch);
>> +
>> FVRequest *req = container_of(ch, FVRequest, ch);
>> struct fv_QueueInfo *qi = ch->qi;
>> VuDev *dev = &se->virtio_dev->dev;
>> --
>> 2.19.1
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-12-11 10:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-10 15:14 [PATCH] virtiofsd: Fix potential NULL pointer dereference in virtio_send_msg() Alex Chen
2020-12-10 18:00 ` Dr. David Alan Gilbert
2020-12-11 10:16 ` Alex Chen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.