From: Juergen Gross <jgross@suse.com>
To: "Gustavo A. R. Silva" <garsilva@embeddedor.com>,
"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
"Roger Pau Monné" <roger.pau@citrix.com>
Cc: xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
Subject: Re: [Xen-devel] [block-xen-blkback] question about pontential null pointer dereference
Date: Thu, 11 May 2017 10:53:33 +0200 [thread overview]
Message-ID: <e4387fb6-9cf4-eca4-06ce-d29f300d0c7b@suse.com> (raw)
In-Reply-To: <20170510114953.Horde.7C1VjUQI-YiZdSL2tKfFVHL@gator4166.hostgator.com>
On 10/05/17 18:49, Gustavo A. R. Silva wrote:
>
> Hello everybody,
>
> While looking into Coverity ID 1350942 I ran into the following piece of
> code at drivers/block/xen-blkback/xenbus.c:490:
>
> 490static int xen_blkbk_remove(struct xenbus_device *dev)
> 491{
> 492 struct backend_info *be = dev_get_drvdata(&dev->dev);
> 493
> 494 pr_debug("%s %p %d\n", __func__, dev, dev->otherend_id);
> 495
> 496 if (be->major || be->minor)
> 497 xenvbd_sysfs_delif(dev);
> 498
> 499 if (be->backend_watch.node) {
> 500 unregister_xenbus_watch(&be->backend_watch);
> 501 kfree(be->backend_watch.node);
> 502 be->backend_watch.node = NULL;
> 503 }
> 504
> 505 dev_set_drvdata(&dev->dev, NULL);
> 506
> 507 if (be->blkif)
> 508 xen_blkif_disconnect(be->blkif);
> 509
> 510 /* Put the reference we set in xen_blkif_alloc(). */
> 511 xen_blkif_put(be->blkif);
> 512 kfree(be->mode);
> 513 kfree(be);
> 514 return 0;
> 515}
>
> The issue here is that line 507 implies that be->blkif might be NULL. If
> this is the case, there is a NULL pointer dereference when executing
> line 511 once macro xen_blkif_put() dereference be->blkif
>
> Is there any chance for be->blkif to be NULL at line 511?
Yes. xen_blkbk_probe() will call xen_blkbk_remove() with be->blkif being
NULL in the failure path.
The call to xen_blkif_put() should be guarded by the "if (be->blkif)" of
line 507, too.
Juergen
next prev parent reply other threads:[~2017-05-11 8:53 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-10 16:49 [block-xen-blkback] question about pontential null pointer dereference Gustavo A. R. Silva
2017-05-11 8:53 ` Juergen Gross
2017-05-11 8:53 ` Juergen Gross [this message]
2017-05-11 15:05 ` [Xen-devel] " Gustavo A. R. Silva
2017-05-11 15:05 ` Gustavo A. R. Silva
2017-05-11 15:27 ` [PATCH] block: xen-blkback: add null check to avoid " Gustavo A. R. Silva
2017-05-11 15:27 ` Gustavo A. R. Silva
2017-05-15 21:18 ` Konrad Rzeszutek Wilk
2017-05-15 21:18 ` Konrad Rzeszutek Wilk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e4387fb6-9cf4-eca4-06ce-d29f300d0c7b@suse.com \
--to=jgross@suse.com \
--cc=garsilva@embeddedor.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=roger.pau@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.