[PATCH 1/2] KVM: PPC: e500: fix some NULL dereferences on error

[PATCH 1/2] KVM: PPC: e500: fix some NULL dereferences on error

[Dan Carpenter]

There are some error paths in kvmppc_core_vcpu_create_e500() where we
forget to set the error code.  It means that we return ERR_PTR(0) which
is NULL and it results in a NULL pointer dereference in the caller.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c
index 32fdab57d604..f9f6468f4171 100644
--- a/arch/powerpc/kvm/e500.c
+++ b/arch/powerpc/kvm/e500.c
@@ -455,16 +455,20 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_e500(struct kvm *kvm,
 	if (err)
 		goto free_vcpu;
 
-	if (kvmppc_e500_id_table_alloc(vcpu_e500) == NULL)
+	if (kvmppc_e500_id_table_alloc(vcpu_e500) == NULL) {
+		err = -ENOMEM;
 		goto uninit_vcpu;
+	}
 
 	err = kvmppc_e500_tlb_init(vcpu_e500);
 	if (err)
 		goto uninit_id;
 
 	vcpu->arch.shared = (void*)__get_free_page(GFP_KERNEL|__GFP_ZERO);
-	if (!vcpu->arch.shared)
+	if (!vcpu->arch.shared) {
+		err = -ENOMEM;
 		goto uninit_tlb;
+	}
 
 	return vcpu;
 

Re: [PATCH 1/2] KVM: PPC: e500: fix some NULL dereferences on error

[Paul Mackerras]

On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote:
> There are some error paths in kvmppc_core_vcpu_create_e500() where we
> forget to set the error code.  It means that we return ERR_PTR(0) which
> is NULL and it results in a NULL pointer dereference in the caller.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Are these user-triggerable, and therefore needing to go into 4.13
and be back-ported to the stable trees?  Or can they wait for 4.14?

Paul.

Re: [PATCH 1/2] KVM: PPC: e500: fix some NULL dereferences on error

[Dan Carpenter]

On Mon, Jul 31, 2017 at 04:03:40PM +1000, Paul Mackerras wrote:
> On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote:
> > There are some error paths in kvmppc_core_vcpu_create_e500() where we
> > forget to set the error code.  It means that we return ERR_PTR(0) which
> > is NULL and it results in a NULL pointer dereference in the caller.
> > 
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Are these user-triggerable, and therefore needing to go into 4.13
> and be back-ported to the stable trees?  Or can they wait for 4.14?
> 

These are static checker fixes...  I imagine that they might be user
triggerable with quite a bit of work but it's a only NULL derefence.

regards,
dan carpenter

Re: [PATCH 1/2] KVM: PPC: e500: fix some NULL dereferences on error

[Paul Mackerras]

On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote:
> There are some error paths in kvmppc_core_vcpu_create_e500() where we
> forget to set the error code.  It means that we return ERR_PTR(0) which
> is NULL and it results in a NULL pointer dereference in the caller.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, both patches applied to my kvm-ppc-next branch.

Paul.