From: Wen Yang <wen.yang99@zte.com.cn>
To: boris.ostrovsky@oracle.com
Cc: jgross@suse.com, sstabellini@kernel.org,
xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org,
xue.zhihong@zte.com.cn, wang.yi59@zte.com.cn,
Wen Yang <wen.yang99@zte.com.cn>,
Dan Carpenter <dan.carpenter@oracle.com>
Subject: [PATCH] pvcalls-front: fix potential null dereference
Date: Mon, 14 Jan 2019 11:20:23 +0800 [thread overview]
Message-ID: <1547436023-5797-1-git-send-email-wen.yang99@zte.com.cn> (raw)
static checker warning:
drivers/xen/pvcalls-front.c:373 alloc_active_ring()
error: we previously assumed 'map->active.ring' could be null
(see line 357)
drivers/xen/pvcalls-front.c
351 static int alloc_active_ring(struct sock_mapping *map)
352 {
353 void *bytes;
354
355 map->active.ring = (struct pvcalls_data_intf *)
356 get_zeroed_page(GFP_KERNEL);
357 if (!map->active.ring)
^^^^^^^^^^^^^^^^^
Check
358 goto out;
359
360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
362 PVCALLS_RING_ORDER);
363 if (!bytes)
364 goto out;
365
366 map->active.data.in = bytes;
367 map->active.data.out = bytes +
368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
369
370 return 0;
371
372 out:
--> 373 free_active_ring(map);
^^^
Replace map->active.ring->ring_order with PVCALLS_RING_ORDER
to avoid potential null dereference.
Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL)
under spinlock")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
CC: Juergen Gross <jgross@suse.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Dan Carpenter <dan.carpenter@oracle.com>
CC: xen-devel@lists.xenproject.org
CC: linux-kernel@vger.kernel.org
---
drivers/xen/pvcalls-front.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 307861f..e56f9a3 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -344,7 +344,7 @@ int pvcalls_front_socket(struct socket *sock)
static void free_active_ring(struct sock_mapping *map)
{
free_pages((unsigned long)map->active.data.in,
- map->active.ring->ring_order);
+ PVCALLS_RING_ORDER);
free_page((unsigned long)map->active.ring);
}
--
2.9.5
next reply other threads:[~2019-01-14 3:21 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-14 3:20 Wen Yang [this message]
2019-01-14 16:16 ` [PATCH] pvcalls-front: fix potential null dereference Boris Ostrovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1547436023-5797-1-git-send-email-wen.yang99@zte.com.cn \
--to=wen.yang99@zte.com.cn \
--cc=boris.ostrovsky@oracle.com \
--cc=dan.carpenter@oracle.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sstabellini@kernel.org \
--cc=wang.yi59@zte.com.cn \
--cc=xen-devel@lists.xenproject.org \
--cc=xue.zhihong@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).