* [PATCH v2] pvcalls-front: fix potential null dereference
@ 2019-01-15 2:31 Wen Yang
2019-01-15 17:04 ` Boris Ostrovsky
0 siblings, 1 reply; 2+ messages in thread
From: Wen Yang @ 2019-01-15 2:31 UTC (permalink / raw)
To: boris.ostrovsky
Cc: jgross, sstabellini, xen-devel, linux-kernel, xue.zhihong,
wang.yi59, Wen Yang, Dan Carpenter
static checker warning:
drivers/xen/pvcalls-front.c:373 alloc_active_ring()
error: we previously assumed 'map->active.ring' could be null
(see line 357)
drivers/xen/pvcalls-front.c
351 static int alloc_active_ring(struct sock_mapping *map)
352 {
353 void *bytes;
354
355 map->active.ring = (struct pvcalls_data_intf *)
356 get_zeroed_page(GFP_KERNEL);
357 if (!map->active.ring)
^^^^^^^^^^^^^^^^^
Check
358 goto out;
359
360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
362 PVCALLS_RING_ORDER);
363 if (!bytes)
364 goto out;
365
366 map->active.data.in = bytes;
367 map->active.data.out = bytes +
368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
369
370 return 0;
371
372 out:
--> 373 free_active_ring(map);
^^^
Add null check on map->active.ring before dereferencing it to avoid
any NULL pointer dereferences.
Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL)
under spinlock")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
CC: Juergen Gross <jgross@suse.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Dan Carpenter <dan.carpenter@oracle.com>
CC: xen-devel@lists.xenproject.org
CC: linux-kernel@vger.kernel.org
---
v2->v1:
- Add NULL check on map->active.ring and return
immediately if it is.
drivers/xen/pvcalls-front.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 307861f..8a249c9 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock)
static void free_active_ring(struct sock_mapping *map)
{
+ if (!map->active.ring)
+ return;
+
free_pages((unsigned long)map->active.data.in,
map->active.ring->ring_order);
free_page((unsigned long)map->active.ring);
--
2.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] pvcalls-front: fix potential null dereference
2019-01-15 2:31 [PATCH v2] pvcalls-front: fix potential null dereference Wen Yang
@ 2019-01-15 17:04 ` Boris Ostrovsky
0 siblings, 0 replies; 2+ messages in thread
From: Boris Ostrovsky @ 2019-01-15 17:04 UTC (permalink / raw)
To: Wen Yang
Cc: jgross, sstabellini, xen-devel, linux-kernel, xue.zhihong,
wang.yi59, Dan Carpenter
On 1/14/19 9:31 PM, Wen Yang wrote:
> static checker warning:
> drivers/xen/pvcalls-front.c:373 alloc_active_ring()
> error: we previously assumed 'map->active.ring' could be null
> (see line 357)
>
> drivers/xen/pvcalls-front.c
> 351 static int alloc_active_ring(struct sock_mapping *map)
> 352 {
> 353 void *bytes;
> 354
> 355 map->active.ring = (struct pvcalls_data_intf *)
> 356 get_zeroed_page(GFP_KERNEL);
> 357 if (!map->active.ring)
> ^^^^^^^^^^^^^^^^^
> Check
>
> 358 goto out;
> 359
> 360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
> 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
> 362 PVCALLS_RING_ORDER);
> 363 if (!bytes)
> 364 goto out;
> 365
> 366 map->active.data.in = bytes;
> 367 map->active.data.out = bytes +
> 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
> 369
> 370 return 0;
> 371
> 372 out:
> --> 373 free_active_ring(map);
> ^^^
> Add null check on map->active.ring before dereferencing it to avoid
> any NULL pointer dereferences.
>
> Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL)
> under spinlock")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
> CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> CC: Juergen Gross <jgross@suse.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: Dan Carpenter <dan.carpenter@oracle.com>
> CC: xen-devel@lists.xenproject.org
> CC: linux-kernel@vger.kernel.org
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Applied to for-linus-4.21.
> ---
> v2->v1:
> - Add NULL check on map->active.ring and return
> immediately if it is.
>
> drivers/xen/pvcalls-front.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
> index 307861f..8a249c9 100644
> --- a/drivers/xen/pvcalls-front.c
> +++ b/drivers/xen/pvcalls-front.c
> @@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock)
>
> static void free_active_ring(struct sock_mapping *map)
> {
> + if (!map->active.ring)
> + return;
> +
> free_pages((unsigned long)map->active.data.in,
> map->active.ring->ring_order);
> free_page((unsigned long)map->active.ring);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-01-15 17:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-15 2:31 [PATCH v2] pvcalls-front: fix potential null dereference Wen Yang
2019-01-15 17:04 ` Boris Ostrovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).