lkml.org 
[lkml]   [2019]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 078/152] pvcalls-front: fix potential null dereference
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit b4711098066f1cf808d4dc11a1a842860a3292fe ]

    static checker warning:
    drivers/xen/pvcalls-front.c:373 alloc_active_ring()
    error: we previously assumed 'map->active.ring' could be null
    (see line 357)

    drivers/xen/pvcalls-front.c
    351 static int alloc_active_ring(struct sock_mapping *map)
    352 {
    353 void *bytes;
    354
    355 map->active.ring = (struct pvcalls_data_intf *)
    356 get_zeroed_page(GFP_KERNEL);
    357 if (!map->active.ring)
    ^^^^^^^^^^^^^^^^^
    Check

    358 goto out;
    359
    360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
    361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
    362 PVCALLS_RING_ORDER);
    363 if (!bytes)
    364 goto out;
    365
    366 map->active.data.in = bytes;
    367 map->active.data.out = bytes +
    368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
    369
    370 return 0;
    371
    372 out:
    --> 373 free_active_ring(map);
    ^^^
    Add null check on map->active.ring before dereferencing it to avoid
    any NULL pointer dereferences.

    Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    CC: Juergen Gross <jgross@suse.com>
    CC: Stefano Stabellini <sstabellini@kernel.org>
    CC: Dan Carpenter <dan.carpenter@oracle.com>
    CC: xen-devel@lists.xenproject.org
    CC: linux-kernel@vger.kernel.org
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/xen/pvcalls-front.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
    index 6357160d466ab..91da7e44d5d4f 100644
    --- a/drivers/xen/pvcalls-front.c
    +++ b/drivers/xen/pvcalls-front.c
    @@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock)

    static void free_active_ring(struct sock_mapping *map)
    {
    + if (!map->active.ring)
    + return;
    +
    free_pages((unsigned long)map->active.data.in,
    map->active.ring->ring_order);
    free_page((unsigned long)map->active.ring);
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-02-25 22:51    [W:2.405 / U:0.276 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site