linux-kernel - Re: [PATCH] virt/lib avoids oops by adding parameter checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Aug 2017 15:39:04 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     nixiaoming <nixiaoming@...wei.com>, alex.williamson@...hat.com
Cc:     kvm@...r.kernel.org, linux-api@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] virt/lib avoids oops by adding parameter checking

On 22/08/2017 03:07, nixiaoming wrote:
> The error parameter passed through the external interface
> causes the system oops. So it is necessary to increase the
> parameter check for all EXPORT_SYMBOL_GPL
> 
> example:
>  int irq_bypass_register_producer(struct irq_bypass_producer *producer)
>  {
>  	if (!producer->token) /* oops if producer == null */
>  		return -einval;
>  }
>  EXPORT_SYMBOL_GPL(irq_bypass_register_producer);

This is used like this:

drivers/vfio/pci/vfio_pci_intrs.c:		irq_bypass_unregister_producer(&vdev->ctx[vector].producer);
drivers/vfio/pci/vfio_pci_intrs.c:	ret = irq_bypass_register_producer(&vdev->ctx[vector].producer);
virt/kvm/eventfd.c:	irq_bypass_unregister_consumer(&irqfd->consumer);
virt/kvm/eventfd.c:		ret = irq_bypass_register_consumer(&irqfd->consumer);

So your check won't actually catch irqfd or vdev being NULL.

Paolo

> Signed-off-by: nixiaoming <nixiaoming@...wei.com>
> ---
>  virt/lib/irqbypass.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/virt/lib/irqbypass.c b/virt/lib/irqbypass.c
> index 6d2fcd6..2bb99e8 100644
> --- a/virt/lib/irqbypass.c
> +++ b/virt/lib/irqbypass.c
> @@ -89,7 +89,7 @@ int irq_bypass_register_producer(struct irq_bypass_producer *producer)
>  	struct irq_bypass_producer *tmp;
>  	struct irq_bypass_consumer *consumer;
>  
> -	if (!producer->token)
> +	if (!producer || !producer->token)
>  		return -EINVAL;
>  
>  	might_sleep();
> @@ -139,7 +139,7 @@ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer)
>  	struct irq_bypass_producer *tmp;
>  	struct irq_bypass_consumer *consumer;
>  
> -	if (!producer->token)
> +	if (!producer || !producer->token)
>  		return;
>  
>  	might_sleep();
> @@ -183,7 +183,7 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer)
>  	struct irq_bypass_consumer *tmp;
>  	struct irq_bypass_producer *producer;
>  
> -	if (!consumer->token ||
> +	if (!consumer || !consumer->token ||
>  	    !consumer->add_producer || !consumer->del_producer)
>  		return -EINVAL;
>  
> @@ -234,7 +234,7 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer)
>  	struct irq_bypass_consumer *tmp;
>  	struct irq_bypass_producer *producer;
>  
> -	if (!consumer->token)
> +	if (!consumer || !consumer->token)
>  		return;
>  
>  	might_sleep();
>