lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <1547519487-27586-1-git-send-email-wen.yang99@zte.com.cn> Date: Tue, 15 Jan 2019 10:31:27 +0800 From: Wen Yang <wen.yang99@....com.cn> To: boris.ostrovsky@...cle.com Cc: jgross@...e.com, sstabellini@...nel.org, xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org, xue.zhihong@....com.cn, wang.yi59@....com.cn, Wen Yang <wen.yang99@....com.cn>, Dan Carpenter <dan.carpenter@...cle.com> Subject: [PATCH v2] pvcalls-front: fix potential null dereference static checker warning: drivers/xen/pvcalls-front.c:373 alloc_active_ring() error: we previously assumed 'map->active.ring' could be null (see line 357) drivers/xen/pvcalls-front.c 351 static int alloc_active_ring(struct sock_mapping *map) 352 { 353 void *bytes; 354 355 map->active.ring = (struct pvcalls_data_intf *) 356 get_zeroed_page(GFP_KERNEL); 357 if (!map->active.ring) ^^^^^^^^^^^^^^^^^ Check 358 goto out; 359 360 map->active.ring->ring_order = PVCALLS_RING_ORDER; 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 362 PVCALLS_RING_ORDER); 363 if (!bytes) 364 goto out; 365 366 map->active.data.in = bytes; 367 map->active.data.out = bytes + 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); 369 370 return 0; 371 372 out: --> 373 free_active_ring(map); ^^^ Add null check on map->active.ring before dereferencing it to avoid any NULL pointer dereferences. Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock") Reported-by: Dan Carpenter <dan.carpenter@...cle.com> Suggested-by: Boris Ostrovsky <boris.ostrovsky@...cle.com> Signed-off-by: Wen Yang <wen.yang99@....com.cn> CC: Boris Ostrovsky <boris.ostrovsky@...cle.com> CC: Juergen Gross <jgross@...e.com> CC: Stefano Stabellini <sstabellini@...nel.org> CC: Dan Carpenter <dan.carpenter@...cle.com> CC: xen-devel@...ts.xenproject.org CC: linux-kernel@...r.kernel.org --- v2->v1: - Add NULL check on map->active.ring and return immediately if it is. drivers/xen/pvcalls-front.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c index 307861f..8a249c9 100644 --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock) static void free_active_ring(struct sock_mapping *map) { + if (!map->active.ring) + return; + free_pages((unsigned long)map->active.data.in, map->active.ring->ring_order); free_page((unsigned long)map->active.ring); -- 2.9.5
Powered by blists - more mailing lists