linux-kernel - RE: [PATCH v2] VMCI: Fix NULL pointer dereference on context ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MWHPR05MB33760A2F7ABC03DB367B09C2DAF00@MWHPR05MB3376.namprd05.prod.outlook.com>
Date:   Mon, 23 Mar 2020 10:16:43 +0000
From:   Jorgen Hansen <jhansen@...are.com>
To:     'Arnd Bergmann' <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     Xiyu Yang <xiyuyang19@...an.edu.cn>,
        Alexios Zavras <alexios.zavras@...el.com>,
        Allison Randal <allison@...utok.net>,
        Adit Ranadive <aditr@...are.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Vishnu Dasa <vdasa@...are.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "yuanxzhang@...an.edu.cn" <yuanxzhang@...an.edu.cn>,
        "kjlu@....edu" <kjlu@....edu>, Xin Tan <tanxin.ctf@...il.com>
Subject: RE: [PATCH v2] VMCI: Fix NULL pointer dereference on context ptr

> From: Arnd Bergmann [mailto:arnd@...db.de]
> Sent: Monday, March 23, 2020 10:17 AM
> On Mon, Mar 23, 2020 at 9:52 AM Greg Kroah-Hartman
> <gregkh@...uxfoundation.org> wrote:
> >
> > On Mon, Mar 23, 2020 at 04:22:33PM +0800, Xiyu Yang wrote:
> > > A NULL vmci_ctx object may pass to vmci_ctx_put() from its callers.
> >
> > Are you sure this can happen?
> >
> > > Add a NULL check to prevent NULL pointer dereference.
> 
> It looks like this could happen if vmci_ctx_get() returns NULL, which is
> not checked for consistently. Maybe add better error handling to the
> callers that currently don't check for that, to catch problems such as

In the cases, where the return value isn't checked, the return value of
vmci_ctx_get() won't be NULL, as the code won't be reached unless the
context ID has an associated context structure. In the example below,
the caller has obtained the context_id from an active context. That said,
it wouldn't hurt to add either checks or at least a comment as to why
the context won't be NULL in the cases, where it isn't checked today.

> 
> void vmci_ctx_rcv_notifications_release(...)
> {
>         struct vmci_ctx *context = vmci_ctx_get(context_id); /* may be NULL */
>        ...
>        context->pending_doorbell_array = db_handle_array;
>        ...
>        vmci_ctx_put(context);
> }
> 
> Checking only in vmci_ctx_put() is too late.
> 
>      Arnd

Thanks,
Jorgen