linux-kernel - Re: [PATCH next] Drivers: hv: mshv: Prevent potential NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <38525f8a-823c-4a79-ac55-68a2ef569a85@linux.microsoft.com>
Date: Fri, 21 Mar 2025 09:53:45 -0700
From: Nuno Das Neves <nunodasneves@...ux.microsoft.com>
To: Dan Carpenter <dan.carpenter@...aro.org>,
 "wei.liu@...nel.org" <wei.liu@...nel.org>
Cc: "K. Y. Srinivasan" <kys@...rosoft.com>,
 Haiyang Zhang <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>,
 Dexuan Cui <decui@...rosoft.com>,
 Anirudh Rayabharam <anrayabh@...ux.microsoft.com>,
 Praveen K Paladugu <prapal@...ux.microsoft.com>,
 Stanislav Kinsburskii <skinsburskii@...ux.microsoft.com>,
 linux-hyperv@...r.kernel.org, linux-kernel@...r.kernel.org,
 kernel-janitors@...r.kernel.org
Subject: Re: [PATCH next] Drivers: hv: mshv: Prevent potential NULL
 dereference

On 3/21/2025 7:35 AM, Dan Carpenter wrote:
> Move the NULL check on "partition" before the dereference.
> 
> Fixes: f5288d14069b ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
> ---
>  drivers/hv/mshv_synic.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/hv/mshv_synic.c b/drivers/hv/mshv_synic.c
> index a3daedd680ff..88949beb5e37 100644
> --- a/drivers/hv/mshv_synic.c
> +++ b/drivers/hv/mshv_synic.c
> @@ -151,13 +151,12 @@ static bool mshv_async_call_completion_isr(struct hv_message *msg)
>  	rcu_read_lock();
>  
>  	partition = mshv_partition_find(partition_id);
> -	partition->async_hypercall_status = async_msg->status;
> -
>  	if (unlikely(!partition)) {
>  		pr_debug("failed to find partition %llu\n", partition_id);
>  		goto unlock_out;
>  	}
>  
> +	partition->async_hypercall_status = async_msg->status;
>  	complete(&partition->async_hypercall);
>  
>  	handled = true;

Thanks for catching this one!
Wei could you please apply or squash this into the driver patch?

Thanks
Nuno