Messages in this thread Patch in this message | | | From | Xiyu Yang <> | Subject | [PATCH] VMCI: Fix NULL pointer dereference on context ptr | Date | Tue, 17 Mar 2020 14:29:57 +0800 |
| |
The refcount wrapper function vmci_ctx_get() may return NULL context ptr. Thus, we need to add a NULL pointer check before its dereference.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> --- drivers/misc/vmw_vmci/vmci_context.c | 2 ++ drivers/misc/vmw_vmci/vmci_queue_pair.c | 17 +++++++++++------ 2 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c index 16695366ec92..a20878fba374 100644 --- a/drivers/misc/vmw_vmci/vmci_context.c +++ b/drivers/misc/vmw_vmci/vmci_context.c @@ -898,6 +898,8 @@ void vmci_ctx_rcv_notifications_release(u32 context_id, bool success) { struct vmci_ctx *context = vmci_ctx_get(context_id); + if (context == NULL) + return; spin_lock(&context->lock); if (!success) { diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c index 8531ae781195..2ecb22d08692 100644 --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -1575,11 +1575,14 @@ static int qp_broker_attach(struct qp_broker_entry *entry, */ create_context = vmci_ctx_get(entry->create_id); - supports_host_qp = vmci_ctx_supports_host_qp(create_context); - vmci_ctx_put(create_context); + if (!create_context) { + supports_host_qp = + vmci_ctx_supports_host_qp(create_context); + vmci_ctx_put(create_context); - if (!supports_host_qp) - return VMCI_ERROR_INVALID_RESOURCE; + if (!supports_host_qp) + return VMCI_ERROR_INVALID_RESOURCE; + } } if ((entry->qp.flags & ~VMCI_QP_ASYMM) != (flags & ~VMCI_QP_ASYMM_PEER)) @@ -1808,7 +1811,8 @@ static int qp_alloc_host_work(struct vmci_handle *handle, pr_devel("queue pair broker failed to alloc (result=%d)\n", result); } - vmci_ctx_put(context); + if (context) + vmci_ctx_put(context); return result; } @@ -1859,7 +1863,8 @@ static int qp_detatch_host_work(struct vmci_handle handle) result = vmci_qp_broker_detach(handle, context); - vmci_ctx_put(context); + if (context) + vmci_ctx_put(context); return result; } -- 2.7.4
| |