lkml.org 
[lkml]   [2020]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] VMCI: Fix NULL pointer dereference on context ptr
Date
The refcount wrapper function vmci_ctx_get() may return NULL
context ptr. Thus, we need to add a NULL pointer check
before its dereference.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
---
drivers/misc/vmw_vmci/vmci_context.c | 2 ++
drivers/misc/vmw_vmci/vmci_queue_pair.c | 17 +++++++++++------
2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
index 16695366ec92..a20878fba374 100644
--- a/drivers/misc/vmw_vmci/vmci_context.c
+++ b/drivers/misc/vmw_vmci/vmci_context.c
@@ -898,6 +898,8 @@ void vmci_ctx_rcv_notifications_release(u32 context_id,
bool success)
{
struct vmci_ctx *context = vmci_ctx_get(context_id);
+ if (context == NULL)
+ return;

spin_lock(&context->lock);
if (!success) {
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 8531ae781195..2ecb22d08692 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -1575,11 +1575,14 @@ static int qp_broker_attach(struct qp_broker_entry *entry,
*/

create_context = vmci_ctx_get(entry->create_id);
- supports_host_qp = vmci_ctx_supports_host_qp(create_context);
- vmci_ctx_put(create_context);
+ if (!create_context) {
+ supports_host_qp =
+ vmci_ctx_supports_host_qp(create_context);
+ vmci_ctx_put(create_context);

- if (!supports_host_qp)
- return VMCI_ERROR_INVALID_RESOURCE;
+ if (!supports_host_qp)
+ return VMCI_ERROR_INVALID_RESOURCE;
+ }
}

if ((entry->qp.flags & ~VMCI_QP_ASYMM) != (flags & ~VMCI_QP_ASYMM_PEER))
@@ -1808,7 +1811,8 @@ static int qp_alloc_host_work(struct vmci_handle *handle,
pr_devel("queue pair broker failed to alloc (result=%d)\n",
result);
}
- vmci_ctx_put(context);
+ if (context)
+ vmci_ctx_put(context);
return result;
}

@@ -1859,7 +1863,8 @@ static int qp_detatch_host_work(struct vmci_handle handle)

result = vmci_qp_broker_detach(handle, context);

- vmci_ctx_put(context);
+ if (context)
+ vmci_ctx_put(context);
return result;
}

--
2.7.4
\
 
 \ /
  Last update: 2020-03-17 07:32    [W:0.121 / U:0.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site