| Message ID | 20170713073829.dqjahnakxqvpne7x@mwanda |
|---|---|
| State | Accepted |
| Headers | show |
On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote: > There are some error paths in kvmppc_core_vcpu_create_e500() where we > forget to set the error code. It means that we return ERR_PTR(0) which > is NULL and it results in a NULL pointer dereference in the caller. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Are these user-triggerable, and therefore needing to go into 4.13 and be back-ported to the stable trees? Or can they wait for 4.14? Paul. -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, Jul 31, 2017 at 04:03:40PM +1000, Paul Mackerras wrote: > On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote: > > There are some error paths in kvmppc_core_vcpu_create_e500() where we > > forget to set the error code. It means that we return ERR_PTR(0) which > > is NULL and it results in a NULL pointer dereference in the caller. > > > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > Are these user-triggerable, and therefore needing to go into 4.13 > and be back-ported to the stable trees? Or can they wait for 4.14? > These are static checker fixes... I imagine that they might be user triggerable with quite a bit of work but it's a only NULL derefence. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jul 13, 2017 at 10:38:29AM +0300, Dan Carpenter wrote: > There are some error paths in kvmppc_core_vcpu_create_e500() where we > forget to set the error code. It means that we return ERR_PTR(0) which > is NULL and it results in a NULL pointer dereference in the caller. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Thanks, both patches applied to my kvm-ppc-next branch. Paul. -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c index 32fdab57d604..f9f6468f4171 100644 --- a/arch/powerpc/kvm/e500.c +++ b/arch/powerpc/kvm/e500.c @@ -455,16 +455,20 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_e500(struct kvm *kvm, if (err) goto free_vcpu; - if (kvmppc_e500_id_table_alloc(vcpu_e500) == NULL) + if (kvmppc_e500_id_table_alloc(vcpu_e500) == NULL) { + err = -ENOMEM; goto uninit_vcpu; + } err = kvmppc_e500_tlb_init(vcpu_e500); if (err) goto uninit_id; vcpu->arch.shared = (void*)__get_free_page(GFP_KERNEL|__GFP_ZERO); - if (!vcpu->arch.shared) + if (!vcpu->arch.shared) { + err = -ENOMEM; goto uninit_tlb; + } return vcpu;
There are some error paths in kvmppc_core_vcpu_create_e500() where we forget to set the error code. It means that we return ERR_PTR(0) which is NULL and it results in a NULL pointer dereference in the caller. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe kvm-ppc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html