2010-01-07 22:08:10

by Roel Kluin

Subject: [PATCH] KVM: dereference of NULL pointer in set_pal_result()

Do not dereference a NULL pointer

Signed-off-by: Roel Kluin <[email protected]>
---
arch/ia64/kvm/kvm_fw.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/ia64/kvm/kvm_fw.c b/arch/ia64/kvm/kvm_fw.c
index e4b8231..d28494f 100644
--- a/arch/ia64/kvm/kvm_fw.c
+++ b/arch/ia64/kvm/kvm_fw.c
@@ -75,9 +75,11 @@ static void set_pal_result(struct kvm_vcpu *vcpu,
struct exit_ctl_data *p;

p = kvm_get_exit_data(vcpu);
- if (p && p->exit_reason == EXIT_REASON_PAL_CALL) {
+ if (!p)
+ return;
+ if (p->exit_reason == EXIT_REASON_PAL_CALL) {
p->u.pal_data.ret = result;
- return ;
+ return;
}
INIT_PAL_STATUS_UNIMPLEMENTED(p->u.pal_data.ret);
}

2010-01-07 23:29:13

by Zhang, Xiantao

Subject: RE: [PATCH] KVM: dereference of NULL pointer in set_pal_result()

For the check "(p && p->exit_reason == EXIT_REASON_PAL_CALL", if p is NULL, the reference about "p->exit_reason == EXIT_REASON_PAL_CALL" won't be checked any more, so no issue here.
Xiantao


Roel Kluin wrote:
> Do not dereference a NULL pointer
>
> Signed-off-by: Roel Kluin <[email protected]>
> ---
> arch/ia64/kvm/kvm_fw.c | 6 ++++--
> 1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/ia64/kvm/kvm_fw.c b/arch/ia64/kvm/kvm_fw.c
> index e4b8231..d28494f 100644
> --- a/arch/ia64/kvm/kvm_fw.c
> +++ b/arch/ia64/kvm/kvm_fw.c
> @@ -75,9 +75,11 @@ static void set_pal_result(struct kvm_vcpu *vcpu,
> struct exit_ctl_data *p;
>
> p = kvm_get_exit_data(vcpu);
> - if (p && p->exit_reason == EXIT_REASON_PAL_CALL) {
> + if (!p)
> + return;
> + if (p->exit_reason == EXIT_REASON_PAL_CALL) {
> p->u.pal_data.ret = result;
> - return ;
> + return;
> }
> INIT_PAL_STATUS_UNIMPLEMENTED(p->u.pal_data.ret);
> }

2010-01-08 07:12:06

by Gabor Gombas

Subject: Re: [PATCH] KVM: dereference of NULL pointer in set_pal_result()

On Fri, Jan 08, 2010 at 07:28:57AM +0800, Zhang, Xiantao wrote:

> For the check "(p && p->exit_reason == EXIT_REASON_PAL_CALL", if p is NULL, the reference about "p->exit_reason == EXIT_REASON_PAL_CALL" won't be checked any more, so no issue here.

> > diff --git a/arch/ia64/kvm/kvm_fw.c b/arch/ia64/kvm/kvm_fw.c
> > index e4b8231..d28494f 100644
> > --- a/arch/ia64/kvm/kvm_fw.c
> > +++ b/arch/ia64/kvm/kvm_fw.c
> > @@ -75,9 +75,11 @@ static void set_pal_result(struct kvm_vcpu *vcpu,
> > struct exit_ctl_data *p;
> >
> > p = kvm_get_exit_data(vcpu);
> > - if (p && p->exit_reason == EXIT_REASON_PAL_CALL) {
> > + if (!p)
> > + return;
> > + if (p->exit_reason == EXIT_REASON_PAL_CALL) {
> > p->u.pal_data.ret = result;
> > - return ;
> > + return;
> > }
> > INIT_PAL_STATUS_UNIMPLEMENTED(p->u.pal_data.ret);

IMHO it's not the test but the INIT_PAL_STATUS_UNIMPLEMENTED() that does
the unwanted dereferencing, and that's fixed by the patch.

Gabor

--
---------------------------------------------------------
MTA SZTAKI Computer and Automation Research Institute
Hungarian Academy of Sciences
---------------------------------------------------------

2010-01-08 09:15:16

by Zhang, Xiantao

Subject: RE: [PATCH] KVM: dereference of NULL pointer in set_pal_result()

Gabor Gombas wrote:
> On Fri, Jan 08, 2010 at 07:28:57AM +0800, Zhang, Xiantao wrote:
>
>> For the check "(p && p->exit_reason == EXIT_REASON_PAL_CALL", if p
>> is NULL, the reference about "p->exit_reason ==
>> EXIT_REASON_PAL_CALL" won't be checked any more, so no issue here.
>
>>> diff --git a/arch/ia64/kvm/kvm_fw.c b/arch/ia64/kvm/kvm_fw.c
>>> index e4b8231..d28494f 100644
>>> --- a/arch/ia64/kvm/kvm_fw.c
>>> +++ b/arch/ia64/kvm/kvm_fw.c
>>> @@ -75,9 +75,11 @@ static void set_pal_result(struct kvm_vcpu
>>> *vcpu, struct exit_ctl_data *p;
>>>
>>> p = kvm_get_exit_data(vcpu);
>>> - if (p && p->exit_reason == EXIT_REASON_PAL_CALL) { + if (!p)
>>> + return;
>>> + if (p->exit_reason == EXIT_REASON_PAL_CALL) {
>>> p->u.pal_data.ret = result;
>>> - return ;
>>> + return;
>>> }
>>> INIT_PAL_STATUS_UNIMPLEMENTED(p->u.pal_data.ret);
>
> IMHO it's not the test but the INIT_PAL_STATUS_UNIMPLEMENTED() that
> does the unwanted dereferencing, and that's fixed by the patch.
Make sense.
Xiantao

2010-01-08 12:25:52

by Roel Kluin

Subject: Re: [PATCH] KVM: dereference of NULL pointer in set_pal_result()

>> For the check "(p && p->exit_reason == EXIT_REASON_PAL_CALL", if p is NULL, the reference about "p->exit_reason == EXIT_REASON_PAL_CALL" won't be checked any more, so no issue here.

>> >     p = kvm_get_exit_data(vcpu);
>> > -   if (p && p->exit_reason == EXIT_REASON_PAL_CALL) {
>> > +   if (!p)
>> > +           return;
>> > +   if (p->exit_reason == EXIT_REASON_PAL_CALL) {
>> >             p->u.pal_data.ret = result;
>> > -           return ;
>> > +           return;
>> >     }
>> >     INIT_PAL_STATUS_UNIMPLEMENTED(p->u.pal_data.ret);
>
> IMHO it's not the test but the INIT_PAL_STATUS_UNIMPLEMENTED() that does
> the unwanted dereferencing, and that's fixed by the patch.
>
> Gabor

Correct. Thanks,

Roel