Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932978AbdHVNjJ (ORCPT ); Tue, 22 Aug 2017 09:39:09 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42064 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932833AbdHVNjH (ORCPT ); Tue, 22 Aug 2017 09:39:07 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 805C5806A2 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH] virt/lib avoids oops by adding parameter checking To: nixiaoming , alex.williamson@redhat.com Cc: kvm@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org References: <20170822010753.102857-1-nixiaoming@huawei.com> From: Paolo Bonzini Message-ID: Date: Tue, 22 Aug 2017 15:39:04 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <20170822010753.102857-1-nixiaoming@huawei.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Tue, 22 Aug 2017 13:39:07 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2344 Lines: 70 On 22/08/2017 03:07, nixiaoming wrote: > The error parameter passed through the external interface > causes the system oops. So it is necessary to increase the > parameter check for all EXPORT_SYMBOL_GPL > > example: > int irq_bypass_register_producer(struct irq_bypass_producer *producer) > { > if (!producer->token) /* oops if producer == null */ > return -einval; > } > EXPORT_SYMBOL_GPL(irq_bypass_register_producer); This is used like this: drivers/vfio/pci/vfio_pci_intrs.c: irq_bypass_unregister_producer(&vdev->ctx[vector].producer); drivers/vfio/pci/vfio_pci_intrs.c: ret = irq_bypass_register_producer(&vdev->ctx[vector].producer); virt/kvm/eventfd.c: irq_bypass_unregister_consumer(&irqfd->consumer); virt/kvm/eventfd.c: ret = irq_bypass_register_consumer(&irqfd->consumer); So your check won't actually catch irqfd or vdev being NULL. Paolo > Signed-off-by: nixiaoming > --- > virt/lib/irqbypass.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/virt/lib/irqbypass.c b/virt/lib/irqbypass.c > index 6d2fcd6..2bb99e8 100644 > --- a/virt/lib/irqbypass.c > +++ b/virt/lib/irqbypass.c > @@ -89,7 +89,7 @@ int irq_bypass_register_producer(struct irq_bypass_producer *producer) > struct irq_bypass_producer *tmp; > struct irq_bypass_consumer *consumer; > > - if (!producer->token) > + if (!producer || !producer->token) > return -EINVAL; > > might_sleep(); > @@ -139,7 +139,7 @@ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer) > struct irq_bypass_producer *tmp; > struct irq_bypass_consumer *consumer; > > - if (!producer->token) > + if (!producer || !producer->token) > return; > > might_sleep(); > @@ -183,7 +183,7 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer) > struct irq_bypass_consumer *tmp; > struct irq_bypass_producer *producer; > > - if (!consumer->token || > + if (!consumer || !consumer->token || > !consumer->add_producer || !consumer->del_producer) > return -EINVAL; > > @@ -234,7 +234,7 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) > struct irq_bypass_consumer *tmp; > struct irq_bypass_producer *producer; > > - if (!consumer->token) > + if (!consumer || !consumer->token) > return; > > might_sleep(); >