Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1584951832-120773-1-git-send-email-xiyuyang19@fudan.edu.cn> <20200323085241.GA342330@kroah.com>
In-Reply-To: <20200323085241.GA342330@kroah.com>
From:   Arnd Bergmann <arnd@arndb.de>
Date:   Mon, 23 Mar 2020 10:16:50 +0100
Message-ID: <CAK8P3a3B373YcmZncnE-wJz12B+3A5QC9CUrDd72qSw+65MwQg@mail.gmail.com>
Subject: Re: [PATCH v2] VMCI: Fix NULL pointer dereference on context ptr
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc:     Xiyu Yang <xiyuyang19@fudan.edu.cn>,
        Alexios Zavras <alexios.zavras@intel.com>,
        Allison Randal <allison@lohutok.net>,
        Adit Ranadive <aditr@vmware.com>,
        Jorgen Hansen <jhansen@vmware.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Vishnu DASA <vdasa@vmware.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        yuanxzhang@fudan.edu.cn, kjlu@umn.edu,
        Xin Tan <tanxin.ctf@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Mar 23, 2020 at 9:52 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Mar 23, 2020 at 04:22:33PM +0800, Xiyu Yang wrote:
> > A NULL vmci_ctx object may pass to vmci_ctx_put() from its callers.
>
> Are you sure this can happen?
>
> > Add a NULL check to prevent NULL pointer dereference.

It looks like this could happen if vmci_ctx_get() returns NULL, which is
not checked for consistently. Maybe add better error handling to the
callers that currently don't check for that, to catch problems such as

void vmci_ctx_rcv_notifications_release(...)
{
        struct vmci_ctx *context = vmci_ctx_get(context_id); /* may be NULL */
       ...
       context->pending_doorbell_array = db_handle_array;
       ...
       vmci_ctx_put(context);
}

Checking only in vmci_ctx_put() is too late.

     Arnd