Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <396156e8-304e-ed68-8596-ee544dce0373@suse.com>
Date:   Thu, 25 Aug 2022 09:38:52 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.12.0
Subject: Re: [PATCH] xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
Content-Language: en-US
To:     Juergen Gross <jgross@suse.com>
Cc:     Stefano Stabellini <sstabellini@kernel.org>,
        Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
        stable@vger.kernel.org,
        Rustam Subkhankulov <subkhankulov@ispras.ru>,
        xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
References: <20220824142634.20966-1-jgross@suse.com>
From:   Jan Beulich <jbeulich@suse.com>
In-Reply-To: <20220824142634.20966-1-jgross@suse.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?S0tVVXBqRllHRzdKRGs5UXpyS3JSN2pZcldESk1Db3ZSSER5NEt0L1R3emtI?=
 =?utf-8?B?SmlMeEJ0YXBMTUt6QTRpM1FHOXFnNGtabEZVVTJ3cWdqdTJHaFRrQk9kU2xt?=
 =?utf-8?B?cmZRQmRhc2luVHdDalFpRmpBTnE4clROK3VabDMyQ2MwUExRNjZVczJnak1L?=
 =?utf-8?B?TlltVGpoNGpla1RjQkNVcG5JSGlHeExNSWpRT3l6OVdqOVlQekVLMDc3NDN0?=
 =?utf-8?B?WHJMcCtYVmFxWm41L2lMaE1HcVF3OUJRR0RwTlEzaEhuakxBSEg4UnA4a0JG?=
 =?utf-8?B?bDBrRWNWcmJhaWwvZjk3bzNWZmptektpMWN6a1VqR3NJK21qaUgyU21rbzFl?=
 =?utf-8?B?bW5OdmVyMUI4UXJ3VTJhMHFkMk1UcFVOV0hzVDBJdVBpMTZDR29ON3AySVFS?=
 =?utf-8?B?cnVjU0F6T2VjUFhwd0plT1crVmVCVXEwZ1Y0UWNTeXdneFljVVhpM2xhUStP?=
 =?utf-8?B?bUhXVkdSSTVUdnJKeDNnZG0rbHZDdzJtMXZOREFNSkdhY2JZZEp0VDZjU0RR?=
 =?utf-8?B?MzU3d0dXcU9IUTMvUWt3akI3a0c1cUN0aC9iaHVCK0xpQ0lnbHJ2azNEakxh?=
 =?utf-8?B?R1lNT2xCMGdiRjNvWkgweE9GdzN1ckx5VWRiY2Z5ZmJZRnBoTnB3TkV2NUdk?=
 =?utf-8?B?SW9GYjlBTlZ3WEhwMDVKVE1ONVREbXJUMjhuekRJNmk1NDVQYk9reEYzdG9J?=
 =?utf-8?B?S2tqalRLL1BjY3plZkJRVHNtQXB1RjE2NDRMeUVEeEkvUVNIZGpXbldRYkxq?=
 =?utf-8?B?MHhzSlAwVE55OXhyMlhjaW02bFc4NXM2eVFwVW15Q1hQYWRDdllQYmRVNytS?=
 =?utf-8?B?eDRQVFIwTWRuZUFKTVpPeDlJc3JGL0lFRWRDN3RIYWpqdDRQNDk1UFBQMnBs?=
 =?utf-8?B?SXJKTEMrVHdjMnpsZGJkaTlRazAzQXVzdmx1STRVOEF5endZVjREMTJhdytH?=
 =?utf-8?B?RlhXSWFYS3IwTWdsQk1CY29QcGlFd2ZYdzdqTXVFOVo2RlNxL1hORmdENVRz?=
 =?utf-8?B?dEY2RkQ1TGJQM2NWL0VWN3YweW83ZjFhcEtvMytsbFFZdVIyR3RPTzQxbDJl?=
 =?utf-8?B?ZkRsRmVmUlBJbnRsMkhCWGl1MEdKSDl2VTJIaGFzZGNoNkhZOUNCOWEwdS9j?=
 =?utf-8?B?bkZzM0pQMGd3K0ZneW84Y2Y1RHFKL1NHOFY0NUtEN2hvNTZUcnFYc2JpcXMz?=
 =?utf-8?B?Zmp5SFlSOGFiazdkMnB0MnJsZzJ0ZUZ6MWY0eXBkL2NRYm9jWkdOZ3E5SHBz?=
 =?utf-8?B?Sk5PelluUG9VL0lUUEM2RWxhWGRuT0JXanZUZy93aHZJU2xzSmhZNlJ3Z2x5?=
 =?utf-8?B?Q1kvOWtkQ0cxcEJzdTZNRHg4YU54cFNuRHRRaWhBWWpSREVFMXUxYmFjdDJu?=
 =?utf-8?B?dWNwN2NyQ0FpUldaUFVkbjRSZmczVG9jVTlRU0k3dE9pMmJlWUFNSTY5Yk9I?=
 =?utf-8?B?UmhRR3N4VllQV3dDRGwzbmN1TFBneUxMV0owNlYxWFk0U0tmQ044b1ZjUHFa?=
 =?utf-8?B?S0dnRUJGK0V2MzRBczVMWHdCbXdlREhBOTM0RVJEYkJVZlBsSWIzWXA2bEZY?=
 =?utf-8?B?K0wzT2NmYm53MXFEL213SXBWc3ZGMW8zWmxBcko2ZTVCV1dERnNqN1U2TmtV?=
 =?utf-8?B?K2NHbzJBeDRGcWRqRVpkN25ZYnRHRjJhaFBIVE0yV3JZNnlhSGdSTjBkN3I0?=
 =?utf-8?B?OEppN3M0WVFEZ1BDa0xnK3pKTW0wclRHZUJuT044cHBrd0UvYmptakdlTVlL?=
 =?utf-8?B?Z0JFRTZzWDhLL25TYkNTUDN2WnBOcmh1L1RiWlR3WmVtdXFwUmNBMTMvY0F6?=
 =?utf-8?B?OXBsbTZiMnJwRWlpSnpsdEZMUmVRV3VlanJTd2JmZnNDTUtRTDFjRUE0K0lI?=
 =?utf-8?B?dFJ1am95OHd0N1B5TzhVWUQwcUJEbU82MVBnNDkzYlRlQVFHRHRmM3J6a25a?=
 =?utf-8?B?TGM0K1JBbmthK2tzbmRtS0ZzTEVFV1JQUDdjYTNzb1R3LzZtWDYwYXhNQ1gy?=
 =?utf-8?B?UXpCVXRkMmwyNTZrZnYvNzlrTjROSzRpMXd6TGZ1TGVYcVFYR3FsWmtPM3Q3?=
 =?utf-8?B?d2xPKzY2WnlpSFVVai9BZHBkdklYSEpXMUNvN1BmSGdOVG1TTVQ1VVlVdEtG?=
 =?utf-8?Q?gTaT8fju26GCldIoDXNZLJQ58?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7bad9774-940f-40f5-b5ec-08da866cdcf0
X-MS-Exchange-CrossTenant-AuthSource: VE1PR04MB6560.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2022 07:38:54.8949
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: mhgaF4GDiDz+ocX2zMfE5eAmVYzm84xYRF2G2GXErcTwkPRzLveCgzinKAC9k8y0INx+jZiV3SstSxXfRHtp2w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR04MB8570
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 24.08.2022 16:26, Juergen Gross wrote:
> The error exit of privcmd_ioctl_dm_op() is calling unlock_pages()
> potentially with pages being NULL, leading to a NULL dereference.
> 
> Fix that by calling unlock_pages only if lock_pages() was at least
> partially successful.
> 
> Cc: <stable@vger.kernel.org>
> Fixes: ab520be8cd5d ("xen/privcmd: Add IOCTL_PRIVCMD_DM_OP")
> Reported-by: Rustam Subkhankulov <subkhankulov@ispras.ru>
> Signed-off-by: Juergen Gross <jgross@suse.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
albeit I wonder whether you did consider the variant actually
reducing code size (and avoiding the need for yet another label),
...

> --- a/drivers/xen/privcmd.c
> +++ b/drivers/xen/privcmd.c
> @@ -679,7 +679,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
>  	rc = lock_pages(kbufs, kdata.num, pages, nr_pages, &pinned);
>  	if (rc < 0) {
>  		nr_pages = pinned;

... dropping this line and ...

> -		goto out;
> +		goto unlock;
>  	}
>  
>  	for (i = 0; i < kdata.num; i++) {
> @@ -691,8 +691,9 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
>  	rc = HYPERVISOR_dm_op(kdata.dom, kdata.num, xbufs);
>  	xen_preemptible_hcall_end();
>  
> -out:
> + unlock:
>  	unlock_pages(pages, nr_pages);

... passing "pinned" here.

Jan

> + out:
>  	kfree(xbufs);
>  	kfree(pages);
>  	kfree(kbufs);