Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 2 May 2023 17:28:10 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Dominique Martinet <asmadeus@codewreck.org>
Cc:     Eric Van Hensbergen <ericvh@gmail.com>,
        Latchesar Ionkov <lucho@ionkov.net>,
        Christian Schoenebeck <linux_oss@crudebyte.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, v9fs@lists.linux.dev,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH 2/5] 9p: virtio: fix unlikely null pointer deref in
 handle_rerror
Message-ID: <ZFEsClxYNiR0CQ7r@corigine.com>
References: <20230427-scan-build-v1-0-efa05d65e2da@codewreck.org>
 <20230427-scan-build-v1-2-efa05d65e2da@codewreck.org>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230427-scan-build-v1-2-efa05d65e2da@codewreck.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cAO9C7frRM3NFiZV8kDsyt64CvVhTPwxhn117P0Bju1Get7gW49qS8AFtAAP?=
 =?us-ascii?Q?5BpfzPiVFtBGdf2ELrT6xkqxOWgt/43r4hlW2hvF5yDuDbuYBiMCSHISEez3?=
 =?us-ascii?Q?kCvj9Ra4sylCdbbmUrihkrJlPUz2V//b6llVZzM6poKPIpOml2d+g8ET87Ad?=
 =?us-ascii?Q?1W5yx0XFo1NMPARlRqK8HsD8OCw3Jx8IWxFjgMvVmJDIKXGX48s7JTIxcS6U?=
 =?us-ascii?Q?y0mR0ZIYAbUeGLdU0iB6M1XQZ7Kpwy+WPPCtBENW87YGH932/V4UM2dP8OFy?=
 =?us-ascii?Q?0IM9tJBqyVnBPwUtFW3VkLX4OM7AqLDNo2DZzxOza1GuDLrArrLNt77ajts6?=
 =?us-ascii?Q?4HTaOiuVEm2d1rKZymAC4AkTCqIgZ6SRQSKkHnz2vgA/nab/aO0w/caFdsoR?=
 =?us-ascii?Q?5IQ2y4ri52n0KNpgb+o4FopunYQwm8bXOhMzCEnyvRTusBS975L3tdrYxeHr?=
 =?us-ascii?Q?DGOG3CB8QTveFQiYz5tJG4zyeE3HEOO+E/laLwdyIrxz2w9wpbuglnOI7XMO?=
 =?us-ascii?Q?XOULd+O/MzKCGDJiXHkZqC/pXIxg5yMUIalk4ZZTIbGIeBmwH6YPxf+YGMQh?=
 =?us-ascii?Q?MMtqQ7qpdN8KLYVBOjrnxHjAOukxVCNwdrh8obxOouAalB8wyQ0URN99uN9L?=
 =?us-ascii?Q?Y/+Rv+FhgfjPx2UVmJa7bRAYaBZQjGSf003AqLIx+H/iltmGO9H1XFh1xm5o?=
 =?us-ascii?Q?rbhWC4AsUTUuVu0iJiIDU8beNEhUrNw3kulNTygr083bxJncI67gNmd0qDnF?=
 =?us-ascii?Q?RTOENRUMZjiJNrvUtVZiSMnD/tpOEKtu2QD5fr3RZnzqRPlsyxUslmCxtSrW?=
 =?us-ascii?Q?P0Fl2Ig4vZrR2ge/6PZMJk0j7R5whkKeR9wUjgyhKvtaHkK8YzsEAbP1Zwaj?=
 =?us-ascii?Q?z+gGBda+8VoIVq0/vlK0VolPnX5A+yBJcWYL/yqE9fO0Mou2qkFCW/S27Ckd?=
 =?us-ascii?Q?LqpSPvztHl7AcoT87wP2fiHPItK0MNX+DMURaAGAGizQy5xx+IaLXOjMD76J?=
 =?us-ascii?Q?xUC9qagQQ58HCCK8lGMi84yYFFih61bGyvUEIukmR7yoA7sIPE6UGcC9OLFd?=
 =?us-ascii?Q?/TW/Sti5PQTyCXvp4xqA2XV3N1vi8pXxrZjdvJU8+/OsvTiFTz15xyYh6vhD?=
 =?us-ascii?Q?opV+4e2yB+WH+zlkgMBjXCoUJSaOs7gOn76khEnugotN1YD2fZ5/olk9LNC+?=
 =?us-ascii?Q?q42Tus3hz72PNwhDGD/YvwcCg2jDJXRUta6JcyZKiovUliU9N7ncxSDHTyiX?=
 =?us-ascii?Q?Z6Wl3JxMvMA6T6U+5XkfGscREntmghDGWKmyrtTsEG/zPwnNtKdODqZ2Bep0?=
 =?us-ascii?Q?ekN+AQOxj3OrDfc/IQmiTwPRgbJWZFLcT4qzG5vsE0koWoAfQM9qkMDIwiXj?=
 =?us-ascii?Q?ge1mc+0ZHZowZh0rTuJElXfeeUSRH++gVxoRZQSdDM/iWt6/tfM/EG5SyVrm?=
 =?us-ascii?Q?9HCf/OawqS/35dYVr+ToGunQlBdyZNqFZiLgdpETS+K6QI/STxdWbTK1ZGDx?=
 =?us-ascii?Q?a8o50wX6h4X+gFBG/BU/fLm+luHtW7p3GJxfZt/6Gs0a7TgRt0Mj7wJlNtQJ?=
 =?us-ascii?Q?NhiTV0M844qaSXuT4PjVPyHjT8dwNuyDgVpSW3gNo3sA5SJIdtNsHZnqnCan?=
 =?us-ascii?Q?aRzZHkSWub+Ii/e33lq9Tj5Xo3Oq5smpKM4B1Td16KrgX0205NAEXA6zTOgC?=
 =?us-ascii?Q?vrvB7A=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ba5eba53-8643-42ae-e5f8-08db4b21d97a
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2023 15:28:15.9303
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Nk1/P3oToTa5sRnUihfDEVLz7N/SiQoVz7+yNJPoH75sKAD4TbdU0HxgL9eCQ+kQM1FjLMIKYURAmR/r+AGHdvaP7Opj/bzMw79SkhoSJ1w=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR13MB3636
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Apr 27, 2023 at 08:23:35PM +0900, Dominique Martinet wrote:
> handle_rerror can dereference the pages pointer, but it is not
> necessarily set for small payloads.
> In practice these should be filtered out by the size check, but
> might as well double-check explicitly.
> 
> This fixes the following scan-build warnings:
> net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer [core.NullDereference]
>                 memcpy_from_page(to, *pages++, offs, n);
>                                      ^~~~~~~~
> net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded from variable 'pages') [core.NullDereference]
>         memcpy_from_page(to, *pages, offs, size);
>                              ^~~~~~
> 
> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>

Reviewed-by: Simon Horman <simon.horman@corigine.com>