From: Juergen Gross <jgross@suse.com>
To: Jan Beulich <jbeulich@suse.com>,
Rustam Subkhankulov <subkhankulov@ispras.ru>
Cc: Stefano Stabellini <sstabellini@kernel.org>,
Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>,
xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org,
Alexey Khoroshilov <khoroshilov@ispras.ru>,
ldv-project@linuxtesting.org
Subject: Re: [POSSIBLE BUG] Dereferencing of NULL pointer
Date: Wed, 24 Aug 2022 16:00:54 +0200 [thread overview]
Message-ID: <0fcf74d8-774f-1999-d508-b8349096d83e@suse.com> (raw)
In-Reply-To: <0f5f26d2-2b22-2a0d-8bb2-ee2e729ada3f@suse.com>
[-- Attachment #1.1.1: Type: text/plain, Size: 809 bytes --]
On 24.08.22 15:59, Jan Beulich wrote:
> On 20.08.2022 19:30, Rustam Subkhankulov wrote:
>> Version: 6.0-rc1
>>
>> Description:
>>
>> In function 'privcmd_ioctl_dm_op' (drivers/xen/privcmd.c: 615)return
>> value of 'kcalloc' with GFP_KERNEL flag is assigned to "pages"
>> variable. GFP_KERNEL flag does not guarantee, that the return value
>> will not be NULL. In that case, there is a jump to the "out" label.
>
> The problem is wider than that, because earlier errors would also
> lead to "out" (e.g. after copy_from_user() failed). Plus I guess
> unlock_pages() shouldn't be called at all (or with its 2nd arg set
> to zero) before lock_pages() was actually called. But I agree with
> the further analysis below. Would you mind sending a patch?
Just started writing it. :-)
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3149 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
prev parent reply other threads:[~2022-08-24 14:01 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-20 17:30 [POSSIBLE BUG] Dereferencing of NULL pointer Rustam Subkhankulov
2022-08-24 13:59 ` Jan Beulich
2022-08-24 14:00 ` Juergen Gross [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0fcf74d8-774f-1999-d508-b8349096d83e@suse.com \
--to=jgross@suse.com \
--cc=jbeulich@suse.com \
--cc=khoroshilov@ispras.ru \
--cc=ldv-project@linuxtesting.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oleksandr_tyshchenko@epam.com \
--cc=sstabellini@kernel.org \
--cc=subkhankulov@ispras.ru \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.