[bug report] VSOCK: Introduce vhost_vsock.ko

[bug report] VSOCK: Introduce vhost_vsock.ko

[Dan Carpenter]

Hello Asias He,

The patch 433fc58e6bf2: "VSOCK: Introduce vhost_vsock.ko" from Jul
28, 2016, leads to the following static checker warning:

	drivers/vhost/vsock.c:343 vhost_vsock_handle_tx_kick()
	error: dereferencing freed memory 'pkt'

drivers/vhost/vsock.c
   330  
   331                  pkt = vhost_vsock_alloc_pkt(vq, out, in);
   332                  if (!pkt) {
   333                          vq_err(vq, "Faulted on pkt\n");
   334                          continue;
   335                  }
   336  
   337                  /* Only accept correctly addressed packets */
   338                  if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
   339                          virtio_transport_recv_pkt(pkt);
   340                  else
   341                          virtio_transport_free_pkt(pkt);
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   342  
   343                  vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
                                                                    ^^^^^^^^
   344                  added = true;
   345          }
   346  
   347  no_more_replies:
   348          if (added)
   349                  vhost_signal(&vsock->dev, vq);
   350  
   351  out:
   352          mutex_unlock(&vq->mutex);
   353  }

regards,
dan carpenter

Re: [bug report] VSOCK: Introduce vhost_vsock.ko

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1509 bytes --]

On Wed, Aug 03, 2016 at 11:31:08AM +0300, Dan Carpenter wrote:
> Hello Asias He,
> 
> The patch 433fc58e6bf2: "VSOCK: Introduce vhost_vsock.ko" from Jul
> 28, 2016, leads to the following static checker warning:
> 
> 	drivers/vhost/vsock.c:343 vhost_vsock_handle_tx_kick()
> 	error: dereferencing freed memory 'pkt'
> 
> drivers/vhost/vsock.c
>    330  
>    331                  pkt = vhost_vsock_alloc_pkt(vq, out, in);
>    332                  if (!pkt) {
>    333                          vq_err(vq, "Faulted on pkt\n");
>    334                          continue;
>    335                  }
>    336  
>    337                  /* Only accept correctly addressed packets */
>    338                  if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
>    339                          virtio_transport_recv_pkt(pkt);
>    340                  else
>    341                          virtio_transport_free_pkt(pkt);
>                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    342  
>    343                  vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
>                                                                     ^^^^^^^^
>    344                  added = true;
>    345          }
>    346  
>    347  no_more_replies:
>    348          if (added)
>    349                  vhost_signal(&vsock->dev, vq);
>    350  
>    351  out:
>    352          mutex_unlock(&vq->mutex);
>    353  }

Thanks Dan, I will send a patch.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 473 bytes --]