Re: [RFC v1 1/6] pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle

[Christian Brauner <brauner@kernel.org>]

On Tue, Apr 07, 2026 at 08:01:35PM +0530, Ritesh Harjani (IBM) wrote:
> Getting the following kernel panic in papr_hvpipe_dev_create_handle()
> when trying to add src_info to the list.
>  Kernel attempted to write user page (0) - exploit attempt? (uid: 0)
>  BUG: Kernel NULL pointer dereference on write at 0x00000000
>  Faulting instruction address: 0xc0000000001b44a0
>  Oops: Kernel access of bad area, sig: 11 [#1]
>  ...
>  Call Trace:
>  papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable)
>  sys_ioctl+0x528/0x1064
>  system_call_exception+0x128/0x360
>  system_call_vectored_common+0x15c/0x2ec
> 
> The error handling with FD_PREPARE's file cleanup and __free(kfree) auto
> cleanup is getting too convoluted. This is mainly because we need to
> ensure only 1 user get the srcID handle. To simplify this, we allocate
> prepare the src_info in the beginning and add it to the global list
> under a spinlock after checking that no duplicates exist.
> 
> This simplify the error handling where if the FD_ADD fails, we can
> simply remove the src_info from the list.
> 
> Cc: Christian Brauner <brauner@kernel.org>
> Fixes: 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()")
> Reported-by: Haren Myneni <haren@linux.ibm.com>
> Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> ---

Thanks for fixing this!
Reviewed-by: Christian Brauner <brauner@kernel.org>