From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37774) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fVHMw-0002nl-EM for qemu-devel@nongnu.org; Tue, 19 Jun 2018 10:12:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fVHMr-0006wS-N3 for qemu-devel@nongnu.org; Tue, 19 Jun 2018 10:12:26 -0400 Received: from forwardcorp1g.cmail.yandex.net ([2a02:6b8:0:1465::fd]:38375) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fVHMr-0006sR-AJ for qemu-devel@nongnu.org; Tue, 19 Jun 2018 10:12:21 -0400 Date: Tue, 19 Jun 2018 17:12:16 +0300 From: Dima Stepanov Message-ID: <20180619141216.GA16512@dimastep-nix> References: <1528877995-5043-1-git-send-email-dimastep@yandex-team.ru> <1528877995-5043-3-git-send-email-dimastep@yandex-team.ru> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1528877995-5043-3-git-send-email-dimastep@yandex-team.ru> Subject: Re: [Qemu-devel] [PATCH v2 2/2] memory: fix possible NULL pointer dereference List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: wrfsh@yandex-team.ru, pbonzini@redhat.com Ping. I believe i forgot to add the maintainer to CC. + pbonzini@redhat.com Regards, Dima. On Wed, Jun 13, 2018 at 11:19:55AM +0300, Dima Stepanov wrote: > In the memory_region_do_invalidate_mmio_ptr() routine the section > variable is intialized by the memory_region_find() call. The section.mr > field can be set to NULL. > > Add the check for NULL before trying to drop a section. > > Signed-off-by: Dima Stepanov > --- > memory.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/memory.c b/memory.c > index 3212acc..bb45248 100644 > --- a/memory.c > +++ b/memory.c > @@ -2712,7 +2712,7 @@ static void memory_region_do_invalidate_mmio_ptr(CPUState *cpu, > /* Reset dirty so this doesn't happen later. */ > cpu_physical_memory_test_and_clear_dirty(offset, size, 1); > > - if (section.mr != mr) { > + if (section.mr && (section.mr != mr)) { > /* memory_region_find add a ref on section.mr */ > memory_region_unref(section.mr); > if (MMIO_INTERFACE(section.mr->owner)) { > -- > 2.7.4 > >