[PATCH v2] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation

[PATCH v2] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation

[Guangshuo Li]

papr_hvpipe_dev_create_handle() transfers ownership of src_info with
retain_and_null_ptr(src_info) after anon_inode_getfile() succeeds.
However, retain_and_null_ptr() clears src_info immediately, and the
function then still dereferences src_info in the subsequent list_add().

Store the transferred pointer in a separate variable and use that for
the list insertion.

Manually identified during code review.

Fixes: 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Fix the Fixes tag to use the documented 12-character SHA-1 format

 arch/powerpc/platforms/pseries/papr-hvpipe.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/papr-hvpipe.c b/arch/powerpc/platforms/pseries/papr-hvpipe.c
index 14ae480d060a..497eb967611b 100644
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -480,6 +480,7 @@ static const struct file_operations papr_hvpipe_handle_ops = {
 static int papr_hvpipe_dev_create_handle(u32 srcID)
 {
 	struct hvpipe_source_info *src_info __free(kfree) = NULL;
+	struct hvpipe_source_info *owned_src_info;
 
 	spin_lock(&hvpipe_src_list_lock);
 	/*
@@ -509,7 +510,7 @@ static int papr_hvpipe_dev_create_handle(u32 srcID)
 	if (fdf.err)
 		return fdf.err;
 
-	retain_and_null_ptr(src_info);
+	owned_src_info = retain_and_null_ptr(src_info);
 	spin_lock(&hvpipe_src_list_lock);
 	/*
 	 * If two processes are executing ioctl() for the same
@@ -520,7 +521,7 @@ static int papr_hvpipe_dev_create_handle(u32 srcID)
 		spin_unlock(&hvpipe_src_list_lock);
 		return -EALREADY;
 	}
-	list_add(&src_info->list, &hvpipe_src_list);
+	list_add(&owned_src_info->list, &hvpipe_src_list);
 	spin_unlock(&hvpipe_src_list_lock);
 	return fd_publish(fdf);
 }
-- 
2.43.0

Re: [PATCH v2] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation

[Ritesh Harjani]

Guangshuo Li <lgs201920130244@gmail.com> writes:

> papr_hvpipe_dev_create_handle() transfers ownership of src_info with
> retain_and_null_ptr(src_info) after anon_inode_getfile() succeeds.
> However, retain_and_null_ptr() clears src_info immediately, and the
> function then still dereferences src_info in the subsequent list_add().
>
> Store the transferred pointer in a separate variable and use that for
> the list insertion.
>
> Manually identified during code review.

Thanks. Although the fix for this and bunch of other fixes & cleanups
were already queued up for review in here [1].

[1]: https://lore.kernel.org/all/cover.1775648406.git.ritesh.list@gmail.com/

-ritesh

Re: [PATCH v2] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation

[kernel test robot]

Hi Guangshuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on powerpc/next]
[also build test ERROR on powerpc/fixes linus/master v7.0 next-20260421]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/powerpc-pseries-papr-hvpipe-fix-NULL-dereference-in-handle-creation/20260420-224327
base:   https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git next
patch link:    https://lore.kernel.org/r/20260420132429.128075-1-lgs201920130244%40gmail.com
patch subject: [PATCH v2] powerpc/pseries/papr-hvpipe: fix NULL dereference in handle creation
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260422/202604221653.KzDQsCY8-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260422/202604221653.KzDQsCY8-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604221653.KzDQsCY8-lkp@intel.com/

All errors (new ones prefixed by >>):

   arch/powerpc/platforms/pseries/papr-hvpipe.c: In function 'papr_hvpipe_dev_create_handle':
>> arch/powerpc/platforms/pseries/papr-hvpipe.c:513:24: error: invalid use of void expression
     513 |         owned_src_info = retain_and_null_ptr(src_info);
         |                        ^


vim +513 arch/powerpc/platforms/pseries/papr-hvpipe.c

   479	
   480	static int papr_hvpipe_dev_create_handle(u32 srcID)
   481	{
   482		struct hvpipe_source_info *src_info __free(kfree) = NULL;
   483		struct hvpipe_source_info *owned_src_info;
   484	
   485		spin_lock(&hvpipe_src_list_lock);
   486		/*
   487		 * Do not allow more than one process communicates with
   488		 * each source.
   489		 */
   490		src_info = hvpipe_find_source(srcID);
   491		if (src_info) {
   492			spin_unlock(&hvpipe_src_list_lock);
   493			pr_err("pid(%d) is already using the source(%d)\n",
   494					src_info->tsk->pid, srcID);
   495			return -EALREADY;
   496		}
   497		spin_unlock(&hvpipe_src_list_lock);
   498	
   499		src_info = kzalloc_obj(*src_info, GFP_KERNEL_ACCOUNT);
   500		if (!src_info)
   501			return -ENOMEM;
   502	
   503		src_info->srcID = srcID;
   504		src_info->tsk = current;
   505		init_waitqueue_head(&src_info->recv_wqh);
   506	
   507		FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
   508			   anon_inode_getfile("[papr-hvpipe]", &papr_hvpipe_handle_ops,
   509					      (void *)src_info, O_RDWR));
   510		if (fdf.err)
   511			return fdf.err;
   512	
 > 513		owned_src_info = retain_and_null_ptr(src_info);
   514		spin_lock(&hvpipe_src_list_lock);
   515		/*
   516		 * If two processes are executing ioctl() for the same
   517		 * source ID concurrently, prevent the second process to
   518		 * acquire FD.
   519		 */
   520		if (hvpipe_find_source(srcID)) {
   521			spin_unlock(&hvpipe_src_list_lock);
   522			return -EALREADY;
   523		}
   524		list_add(&owned_src_info->list, &hvpipe_src_list);
   525		spin_unlock(&hvpipe_src_list_lock);
   526		return fd_publish(fdf);
   527	}
   528	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki