forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers
History
Wen Yang 642e26628c pvcalls-front: fix potential null dereference 
[ Upstream commit b471109806 ]

 static checker warning:
    drivers/xen/pvcalls-front.c:373 alloc_active_ring()
    error: we previously assumed 'map->active.ring' could be null
           (see line 357)

drivers/xen/pvcalls-front.c
    351 static int alloc_active_ring(struct sock_mapping *map)
    352 {
    353     void *bytes;
    354
    355     map->active.ring = (struct pvcalls_data_intf *)
    356         get_zeroed_page(GFP_KERNEL);
    357     if (!map->active.ring)
                    ^^^^^^^^^^^^^^^^^
Check

    358         goto out;
    359
    360     map->active.ring->ring_order = PVCALLS_RING_ORDER;
    361     bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
    362                     PVCALLS_RING_ORDER);
    363     if (!bytes)
    364         goto out;
    365
    366     map->active.data.in = bytes;
    367     map->active.data.out = bytes +
    368         XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
    369
    370     return 0;
    371
    372 out:
--> 373     free_active_ring(map);
                                 ^^^
Add null check on map->active.ring before dereferencing it to avoid
any NULL pointer dereferences.

Fixes: 9f51c05dc4 ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
CC: Juergen Gross <jgross@suse.com>
CC: Stefano Stabellini <sstabellini@kernel.org>
CC: Dan Carpenter <dan.carpenter@oracle.com>
CC: xen-devel@lists.xenproject.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-27 10:08:56 +01:00
..
accessibility
acpi acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() 2019-02-27 10:08:54 +01:00
amba
android binder: fix race that allows malicious free of live buffer 2018-12-05 19:32:11 +01:00
ata libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD 2019-02-15 08:10:10 +01:00
atm
auxdisplay auxdisplay: charlcd: fix x/y command parsing 2019-01-13 09:51:03 +01:00
base cacheinfo: Keep the old value if of_property_read_u32 fails 2019-02-12 19:47:26 +01:00
bcma
block block/swim3: Fix -EBUSY error when re-opening device after unmount 2019-02-12 19:47:18 +01:00
bluetooth Bluetooth: hci_bcm: Handle deferred probing for the clock supply 2019-02-12 19:47:13 +01:00
bus
cdrom gdrom: fix a memory leak bug 2019-02-12 19:47:18 +01:00
char char/mwave: fix potential Spectre v1 vulnerability 2019-01-31 08:14:36 +01:00
clk clk: imx6sl: ensure MMDC CH0 handshake is bypassed 2019-02-12 19:47:08 +01:00
clocksource clocksource/drivers/integrator-ap: Add missing of_node_put() 2019-01-26 09:32:42 +01:00
connector
cpufreq cpufreq: check if policy is inactive early in __cpufreq_get() 2019-02-20 10:25:40 +01:00
cpuidle cpuidle: big.LITTLE: fix refcount leak 2019-02-12 19:47:08 +01:00
crypto crypto: ux500 - Use proper enum in hash_set_dma_transfer 2019-02-12 19:47:17 +01:00
dax mm, devm_memremap_pages: fix shutdown handling 2019-01-13 09:51:04 +01:00
dca
devfreq
dio
dma dmaengine: imx-dma: fix wrong callback invoke 2019-02-12 19:47:24 +01:00
dma-buf
edac EDAC, skx_edac: Fix logical channel intermediate decoding 2018-11-13 11:08:44 -08:00
eisa
extcon
firewire
firmware x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls 2019-02-20 10:25:48 +01:00
fmc
fpga fpga: altera-cvp: fix 'bad IO access' on x86_64 2019-02-12 19:46:59 +01:00
fsi fsi: master-ast-cf: select GENERIC_ALLOCATOR 2018-12-17 09:24:35 +01:00
gnss gnss: sirf: fix activation retry handling 2018-12-13 09:16:22 +01:00
gpio gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2 2019-02-27 10:08:49 +01:00
gpu drm/sun4i: backend: add missing of_node_puts 2019-02-27 10:08:56 +01:00
hid HID: debug: fix the ring buffer implementation 2019-02-12 19:47:24 +01:00
hsi
hv Drivers: hv: vmbus: Check for ring when getting debug info 2019-01-31 08:14:36 +01:00
hwmon hwmon: (lm80) Fix missing unlock on error in set_fan_div() 2019-02-23 09:07:26 +01:00
hwspinlock
hwtracing intel_th: msu: Fix an off-by-one in attribute store 2019-01-13 09:51:10 +01:00
i2c i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) 2019-02-12 19:47:11 +01:00
ide ide: fix a typo in the settings proc file name 2019-01-31 08:14:42 +01:00
idle
iio iio: ti-ads8688: Update buffer allocation for timestamps 2019-02-15 08:10:10 +01:00
infiniband RDMA/mthca: Clear QP objects during their allocation 2019-02-27 10:08:54 +01:00
input Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 2019-02-20 10:25:47 +01:00
iommu iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer 2019-02-12 19:47:07 +01:00
ipack
irqchip irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID 2019-02-12 19:47:24 +01:00
isdn isdn: i4l: isdn_tty: Fix some concurrency double-free bugs 2019-02-27 10:08:55 +01:00
leds leds: pwm: silently error out on EPROBE_DEFER 2019-01-13 09:51:08 +01:00
lightnvm lightnvm: pblk: add lock protection to list operations 2019-02-12 19:47:08 +01:00
macintosh
mailbox mailbox: PCC: handle parse error 2018-11-13 11:08:18 -08:00
mcb
md dm thin: fix bug where bio that overwrites thin block ignores FUA 2019-02-20 10:25:49 +01:00
media media: coda: fix H.264 deblocking filter controls 2019-02-12 19:47:07 +01:00
memory memory: ti-aemif: fix a potential NULL-pointer dereference 2018-09-06 10:04:07 -07:00
memstick memstick: Prevent memstick host from getting runtime suspended during card detection 2019-02-12 19:47:10 +01:00
message
mfd mfd: mc13xxx: Fix a missing check of a register-read failure 2019-02-27 10:08:52 +01:00
misc eeprom: at24: add support for 24c2048 2019-02-20 10:25:35 +01:00
mmc mmc: meson-gx: fix interrupt name 2019-02-23 09:07:26 +01:00
mtd mtd: rawnand: gpmi: fix MX28 bus master lockup problem 2019-02-15 08:10:10 +01:00
mux mux: adgs1408: use the correct MODULE_LICENSE 2018-10-12 17:36:39 +02:00
net net: stmmac: Prevent RX starvation in stmmac_napi_poll() 2019-02-27 10:08:54 +01:00
nfc NFC: nfcmrvl_uart: fix OF child-node lookup 2018-11-13 11:08:48 -08:00
ntb
nubus
nvdimm mm, devm_memremap_pages: fix shutdown handling 2019-01-13 09:51:04 +01:00
nvme nvme: pad fake subsys NQN vid and ssvid with zeros 2019-02-20 10:25:41 +01:00
nvmem nvmem: check the return value of nvmem_add_cells() 2018-11-13 11:08:35 -08:00
of of: overlay: do not duplicate properties from overlay for new nodes 2019-02-06 17:30:16 +01:00
opp OPP: Use opp_table->regulators to verify no regulator case 2019-02-12 19:47:08 +01:00
oprofile
parisc
parport
pci PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter 2019-02-23 09:07:26 +01:00
pcmcia pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges 2018-11-13 11:08:17 -08:00
perf perf: arm_spe: handle devm_kasprintf() failure 2019-02-12 19:47:03 +01:00
phy phy: sun4i-usb: add support for missing USB PHY index 2019-02-12 19:47:09 +01:00
pinctrl pinctrl: cherryview: fix Strago DMI workaround 2019-02-15 08:10:11 +01:00
platform platform/x86: mlx-platform: Fix tachometer registers 2019-02-12 19:47:08 +01:00
pnp
power power: supply: olpc_battery: correct the temperature units 2019-01-13 09:51:10 +01:00
powercap
pps
ps3
ptp ptp: Fix pass zero to ERR_PTR() in ptp_clock_register 2019-02-12 19:47:01 +01:00
pwm
rapidio
ras
regulator regulator: fix crash caused by null driver data 2018-09-20 09:04:51 -07:00
remoteproc remoteproc: qcom: q6v5: Propagate EPROBE_DEFER 2018-11-13 11:08:52 -08:00
reset
rpmsg rpmsg: smd: fix memory leak on channel create 2018-11-13 11:08:55 -08:00
rtc rtc: m41t80: Correct alarm month range with RTC reads 2019-01-09 17:38:48 +01:00
s390 s390/zcrypt: fix specification exception on z196 during ap probe 2019-02-20 10:25:48 +01:00
sbus drivers/sbus/char: add of_node_put() 2018-12-21 14:15:17 +01:00
scsi scsi: cxgb4i: add wait_for_completion() 2019-02-27 10:08:55 +01:00
sfi
sh
siox
slimbus slimbus: ngd: mark PM functions as __maybe_unused 2018-12-19 19:19:49 +01:00
sn
soc soc: bcm: brcmstb: Don't leak device tree node reference 2019-02-12 19:47:03 +01:00
soundwire
spi spi: bcm2835: Unbreak the build of esoteric configs 2019-01-09 17:38:49 +01:00
spmi
ssb
staging staging: speakup: fix tty-operation NULL derefs 2019-02-12 19:47:25 +01:00
target scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes 2019-02-27 10:08:55 +01:00
tc TC: Set DMA masks for devices 2018-11-13 11:08:51 -08:00
tee tee: optee: avoid possible double list_del() 2019-02-12 19:47:08 +01:00
thermal thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set 2019-02-12 19:47:21 +01:00
thunderbolt thunderbolt: Prevent root port runtime suspend during NVM upgrade 2018-12-17 09:24:36 +01:00
tty serial: sh-sci: Do not free irqs that have already been freed 2019-02-12 19:47:26 +01:00
uio uio: Fix an Oops on load 2018-11-27 16:13:09 +01:00
usb usb: gadget: musb: fix short isoc packets with inventra dma 2019-02-12 19:47:25 +01:00
uwb
vfio vfio/type1: Fix unmap overflow off-by-one 2019-01-16 22:04:34 +01:00
vhost vhost: return EINVAL if iovecs size does not match the message size 2019-02-27 10:08:56 +01:00
video backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables 2019-02-27 10:08:50 +01:00
virt vbox: fix link error with 'gcc -Og' 2019-02-12 19:46:59 +01:00
virtio
visorbus
vlynq
vme
w1 w1: omap-hdq: fix missing bus unregister at removal 2018-11-13 11:08:48 -08:00
watchdog watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem 2019-02-27 10:08:52 +01:00
xen pvcalls-front: fix potential null dereference 2019-02-27 10:08:56 +01:00
zorro
Kconfig
Makefile