Skip to contentSkip to conversation

kvm: Fix NULL dereference doing kvm_create_vm()

PATCH In review Dan Carpenter 4 participants 4 messages Nov 6, 2019 – Nov 9, 2019

Subsystems (2)
KVM Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 kvm: Fix NULL dereference doing kvm_create_vm()

If init_srcu_struct() or init_srcu_struct() fails then this function returns ERR_PTR(0) which is NULL. It leads to a NULL dereference in the caller.

Fixes 9121923c457d ("kvm: Allocate memslots and buses before calling kvm_arch_init_vm")
Signed-off-by Dan Carpenter <[email protected]>
---
 virt/kvm/kvm_main.c | 1 +
 1 file changed, 1 insertion(+)
virt/kvm/kvm_main.c +1 -0
index d16d2054e937..91971811fa5f 100644
@@ -675,6 +675,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
 	INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
 #endif
 
+	r = -ENOMEM;
 	if (init_srcu_struct(&kvm->srcu))
 		goto out_err_no_srcu;
 	if (init_srcu_struct(&kvm->irq_srcu))
Signature · 1 line
2.20.1
#1 lore raw

The same patch was already sent by Wanpeng Li.

See
https://lore.kernel.org/lkml/[email protected]/

Quoted 23 lines · Dan Carpenter

If init_srcu_struct() or init_srcu_struct() fails then this function returns ERR_PTR(0) which is NULL. It leads to a NULL dereference in the caller.

Fixes 9121923c457d ("kvm: Allocate memslots and buses before calling kvm_arch_init_vm")
Signed-off-by Dan Carpenter <[email protected]>
---
 virt/kvm/kvm_main.c | 1 +
 1 file changed, 1 insertion(+)
virt/kvm/kvm_main.c +1 -0
index d16d2054e937..91971811fa5f 100644
@@ -675,6 +675,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
 	INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
 #endif
 
+	r = -ENOMEM;
 	if (init_srcu_struct(&kvm->srcu))
 		goto out_err_no_srcu;
 	if (init_srcu_struct(&kvm->irq_srcu))
#3 lore raw
Quoted 9 lines · Paolo Bonzini
Quoted 4 lines · Christian Borntraeger

The same patch was already sent by Wanpeng Li.

See
https://lore.kernel.org/lkml/[email protected]/

I'm also going to send a somewhat different version today (hopefully). Stay tuned...

You can move forward if patches there.

Wanpeng