hw/s390x: prevent potential NULL dereference

[PATCH] hw/s390x: prevent potential NULL dereference

Oleg Sviridov posted 1 patch 5 months, 4 weeks ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20240529113643.3638618-1-oleg.sviridov@red-soft.ru

Maintainers: Christian Borntraeger <borntraeger@linux.ibm.com>, Thomas Huth <thuth@redhat.com>, Halil Pasic <pasic@linux.ibm.com>, Eric Farman <farman@linux.ibm.com>, Richard Henderson <richard.henderson@linaro.org>, David Hildenbrand <david@redhat.com>, Ilya Leoshkevich <iii@linux.ibm.com>

hw/s390x/ipl.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH] hw/s390x: prevent potential NULL dereference

Posted by Oleg Sviridov 5 months, 4 weeks ago

Pointer, returned from function 's390_ipl_get_iplb_pv', may be NULL and is dereferenced immediately after.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru>
---
 hw/s390x/ipl.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index e934bf89d1..2fa6a340a1 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -706,9 +706,14 @@ int s390_ipl_prepare_pv_header(Error **errp)
 {
     IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
     IPLBlockPV *ipib_pv = &ipib->pv;
-    void *hdr = g_malloc(ipib_pv->pv_header_len);
+    void *hdr;
     int rc;
 
+    if (!ipib_pv) {
+        return -1;
+    }
+
+    hdr = g_malloc(ipib_pv->pv_header_len);
     cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
                              ipib_pv->pv_header_len);
     rc = s390_pv_set_sec_parms((uintptr_t)hdr, ipib_pv->pv_header_len, errp);
@@ -722,6 +727,10 @@ int s390_ipl_pv_unpack(void)
     IPLBlockPV *ipib_pv = &ipib->pv;
     int i, rc = 0;
 
+    if (!ipib_pv) {
+        return -1;
+    }
+
     for (i = 0; i < ipib_pv->num_comp; i++) {
         rc = s390_pv_unpack(ipib_pv->components[i].addr,
                             TARGET_PAGE_ALIGN(ipib_pv->components[i].size),
-- 
2.44.0

Re: [PATCH] hw/s390x: prevent potential NULL dereference

Posted by Philippe Mathieu-Daudé 5 months, 4 weeks ago

Hi Oleg,

On 29/5/24 13:36, Oleg Sviridov wrote:
> Pointer, returned from function 's390_ipl_get_iplb_pv', may be NULL and is dereferenced immediately after.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Oleg Sviridov <oleg.sviridov@red-soft.ru>
> ---
>   hw/s390x/ipl.c | 11 ++++++++++-
>   1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index e934bf89d1..2fa6a340a1 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -706,9 +706,14 @@ int s390_ipl_prepare_pv_header(Error **errp)
>   {
>       IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
>       IPLBlockPV *ipib_pv = &ipib->pv;

I suppose ipib_pv being NULL here is a bug elsewhere. You should
add here:

        assert(ipib_pv);

and look at the backtrace or audit the code.

> -    void *hdr = g_malloc(ipib_pv->pv_header_len);
> +    void *hdr;
>       int rc;
>   
> +    if (!ipib_pv) {

(If this is a legit error you have to set errp here before returning).

> +        return -1;
> +    }
> +
> +    hdr = g_malloc(ipib_pv->pv_header_len);
>       cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
>                                ipib_pv->pv_header_len);
>       rc = s390_pv_set_sec_parms((uintptr_t)hdr, ipib_pv->pv_header_len, errp);
> @@ -722,6 +727,10 @@ int s390_ipl_pv_unpack(void)
>       IPLBlockPV *ipib_pv = &ipib->pv;
>       int i, rc = 0;
>   

Ditto assert.

> +    if (!ipib_pv) {
> +        return -1;
> +    }
> +
>       for (i = 0; i < ipib_pv->num_comp; i++) {
>           rc = s390_pv_unpack(ipib_pv->components[i].addr,
>                               TARGET_PAGE_ALIGN(ipib_pv->components[i].size),